Lessons Learned Process Quiz

What you'll be asked

1. What is the primary purpose of a Lessons Learned meeting following a security incident?
2. Which of the following activities is considered a critical best practice during the Lessons Learned phase?
3. In the context of post-incident reporting, what should be done with the sensitive technical details of a vulnerability discovered during the incident?
4. During a Lessons Learned session, the team discovers that the incident response plan lacked clear communication protocols for external stakeholders. What is the most effective way to incorporate this into the process?
5. An organization experiences an incident where a critical server was compromised due to an unpatched vulnerability. During the Lessons Learned meeting, the team identifies that the patch management policy exists but is rarely enforced. Which of the following root cause analysis (RCA) techniques would be most effective in identifying the underlying breakdown in organizational culture or policy enforcement?

Answers and explanations come after you submit.