CompTIA CySA+ Cybersecurity Analyst Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  This is the lessons-learned phase—the point where you analyze what worked, what didn’t, and what needs to change so the next incident is handled faster and more effectively. It’s the only option focused on improving the IR process itself.

• 1

  the purpose of the question is to improve future incident response

• Chose B2

  The answer is B - Schedule a review with all teams to discuss what occurred.