インシデント対応アナリストが別のアナリストから調査を引き継いでいます。捜査はここ数日間続いている。2 人のアナリストの間で移行する際に最も重要な手順は次のうちどれですか?
正解:C
Reviewing the steps that the previous analyst followed is the most important step during the transition, as it ensures continuity and consistency of the investigation. It also helps the new analyst to understand the current status, scope, and findings of the investigation, and to avoid repeating the same actions or missing any important details. The other options are either less important, premature, or potentially biased. References:
CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 4: Incident Response and Management, page
191. Incident response best practices and tips, Tip 1: Always pack a jump bag.