200-201 · Question #158
According to NIST, at which step of the incident response process should an organization apply lessons learned from practice?
The correct answer is D. post-incident activity. According to NIST, the application of lessons learned from incident response practices occurs during the post-incident activity phase to improve future incident handling capabilities.
Question
According to NIST, at which step of the incident response process should an organization apply lessons learned from practice?
Options
- Apreparation
- Bdetection and analysis
- Ccontainment
- Dpost-incident activity
How the community answered
(18 responses)- A6% (1)
- D94% (17)
Why each option
According to NIST, the application of lessons learned from incident response practices occurs during the post-incident activity phase to improve future incident handling capabilities.
Preparation involves establishing policies, procedures, and teams before an incident occurs.
Detection and analysis focuses on identifying and understanding an incident as it happens.
Containment involves limiting the scope and impact of an incident once it has been detected.
The NIST incident response lifecycle includes 'Post-Incident Activity' (also known as 'Post-Incident Review' or 'Lessons Learned'). In this phase, the incident response team reviews the entire incident, documents what happened, what worked well, what didn't, and identifies improvements for future incident handling, policies, and procedures, applying these 'lessons learned'.
Concept tested: NIST Incident Response Lifecycle - Post-Incident Activity
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.