CS0-003 Question 150

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Root cause analysis: Determines WHY the incident happened Incident response plan: Documents how the organization should respond to incidents

• Chose C2

  The option B is a funny answer, because the root cause is part of the investigation. You can't say an investigation has been concluded if the root cause wasn't part of the investigation. After investigating an incident the next step would ideally be to respond to the incident using the findings of the investigation; however we can also argue that the investigation should for a part of the IRP.

• 3

  It took me a bit to agree with root cause as the answer but after a while I got it. The root cause is the why it happened not what happened. The investigation covers the what and after that is concluded, then you focus on the why.