A security analyst needs to produce a document that details how a security incident occurred, the steps that
were taken for recovery, and how future incidents can be avoided. During which of the following stages of the
response process will this activity take place?


A. Recovery
B. Identification
C. Lessons learned
D. Preparation