CompTIA Security+ (SY0-701) — Question 87

Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

Answer options

• A. Preparation
• B. Recovery
• C. Lessons learned
• D. Analysis

Correct answer: A

Explanation

The correct answer is A, Preparation, as this phase includes establishing roles and responsibilities to effectively respond to incidents. The other options, such as Recovery and Lessons learned, occur after incidents have taken place and do not focus on defining roles prior to an incident.