Quick Answer

The answer is conducting a root cause analysis, providing recommendations for security control improvements, and updating playbooks based on lessons learned. These three objectives are correct because the post-incident activity phase is fundamentally about closing the loop on an incident: you must identify the underlying vulnerability through root cause analysis, then translate that finding into actionable recommendations to harden defenses, and finally refine your incident response playbooks so the team can react more effectively next time. On the CompTIA CySA+ CS0-003 exam, this objective tests your understanding that the post-incident phase is not about containment or eradication—those happen earlier—but about strategic improvement. A common trap is confusing “identifying the attacker’s tools” with root cause analysis; the focus is on systemic weaknesses, not just forensic artifacts. Remember the mnemonic “RPR” for Root cause, Playbook updates, Recommendations—if it doesn’t improve future response, it’s not a post-incident objective.