CompTIA Security+ (SY0-601) — Question 289

Which of the following processes would most likely help an organization that has conducted an incident response exercise to improve performance and identify challenges?

Answer options

• A. Lessons learned
• B. Identification
• C. Simulation
• D. Containment

Correct answer: A

Explanation

The 'Lessons learned' process is critical after an incident response exercise as it allows the organization to analyze what worked, what didn’t, and how to improve in the future. The other options, while relevant in their own contexts, do not specifically focus on reviewing and enhancing responses based on past experiences.