CompTIA Security+ (SY0-601) — Question 602
Which of the following is the final step of the incident response process?
Answer options
- A. Lessons learned
- B. Eradication
- C. Containment
- D. Recovery
Correct answer: A
Explanation
The correct answer is A, Lessons learned, as this step involves reviewing and analyzing the incident to improve future responses. The other options, such as Eradication, Containment, and Recovery, are important steps in addressing the incident but occur before the lessons learned phase.