Which phase of incident response involves learning from the incident and improving security to prevent recurrence?

• A. Containment.
• B. Post-Incident Activity.
• C. Preparation.
• D. Detection and Analysis.

Answer: (B)

Post-incident activity focuses on learning from what happened and turning that knowledge into concrete security improvements to prevent recurrence. After containment, eradication, and recovery, this phase revisits the incident to identify root causes, gaps in defenses, and what could be done better next time. It leads to practical changes like updating the incident response plan, patching or mitigating vulnerabilities, refining detection and monitoring rules, strengthening access controls, and training staff. The aim is a feedback loop that strengthens both prevention and response for future events. Containment centers on stopping the incident and limiting damage during it; detection and analysis focus on recognizing and understanding the incident as it occurs; preparation is about planning and readiness before incidents happen.