CompTIA Security Exam Practice Questions Sample SY0 501 Q393

After a security incident, management is meeting with involved employees to document the incident and its aftermath.
Which of the following BEST describes this phase of the incident response process?

A. Lessons learned
B. Recovery
C. Identification
D. Preparation

Correct Answer: A