200-201 Security Policies and Procedures Practice Question
After a security incident, the IR team holds a lessons learned meeting. Which THREE activities are part of the Post-Incident Activity phase?
⚠ Common exam trap
The trap is mixing phases — candidates often select 'restore systems from backup' or 'triage alerts' because they sound incident-related, but those belong to Recovery and Detection/Analysis respectively, not Post-Incident Activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Developing metrics to measure IR effectiveness
Option A is correct because the Post-Incident Activity phase includes developing metrics (e.g., MTTD, MTTR, containment time) to measure the effectiveness of the incident response process and inform future improvements. Option B is correct because a core output of the lessons learned meeting is identifying improvements to the IR process, such as better detection rules, communication paths, or tooling gaps. Option C is correct because findings from the lessons learned review are used to update the incident response plan, ensuring procedures, playbooks, and roles reflect what was learned. Option D is not part of this phase; initial triage of new alerts belongs to the Detection and Analysis phase. Option E is also not part of this phase; restoring systems from backup occurs during the Containment, Eradication, and Recovery phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Developing metrics to measure IR effectiveness
Why this is correct
Defining metrics that measure IR effectiveness belongs to Post-Incident Activity, quantifying detection, response and recovery performance after the event. This satisfies the phase's purpose of evaluating what occurred rather than preparing for or containing an incident.
- ✓
Identifying improvements to the IR process
Why this is correct
Identifying improvements to the IR process is a Post-Incident Activity output, feeding lessons learned back into plans, playbooks and controls. This satisfies the phase's requirement to convert incident findings into corrective actions for future response.
- ✓
Updating the incident response plan
Why this is correct
Updating the incident response plan is a core Post-Incident Activity task: the lessons learned meeting feeds identified gaps and improvements back into the plan, satisfying the phase's requirement to refine future response capability rather than contain or eradicate the live threat.
- ✗
Conducting initial triage of new alerts
Why it's wrong here
Initial triage of new alerts belongs to detection and analysis, occurring before containment and eradication. It is tempting because lessons learned meetings review alert handling, but the post-incident phase covers documentation, evidence retention and improvement recommendations rather than live alert assessment.
- ✗
Restoring systems from backup
Why it's wrong here
Restoring systems from backup is eradication and recovery work, performed before the incident is formally closed. It is tempting because recovery completes the response lifecycle, but post-incident activity instead examines what happened, captures lessons and updates procedures to prevent recurrence.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.