CAS-001 · Question #453
A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that…
The correct answer is B. During the Lessons Learned phase. The Lessons Learned phase (also called Post-Incident Activity or Post-Mortem) is the correct answer. This phase occurs after the incident is fully resolved and is specifically designed as a structured, blameless review to: (1) document what happened and the timeline; (2)…
Question
A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that theincident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?
Options
- ADuring the Identification Phase
- BDuring the Lessons Learned phase
- CDuring the Containment Phase
- DDuring the Preparation Phase
How the community answered
(56 responses)- A4% (2)
- B95% (53)
- C2% (1)
Explanation
The Lessons Learned phase (also called Post-Incident Activity or Post-Mortem) is the correct answer. This phase occurs after the incident is fully resolved and is specifically designed as a structured, blameless review to: (1) document what happened and the timeline; (2) identify what went wrong and what worked well; (3) assign accountability and recommend improvements - all in a professional, non-adversarial setting. This prevents the chaos of blame-assignment during the heat of active response. The Identification Phase (A) is focused on detecting and confirming the incident. The Containment Phase (C) is focused on stopping the spread of damage. The Preparation Phase (D) occurs before an incident and focuses on building IR capabilities. None of these are appropriate venues for accountability reviews.
Topics
Community Discussion
No community discussion yet for this question.