A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

The correct answer is D. Discussion of event timeline E. Assigning of follow up items. Lessons learned process is the sixth step in the Incident Response process. Everybody that was involved in the process reviews what happened and why it happened. It is during this step that they determine what changes should be introduced to prevent future problems.

Enterprise Security Operations

Question

Options

ADemonstration of IPS system
BReview vendor selection process
CCalculate the ALE for the event
DDiscussion of event timeline
EAssigning of follow up items

How the community answered

(62 responses)

A
2% (1)
B
3% (2)
C
6% (4)
D
89% (55)

Explanation

Lessons learned process is the sixth step in the Incident Response process. Everybody that was involved in the process reviews what happened and why it happened. It is during this step that they determine what changes should be introduced to prevent future problems.

Topics

#lessons learned#incident response#post-incident review#follow-up tracking

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice