CompTIA CySA+ (CS0-003) — Question 127

Which of the following should be updated after a lessons-learned review?

Answer options

• A. Disaster recovery plan
• B. Business continuity plan
• C. Tabletop exercise
• D. Incident response plan

Correct answer: D

Explanation

The correct answer is D because the incident response plan needs to incorporate insights gained from the lessons-learned review to improve future responses. The other options, while important, do not specifically relate to immediate changes based on the review's outcomes.