CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
During a post-incident review, an analyst is compiling a 'lessons learned' report. The team successfully contained a sophisticated phishing attack, but the initial detection took longer than expected due to alert fatigue. Which section of the lessons learned report should detail this specific challenge and propose a solution?
- ATimeline of Events
- BIncident Summary
- CRecommendations and Action Items
- DAnalysis of Contributing Factors
Show answer & explanationAnswer & explanation
Correct answer: D. Analysis of Contributing Factors
The 'Analysis of Contributing Factors' section is where the root causes, challenges, and specific issues that impacted incident handling (like alert fatigue) are dissected and explained.
Why the other options are wrong
- A. The timeline details when events occurred, not why specific issues arose.
- B. The incident summary provides a high-level overview, not detailed analysis of challenges.
- C. Recommendations propose solutions, but the *explanation* of the problem (alert fatigue) belongs in the analysis section before the recommendation.
Analysis of Contributing Factors
A section within a 'lessons learned' or incident report that identifies and explains the specific elements, conditions, or decisions that positively or negatively influenced the incident's outcome.
- Goes beyond 'what happened' to 'why it happened'.
- Includes both successes and failures.
- Forms the basis for actionable recommendations.
Memory trick: A good 'lessons learned' report 'Summarizes', 'Times', 'Analyzes', and 'Recommends'.