When are Roles and Responsibilities Reviewed in Incident Response?

Incident Response

Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

Preparation Source Reference Answer
Recovery
Lessons learned
Analysis

Community Votes

74%

26%

74% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the distinction between establishing procedures (Preparation) and analyzing past events (Lessons Learned), with the common trap being the assumption that 'review' implies post-incident analysis.

The CompTIA SY0-701 exam tests knowledge of the NIST incident response lifecycle, specifically distinguishing between initial setup and continuous improvement. Community consensus confirms that reviewing roles and responsibilities is a core activity of the Preparation phase.

Candidates often select Lessons Learned because they associate the word 'reviews' with retrospective analysis. However, the Preparation phase includes ongoing maintenance and review of the incident response plan to ensure it remains current before incidents occur.

Community Discussion (10 comments)

Etc_Shadow28000 👍 13 Selected: A

A. Preparation The preparation phase in the incident response process is when a security analyst reviews roles and responsibilities. This phase involves planning and setting up the necessary tools, processes, and team structures to effectively respond to potential security incidents. Therefore, the correct answer is: A. Preparation

jennyka76 👍 1 Selected: A

In the incident response process, a security analyst reviews roles and responsibilities during the "Preparation" phase; this is where the incident response plan is established, outlining who is responsible for what tasks during a security incident, ensuring everyone understands their role and how to respond effectively.

nap61 👍 2 Selected: C

From CompTIA guide Preparation—makes the system resilient to attack in the first place. This includes hardening systems, writing policies and procedures, and setting up confidential lines of communication. It also implies creating incident response resources and procedures Lessons learned—analyzes the incident and responses to identify whether procedures or systems could be improved. It is imperative to document the incident. Outputs from this phase feed back into a new preparation phase in the cycle Also... The lessons learned process reviews severe security incidents to determine their root cause, whether they were avoidable, and how to avoid them in the future. So, the world REVIEW is in the LESSON LEARN.

Cee007 👍 1 Selected: A

A. Preparation

dbrowndiver 👍 2 Selected: A

The Preparation phase is the initial step in the incident response process where an organization establishes the foundation for handling potential incidents. It involves planning, setting up necessary tools, and defining roles and responsibilities.

a4e15bd 👍 1

The correct phase for reviewing and defining roles and responsibilities in the incident response process is the preparation phase. Lessons Learned is more about reviewing the entire incident after it has been resolved, identifying what went well and what didn't and making improvements for future responses.

AutoroTink 👍 3 Selected: A

This is a tough one! "The Preparation phase includes not only the initial establishment of roles and responsibilities but also their ongoing review and maintenance". I feel like these two steps kind of can blend into each other...review/lessons learned of one incident, can be preparation for the next incident.

leedsbarber 👍 3 Selected: A

Roles and responsibilities should be regularly reviewed, not just after an event. This enables good preparation. Events are reviewed retrospectively, that's when lessons are learned.

MahiMahiMahi 👍 3 Selected: C

C. Review seems to be the key word here.

mr_reyes 👍 3 Selected: C

Given the options, the phase in the incident response process when a security analyst reviews roles and responsibilities is the Lessons learned phase. During this phase, the team reflects on their performance, identifies gaps, and ensures that roles and responsibilities are well-defined and understood for future incidents. The keyword in this question is "reviews". In the Lessons Learned step we review the roles to see if anything needs to be changed, in the preparation step we are just creating the roles, nothing to review yet.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is Preparation. According to NIST SP 800-61, the Preparation phase involves establishing an incident response team, defining roles and responsibilities, and maintaining the incident response plan. This phase is not a one-time event but includes regular reviews and updates to ensure readiness.

Why the Other Options Are Wrong

Analysis (D) focuses on triaging and investigating active incidents, not planning roles. Recovery (B) involves restoring systems to normal operations after containment. Lessons Learned (C) is conducted after an incident is closed to identify improvements; while it may result in changes to roles, the act of reviewing and maintaining these definitions as part of operational readiness falls under Preparation.

Community Comment Notes

Comment [2] correctly notes that preparation includes 'ongoing review and maintenance.' Comment [3] emphasizes that roles should be reviewed regularly for good preparation, distinct from retrospective lessons learned. Comment [5] highlights the trap of focusing solely on the keyword 'reviews' without considering the context of proactive vs. reactive phases.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

Exam Strategy

Focus on the intent of each IR phase: Preparation is about readiness and maintenance, while Lessons Learned is about retrospective improvement. When you see 'review' or 'update,' check if it refers to maintaining the plan's effectiveness (Preparation) or analyzing a specific event's outcome (Lessons Learned).

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide