Which of the following actions would an analyst most likely perform after an incident has been investigated?

Question

Options

• ARisk assessment
• BRoot cause analysis
• CIncident response plan
• DTabletop exercise

• B
  94% (30)
• C
  3% (1)
• D
  3% (1)

Explanation

Post-Incident Analysis Explained

Root cause analysis (B) is the correct answer because after investigating an incident, analysts must determine the underlying reason the incident occurred in the first place - not just what happened, but why it happened. This allows the organization to implement corrective measures that prevent recurrence, making it a natural next step following an investigation.

Why the distractors are wrong:

• A (Risk assessment) is performed before incidents to identify potential threats and vulnerabilities, not as a post-incident activity
• C (Incident response plan) is developed proactively before incidents occur to guide responders during an event, not after one concludes
• D (Tabletop exercise) is a preparedness drill used to practice incident response scenarios before a real incident happens

Memory Tip: Think of the phrase "After the fire, find the spark" - once the incident (fire) is handled, you dig back to find what ignited it (root cause). The word "root" implies going deeper after the surface-level investigation is complete, making it clearly a post-incident activity.

No community discussion yet for this question.