Security Policies and Procedures →easyMultiple ChoiceObjective-mapped

200-201 Security Policies and Procedures Practice Question

In the NIST SP 800-61 Rev 2 incident response process, which phase involves documenting lessons learned and updating the incident response plan?

⚠ Common exam trap

Cisco often tests the misconception that lessons learned and plan updates occur during the Detection and Analysis phase, because candidates confuse the analysis of the incident itself with the analysis of the incident response process performance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Post-Incident Activity

The Post-Incident Activity phase of NIST SP 800-61 Rev 2 is specifically designed for conducting a lessons learned meeting, documenting findings, and updating the incident response plan based on those insights. This phase ensures continuous improvement of the incident response process by capturing what worked, what didn't, and what changes are needed for future incidents.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Containment, Eradication, and Recovery
Why it's wrong here
This phase focuses on stopping the incident and restoring operations.
✗
Detection and Analysis
Why it's wrong here
This phase involves identifying and analyzing incidents.
✓
Post-Incident Activity
Why this is correct
Lessons learned and plan updates occur in this phase.
✗
Preparation
Why it's wrong here
Preparation occurs before an incident.

Go deeper

200-201 Security Policies and Procedures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question