A security analyst provides the management team with an after action report for a security incident. Which of the following is the management team most likely to review in order to correct validated…

The correct answer is B. Lessons learned. The lessons learned phase is a formal step in the incident response process where teams review what went wrong, what worked, and how to improve future responses. Management uses this to adjust policies, procedures, and controls based on real incident experiences.

Submitted by tom_us· Mar 6, 2026Incident Response and Management

Question

A security analyst provides the management team with an after action report for a security incident. Which of the following is the management team most likely to review in order to correct validated issues with the incident response processes?

Options

ATabletop exercise
BLessons learned
CRoot cause analysis
DForensic analysis

How the community answered

(21 responses)

A
5% (1)
B
90% (19)
D
5% (1)

Explanation

The lessons learned phase is a formal step in the incident response process where teams review what went wrong, what worked, and how to improve future responses. Management uses this to adjust policies, procedures, and controls based on real incident experiences.

Topics

#Incident response#Lessons learned#After-action review#Process improvement

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice