SY0-701 Question 58

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  I think the best way of looking at this question is "attempts to understand". That is almost the very definition of "analysis".

• Chose A1

  Analysis in incident response involves: Determining the root cause of the incident. Identifying the attack vector (how the breach occurred). Reviewing logs, artifacts, and evidence to understand the source.

• Chose A7

  In the Analysis phase, the team examines logs, network traffic, artifacts, and other relevant data to determine: The root cause of the incident How the incident occurred The systems and data affected Indicators of Compromise (IOCs) Possible paths for remediation and prevention