CySA+ Post Incident Lessons Learned Reports Quiz

1. What does a preventive action address in incident management?

Stopping the current incident

Stopping similar incidents from occurring in the future

Assigning responsibility

Reducing audit findings

2. What is the relationship between incident severity and the depth of lessons learned analysis?

Severity has no impact on analysis depth

Higher severity incidents warrant more comprehensive analysis

All incidents require identical analysis regardless of severity

Minor incidents require the most detailed review

3. Which documentation should be preserved for a lessons learned archive?

Incident reports, timelines, and final lessons learned reports

Only the executive summary

Personal notes from responders

Email threads only

4. How does conducting a lessons learned review contribute to organizational resilience?

It has minimal impact

It identifies gaps and drives continuous improvement in security controls

It only satisfies compliance audits

It eliminates all future security incidents

Submit

6. What should be done with action items identified in lessons learned?

File them away without follow-up

Assign ownership, track progress, and verify implementation

Only discuss them verbally

Report them only to compliance teams

7. Why is it important to maintain confidentiality during lessons learned sessions?

To hide mistakes from stakeholders

To encourage honest discussion without fear of blame

To comply with non-disclosure agreements only

Confidentiality is not necessary

8. Which of the following is a key metric to track in post-incident analysis?

Mean Time to Detect (MTTD)

Mean Time to Respond (MTTR)

Mean Time to Resolve (MTTR)

All of the above

Submit

10. How should metrics from the incident response be used in lessons learned?

Ignored in favor of qualitative feedback

Used to measure response effectiveness and identify improvements

Only reported to external auditors

Kept confidential from staff

11. What is the primary purpose of a post-incident lessons learned report?

To assign blame to team members

To document findings and improve future incident response

To fulfill legal compliance requirements only

To terminate employees involved in the incident

Submit

13. Which stakeholders should typically participate in a lessons learned session?

Only the CISO

Incident response team, IT, security, management, and relevant departments

Only technical staff

External consultants exclusively

14. What is the significance of documenting 'what went well' in a lessons learned report?

It has no value

It reinforces effective practices and builds team confidence

It is only for management morale

It wastes time in the report

Submit

16. When should the lessons learned meeting ideally be scheduled?

Immediately after containment

Six months after the incident

Shortly after recovery, while details are fresh

Only if management requests it

17. Which tool or technique is commonly used for root cause analysis in incident response?

Five Whys analysis

Fishbone diagram

Both Five Whys and Fishbone diagrams

Neither tool is effective

18. What should be included when documenting incident timeline information?

Only the detection timestamp

Key events, detection time, response actions, and resolution

Personal opinions of team members

Estimated financial impact only

Submit

20. Which phase of incident response includes conducting a lessons learned review?

Detection and Analysis

Containment, Eradication, and Recovery

Post-Incident Activity

Preparation

CySA+ Post Incident Lessons Learned Reports Quiz

1. What does a preventive action address in incident management?

2.

What first name or nickname would you like us to use?

2. What is the relationship between incident severity and the depth of lessons learned analysis?

3. Which documentation should be preserved for a lessons learned archive?

4. How does conducting a lessons learned review contribute to organizational resilience?

5. A formal lessons learned report typically concludes with ____ for future incidents.

6. What should be done with action items identified in lessons learned?

7. Why is it important to maintain confidentiality during lessons learned sessions?

8. Which of the following is a key metric to track in post-incident analysis?

9. The lessons learned report should include a ____ section documenting what the organization learned.

10. How should metrics from the incident response be used in lessons learned?

11. What is the primary purpose of a post-incident lessons learned report?

12. A corrective action in an incident report should include a ____ for implementation.

13. Which stakeholders should typically participate in a lessons learned session?

14. What is the significance of documenting 'what went well' in a lessons learned report?

15. A lessons learned report should recommend ____ to prevent similar incidents.

16. When should the lessons learned meeting ideally be scheduled?

17. Which tool or technique is commonly used for root cause analysis in incident response?

18. What should be included when documenting incident timeline information?

19. Root cause analysis in incident management focuses on identifying ____.

20. Which phase of incident response includes conducting a lessons learned review?