Which of the following actions should be taken during a post-incident review?

The correct answer is C. Identify modifications to incident response procedures. The primary purpose of a post-incident review (also called a lessons-learned meeting or after-action review) is to evaluate how the incident was handled and identify gaps or weaknesses in the incident response procedures so they can be improved. Identifying modifications to…

Submitted by alyssa_d· Apr 18, 2026Information Security Incident Management

Question

Options

AEstablish objectives for the incident response plan.
BRestore operations to normal.
CIdentify modifications to incident response procedures.
DUpdate firewall rules.

How the community answered

(28 responses)

A
7% (2)
C
89% (25)
D
4% (1)

Explanation

The primary purpose of a post-incident review (also called a lessons-learned meeting or after-action review) is to evaluate how the incident was handled and identify gaps or weaknesses in the incident response procedures so they can be improved. Identifying modifications to incident response procedures (C) is the core deliverable of this phase. Establishing IR plan objectives (A) is a planning activity done before incidents occur. Restoring operations (B) happens during the containment and recovery phases of the active incident response - not after. Updating firewall rules (D) is a specific remediation or hardening action that may result from the review, but it is a tactical output rather than the overarching goal of the post-incident review process itself.

Topics

#Post-incident review#Incident response lifecycle#Lessons learned#Process improvement

Community Discussion

No community discussion yet for this question.

Full CISM Practice