CompTIA Security+ (SY0-701)Security OperationsMedium
After a ransomware incident has been eradicated and systems fully recovered, the incident response team holds a meeting to document the incident timeline, evaluate the effectiveness of the response, and update playbooks and detection rules. Which phase of the incident response process does this activity represent?
- APreparation
- BContainment
- CLessons learned
- DIdentification
Show answer & explanationAnswer & explanation
Correct answer: C. Lessons learned
The lessons learned (post-incident review) phase occurs after recovery, where the team documents findings, evaluates response effectiveness, and updates procedures to improve future response. Containment and identification occur during the active incident, and preparation is the proactive phase before any incident occurs.
Why the other options are wrong
- A. Preparation is proactive readiness work done before incidents occur.
- B. Containment happens during the active incident to limit spread.
- D. Identification is the detection/confirmation phase early in the incident.
Lessons Learned (Post-Incident Review)
The final phase of incident response where the team reviews the incident, documents findings, and updates policies, playbooks, and controls to prevent recurrence.
- Occurs after recovery is complete
- Produces a formal after-action report
- Feeds improvements back into preparation phase
Memory trick: After the fire is out, the team writes the report so it burns less next time.