Following the successful response to a data-leakage incident, the incident team lead facilitates an exercise that focuses on continuous improvement of the organization's incident response…

A lessons learned review - also called an after-action review or post-incident review - is a structured facilitated discussion conducted after an incident is resolved where participants identify successes, failures, gaps in tooling, and procedural improvements. It directly targets continuous improvement of incident response capabilities by updating runbooks, training programs, and detective or preventive controls based on real-world experience. The scenario description of the team lead facilitating post-response improvement is the textbook definition of this activity.

A root cause analysis focuses narrowly on identifying the underlying technical cause of the incident to prevent recurrence, which is a component of lessons learned but not the broader continuous improvement exercise described.

An incident audit is a formal compliance-oriented review that assesses whether documented procedures were followed correctly, not a collaborative team exercise aimed at evolving capabilities.

A corrective action exercise refers to implementing specific remediation steps identified from prior findings, which is a downstream activity that results from a lessons learned review rather than the review itself.