During a post-incident review, which of the following would provide the BEST data source for identifying improvements to the incident team response?

The correct answer is C. Interviews with response team members. Interviews with response team members (C) are the best source for identifying improvements to team response because they capture subjective insights - communication gaps, decision-making friction, confusion about roles, and process breakdowns - that no artifact or log can…

Submitted by paula_co· Apr 18, 2026Information Security Incident Management

Question

Options

ADocuments created during the incident
BLogs from systems involved
CInterviews with response team members
DA consolidated event timeline

How the community answered

(59 responses)

A
3% (2)
B
8% (5)
C
73% (43)
D
15% (9)

Explanation

Interviews with response team members (C) are the best source for identifying improvements to team response because they capture subjective insights - communication gaps, decision-making friction, confusion about roles, and process breakdowns - that no artifact or log can record. Documents created during the incident (A) reflect what was written down, not what was experienced or missed. System logs (B) reveal what happened technically, but say nothing about how the people responded. A consolidated event timeline (D) is a useful output of the review process itself, but it reconstructs what happened rather than surfacing how the team could improve.

Memory tip: The key phrase is "team response" - whenever the question targets human behavior, process, or communication, interviews are your answer; whenever it targets technical facts, logs and timelines win.

Topics

#Post-incident review#Incident response team#Lessons learned#Improvement identification

Community Discussion

No community discussion yet for this question.

Full CISM Practice