Câu 197: SY0-601: CompTIA Security+ 2021

A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?

1. A. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future. — đáp án hiện tại
2. B. It returns the affected systems back into production once systems have been fully patched, data restored, and vulnerabilities addressed.
3. C. It identifies the incident and the scope of the breach, how it affects the production environment, and the ingress point.
4. D. It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach.