SSCP Incident Response and Recovery Practice Question
An organization's incident response team has just completed the recovery phase of a major security incident. The team lead is now planning the post-incident activity. According to NIST SP 800-61, which of the following should be the PRIMARY focus of the lessons learned meeting?
⚠ Common exam trap
Test-takers frequently confuse the lessons learned meeting with a disciplinary or financial review, when its core purpose is to improve incident response processes through constructive analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identifying improvements to the incident response plan and procedures based on what worked and what did not.
The primary focus of a lessons learned meeting after an incident is to review the response efforts and identify improvements to the incident response plan, procedures, and training. This aligns with NIST SP 800-61, which emphasizes that the meeting should produce actionable recommendations to enhance future response. It is not about discipline, financial reporting, or solely updating disaster recovery plans. The goal is continuous improvement of the incident response capability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identifying improvements to the incident response plan and procedures based on what worked and what did not.
Why this is correct
The lessons learned meeting is intended to review the incident and the response to identify strengths and weaknesses, leading to improvements in the incident response plan, procedures, and training. This helps the organization better prepare for future incidents. The primary focus is on process improvement, not on assigning blame or calculating costs. NIST SP 800-61 emphasizes that the meeting should produce actionable recommendations.
- ✗
Updating the organization's disaster recovery plan to reflect the new threat landscape.
Why it's wrong here
Updating the disaster recovery plan may be a follow-up action, but it is not the primary focus of the lessons learned meeting. The meeting focuses on the incident response process itself, not specifically on disaster recovery, which deals with restoring critical business functions after a disruption. The lessons learned should inform multiple plans, but the immediate focus is on incident response improvements.
- ✗
Calculating the total financial cost of the incident to report to stakeholders.
Why it's wrong here
While cost analysis may be part of post-incident activities, it is not the primary focus of the lessons learned meeting. The meeting's main goal is to improve incident response capabilities by reviewing what happened and why. Financial reporting is typically handled by other departments and is not the core objective of this technical and operational review.
- ✗
Determining which team members should be disciplined for mistakes made during the response.
Why it's wrong here
The lessons learned meeting is not a disciplinary hearing. Its purpose is to improve processes, not to punish individuals. A blame-oriented approach can discourage honest reporting and hinder learning. NIST SP 800-61 stresses a non-punitive environment to encourage open discussion. Disciplinary actions, if needed, should be handled separately through HR, not as the primary focus of this meeting.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.