CompTIA Security+ (SY0-501) — Question 935

After an identified security breach, an analyst is tasked to initiate the IR process. Which of the following is the NEXT step the analyst should take?

Answer options

• A. Recovery
• B. Identification
• C. Preparation
• D. Documentation
• E. Escalation

Correct answer: B

Explanation

The next step in the Incident Response process after a breach is Identification, as it involves determining the nature and scope of the incident. Recovery, Preparation, Documentation, and Escalation are important but occur at different stages in the process, making them incorrect as the immediate next step.