When are Roles and Responsibilities Reviewed in Incident Response?

SY0-701 By islever Editorial Last updated

Short answer

A Preparation

Question

Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
  1. Preparation Correct Answer
  2. Recovery
  3. Lessons learned
  4. Analysis

Key Takeaways

This question tests the distinction between establishing procedures (Preparation) and analyzing past events (Lessons Learned), with the common trap being the assumption that 'review' implies post-incident analysis.

The CompTIA SY0-701 exam tests knowledge of the NIST incident response lifecycle, specifically distinguishing between initial setup and continuous improvement. Community consensus confirms that reviewing roles and responsibilities is a core activity of the Preparation phase.

Common mistake: Candidates often select Lessons Learned because they associate the word 'reviews' with retrospective analysis. However, the Preparation phase includes ongoing maintenance and review of the incident response plan to ensure it remains current before incidents occur.

Expert Analysis

Why the Answer Is Correct

The correct answer is Preparation. According to NIST SP 800-61, the Preparation phase involves establishing an incident response team, defining roles and responsibilities, and maintaining the incident response plan. This phase is not a one-time event but includes regular reviews and updates to ensure readiness.

Why the Other Options Are Wrong

Analysis (D) focuses on triaging and investigating active incidents, not planning roles. Recovery (B) involves restoring systems to normal operations after containment. Lessons Learned (C) is conducted after an incident is closed to identify improvements; while it may result in changes to roles, the act of reviewing and maintaining these definitions as part of operational readiness falls under Preparation.

Community Comment Notes

Comment [2] correctly notes that preparation includes 'ongoing review and maintenance.' Comment [3] emphasizes that roles should be reviewed regularly for good preparation, distinct from retrospective lessons learned. Comment [5] highlights the trap of focusing solely on the keyword 'reviews' without considering the context of proactive vs. reactive phases.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on the intent of each IR phase: Preparation is about readiness and maintenance, while Lessons Learned is about retrospective improvement. When you see 'review' or 'update,' check if it refers to maintaining the plan's effectiveness (Preparation) or analyzing a specific event's outcome (Lessons Learned).

Community Votes

A
74%
C
26%

74% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. Etc_Shadow28000 👍 13 Answered A
    A. Preparation The preparation phase in the incident response process is when a security analyst reviews roles and responsibilities. This phase involves planning and setting up the necessary tools, processes, and team structures to effectively respond to potential security incidents. Therefore, the correct answer is: A. Preparation
  2. mr_reyes 👍 3 Answered C
    Given the options, the phase in the incident response process when a security analyst reviews roles and responsibilities is the Lessons learned phase. During this phase, the team reflects on their performance, identifies gaps, and ensures that roles and responsibilities are well-defined and understood for future incidents. The keyword in this question is "reviews". In the Lessons Learned step we review the roles to see if anything needs to be changed, in the preparation step we are just creating the roles, nothing to review yet.
  3. AutoroTink 👍 3 Answered A
    This is a tough one! "The Preparation phase includes not only the initial establishment of roles and responsibilities but also their ongoing review and maintenance". I feel like these two steps kind of can blend into each other...review/lessons learned of one incident, can be preparation for the next incident.
  4. leedsbarber 👍 3 Answered A
    Roles and responsibilities should be regularly reviewed, not just after an event. This enables good preparation. Events are reviewed retrospectively, that's when lessons are learned.
  5. MahiMahiMahi 👍 3 Answered C
    C. Review seems to be the key word here.
Show 5 more comments
  1. nap61 👍 2 Answered C
    From CompTIA guide Preparation—makes the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and setting up confidential lines of communication. It also implies creating incident response resources and procedures Lessons learned—analyzes the incident and responses to identify whether procedures or systems could be improved. It is imperative to document the incident. Outputs from this phase feed back into a new preparation phase in the cycle Also... The lessons learned process reviews severe security incidents to determine their root cause, whether they were avoidable, and how to avoid them in the future. So, the world REVIEW is in the LESSON LEARN.
  2. dbrowndiver 👍 2 Answered A
    The Preparation phase is the initial step in the incident response process where an organization establishes the foundation for handling potential incidents. It involves planning, setting up necessary tools, and defining roles and responsibilities.
  3. jennyka76 👍 1 Answered A
    In the incident response process, a security analyst reviews roles and responsibilities during the "Preparation" phase; this is where the incident response plan is established, outlining who is responsible for what tasks during a security incident, ensuring everyone understands their role and how to respond effectively.
  4. a4e15bd 👍 1
    The correct phase for reviewing and defining roles and responsibilities in the incident response process is the preparation phase. Lessons Learned is more about reviewing the entire incident after it has been resolved, identifying what went well and what didn't and making improvements for future responses.
  5. Cee007 👍 1 Answered A
    A. Preparation

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide