Which activity belongs most directly to post-incident work?
Answer
Updating the incident playbook using lessons learned
Explanation
### Why this is right
Post-incident activity reviews what happened and uses lessons to improve the playbook.
### The concept
Learning after an incident closes the improvement loop and informs later preparation.
### The other options
- **B. Disconnecting an affected host as the first containment action**: is containment.
- **C. Monitoring a network for initial alerts**: is detection.
- **D. Establishing a response team before an incident**: is preparation.
### Remember
Post-incident review converts experience into changed practice.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free