Exam CS0-003 topic 1 question 135 discussion

Lessons learned is a root cause analysis key phrase. This is more about hand-off, in which you want to know what's been completed in the investigatory process before you take over.

There are no lessons learned, because the investigation isn't complete for yet! Touch base, and continue the investigation- C.

Options like accepting findings (B) or validating the root cause (D) come after understanding the investigation's progress. While identifying lessons learned (A) is valuable, it is usually done after the investigation is completed, not during the handover.

It’s Ongoing so it’s Ca

From Comptia Study Guide: "A" would be correct.

"Review the steps..." - Zero-Trust = Trust-no-One - I have learn (lesson-learned) in the hard way. Question: If you need to revise your work, why not revise the work of someone that you are taking over? ;)

But if 'is taking over' and 'has been going for few days', why the first analist shound have some lesson learned done? the analisys is on working phease

I don't know, I'm going to vote B here only because the question sounds like and ongoing investigation lasting for a few days already. A and D are towards the end of the incident, and C sounds more like an audit to me. If I'm going to take over an incident, I will probably want to know what has been done already and what's the next steps are.

Going to say A here because C should be pretty heavily documented already, whereas lessons learned may not be.

A) identify and discuss the lessons learned with the prior analyst I was thinking C, but A makes things most clear. With option C, the other analyst isn't consulted, so the steps taken can be misinterpreted.

A. Identify and discuss the lessons learned with the prior analyst. Transitioning an ongoing investigation between analysts is a crucial moment in incident response. Understanding what has already been done, what has been learned, and what challenges have been encountered is essential for the incoming analyst. This information helps prevent duplicating efforts, ensures continuity in the investigation, and can lead to more effective and efficient resolution of the incident.

The most important step is to identify and discuss lessons learned with the previous analyst. This will help to have a clear view of the research done and avoid redundant work and mistakes that would have been made.