CompTIA Security+ (SY0-701) — Question 216

Which of the following phases of an incident response involves generating reports?

Answer options

• A. Recovery
• B. Preparation
• C. Lessons learned
• D. Containment

Correct answer: C

Explanation

The correct answer is C, as the 'Lessons learned' phase focuses on reviewing the incident and documenting findings, including generating reports. The other options, such as Recovery, Preparation, and Containment, do not specifically emphasize the reporting aspect of the incident response process.