CompTIA CASP+ (CAS-004) — Question 244

An employee's device was missing for 96 hours before being reported. The employee called the help desk to ask for another device. Which of the following phases of the incident response cycle needs improvement?

Answer options

• A. Containment
• B. Preparation
• C. Resolution
• D. Investigation

Correct answer: B

Explanation

The correct answer is B, Preparation, because there should be protocols in place for promptly reporting lost devices to minimize downtime. The other options, such as Containment, Resolution, and Investigation, pertain to responses after an incident has been reported, which highlights the need for better preparation and awareness among employees.