After completing an incident response process and providing a final report to management, what step should Casey use to identify improvements to response plan?

A $$ Review patching status and vulnerability scans. $$

Conduct a lessons$-$learned session.

C $$ Identify the infected system's elements and isolate them from the rest of the systems.

D $$ Restores and returns affected systems.