CAS-004 Security Operations Practice Question
A company's incident response team is conducting a post-incident review. They identify that the intrusion was not detected for 72 hours due to insufficient logging on critical servers. Which phase of the incident response lifecycle should be improved to address this gap?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preparation
The preparation phase includes establishing logging and monitoring capabilities. Improving logging is part of preparation for future incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lessons learned
Why it's wrong here
Lessons learned identifies improvements but the phase is preparation.
- ✗
Containment
Why it's wrong here
Containment happens after detection.
- ✗
Detection
Why it's wrong here
Detection is about identifying incidents; the root cause is lack of preparation.
- ✓
Preparation
Why this is correct
Preparation involves building detection capabilities like logging.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.