CompTIA CySA+ (CS0-003) — Question 450

Which of the following actions would an analyst most likely perform after an incident has been investigated?

Answer options

• A. Risk assessment
• B. Root cause analysis
• C. Incident response plan
• D. Tabletop exercise

Correct answer: B

Explanation

The correct answer is B, as a Root Cause Analysis is crucial for understanding the underlying issues that led to the incident. While a Risk Assessment (A) evaluates potential future risks, and an Incident Response Plan (C) is about preparing for future incidents, and a Tabletop Exercise (D) is a training method, they do not directly address understanding the specific cause of the incident that has just been investigated.