Scenario: During an incident response, you discovered malware on a server. The malware was promptly removed, and the server was restored. What should be your next step?

A.  Close the incident

B.  Conduct a lessons-learned meeting

C.  Update security policies

D.   Analyze root cause

Answer:  D

Explanation:  The next step should be to analyze the root cause of the incident. Understanding how the malware got onto the server will help prevent similar incidents in the future. While a lessons-learned meeting (B), policy update (C), and closing the incident (A) are important, they usually come after understanding the root cause.