312-39 · Question #4
One week after a ransomware attack disrupted operations, Sarah, a SOC analyst, leads a review meeting with the IT team, security engineers, and business unit representatives. The group reviews the…
The correct answer is B. Post-Incident Activities. This is the “Post-Incident Activities” phase, commonly known as lessons learned or post-incident review. The defining elements are present: the incident is already over (one week later), stakeholders are reviewing the timeline, calculating business impact, and identifying…
Question
One week after a ransomware attack disrupted operations, Sarah, a SOC analyst, leads a review meeting with the IT team, security engineers, and business unit representatives. The group reviews the incident timeline, calculates a business impact of $157,000 due to downtime and data loss, and identifies seven critical improvements to enhance detection and response processes. Which of the following Incident Response phase is this?
Options
- ARecovery
- BPost-Incident Activities
- CEradication
- DContainment
How the community answered
(21 responses)- A5% (1)
- B95% (20)
Explanation
This is the “Post-Incident Activities” phase, commonly known as lessons learned or post-incident review. The defining elements are present: the incident is already over (one week later), stakeholders are reviewing the timeline, calculating business impact, and identifying improvements to processes and controls. In SOC practice, this phase focuses on improving readiness and reducing recurrence by documenting what happened, what worked, what failed, and what should change. Typical outputs include updated playbooks/runbooks, improved detection logic, better alert triage workflows, logging and telemetry enhancements, refined escalation paths, improved backup/restore procedures, and training actions. Recovery is about restoring services and operations (rebuild systems, restore data, validate return-to-service), which is not the primary activity described. Eradication is removing the threat from the environment (remove malware, close persistence, patch exploited vulnerabilities). Containment is stopping spread and limiting damage during the incident. Since the group is assessing impact and creating improvement actions after operations have resumed, the correct classification is Post-Incident Activities.
Topics
Community Discussion
No community discussion yet for this question.