Post-Investigation Actions: Root Cause Analysis in Incident Response

Given a scenario, perform incident response activities

Which of the following actions would an analyst most likely perform after an incident has been investigated?

Risk assessment
Root cause analysis Correct Answer
Incident response plan
Tabletop exercise

Answer Correct answer: B — Perform root cause analysis to determine the underlying factors of the incident.

Community Insight

The exam often distinguishes between the investigation (what happened) and the subsequent analysis (why it happened), where root cause analysis is performed to prevent recurrence.

This question tests the correct sequencing of incident response activities, specifically identifying root cause analysis as a key post-investigation step for understanding why an incident occurred.

Many learners choose 'Incident response plan' because they confuse updating documentation with the analytical process of determining causes after an event has been contained and investigated.

Community Discussion (9 comments)

Berro_b 👍 1 Selected: B

Root cause analysis: Determines WHY the incident happened Incident response plan: Documents how the organization should respond to incidents

EfaChux 👍 2 Selected: C

The option B is a funny answer, because the root cause is part of the investigation. You can't say an investigation has been concluded if the root cause wasn't part of the investigation. After investigating an incident the next step would ideally be to respond to the incident using the findings of the investigation; however we can also argue that the investigation should for a part of the IRP.

Chalice 👍 3

It took me a bit to agree with root cause as the answer but after a while I got it. The root cause is the why it happened not what happened. The investigation covers the what and after that is concluded, then you focus on the why.

Tdarling77 👍 1

Answer D: Tabletop exercise. Here's my rationale: Conducting a risk assessment, root cause analysis, and developing an incident response plan are activities typically carried out before or during an incident investigation, rather than afterward. A risk assessment involves identifying, analyzing, and evaluating potential risks to the organization. Root cause analysis entails identifying the fundamental reasons behind an incident. An incident response plan outlines roles, responsibilities, procedures, and resources for responding to incidents. My emphasis is on the timing of these actions, which occur before or during, not after, an incident investigation.

VVV4WIN 👍 3

After an incident has been remediated? Is that what they mean? If it has only been investigated, then has it only been discovered? Then IRP must occur..... But knowing CompTiA it is probably B

👍 7 Selected: B

B A) risk assessment: done prior to an incident. This is a separate process outside of incident response B) Correct. After the incident, this is part of the lessons learned. Why did this happen? C) IRP this doesn't make sense in the context of the question D) tabletops are done to simulate an incident, preemptive. Not afterwards

Sebatian20 👍 1

Investigate isn't fixing the issue. IRP is the only answer as you need to fix the problem before before you can do a lesson learn. This isn't a well worded question though; typical of Comptia.

Frog_Man 👍 1

If an incident has been investigated, A and B should be complete and D does not apply. I say C. After the investigation has been completed, then we do a lessons learned and update the IRP as applicable.

kmordalv 👍 7 Selected: B

After an incident has been investigated, one of the most important actions is to perform a root cause analysis. Root cause analysis helps in identifying the underlying reasons or factors that led to the incident in the first place. By understanding the root causes, organizations can implement corrective actions to prevent similar incidents from occurring in the future. This analysis is crucial for improving the overall security posture and resilience of the organization. The options A, C and D are typically done before an incident occurs

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Correct answer: B — Root cause analysis is the systematic process used to identify the underlying reasons for an incident after the immediate investigation is complete. This step is crucial for the 'lessons learned' phase, allowing organizations to implement corrective actions that prevent similar future occurrences.

Why the Other Options Are Wrong

Risk assessment (A) is a proactive activity performed before incidents occur to identify potential threats. An Incident response plan (C) is a pre-defined document created during the preparation phase; while it may be updated later, performing the plan itself is not a post-investigation action. Tabletop exercises (D) are simulated training events conducted during the preparation phase to test readiness, not a real-world action taken after an actual incident.

Community Comment Notes

Community consensus strongly supports Root Cause Analysis. As one user noted, "Root cause analysis helps in identifying the underlying reasons or factors that led to the incident." Another commenter clarified the distinction: "The root cause is the why it happened not what happened. The investigation covers the what and after that is concluded, then you focus on the why." Some confusion exists regarding whether IRP updates happen here, but the primary analytical task is RCA.

Exam Strategy

Always check the timeline of incident response phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. If the question states the incident has been 'investigated,' look for actions related to learning and prevention, such as Root Cause Analysis or updating policies based on lessons learned.

Frequently Asked Questions

Is root cause analysis part of the investigation?

While closely related, CompTIA often treats the 'investigation' as determining what happened, and 'root cause analysis' as the subsequent deep-dive into why it happened during the post-incident phase.

When should an Incident Response Plan be updated?

IRPs are updated during the post-incident activity phase based on lessons learned from root cause analysis, but the update itself is not the immediate action of analyzing the specific incident.

More CS0-003 FAQ →

Related Analysis

← Back to CS0-003 Study Guide