Which incident response activity best fits the 'Lessons Learned' phase?

• A. Immediate containment
• B. Eradication
• C. Documentation and process improvement
• D. Contingency planning

Answer: (C)

In the Lessons Learned phase, the goal is to capture a complete record of what happened, assess how effectively the incident was handled, identify gaps and root causes, and translate those findings into concrete changes to plans, procedures, and training. This is where you turn experience into improvement, updating incident response playbooks, runbooks, communication processes, controls, and defense measures so future incidents are detected and contained more quickly.

Immediate containment focuses on stopping the incident in the moment, so it belongs to the active-response actions rather than learning from it. Eradication involves removing the attacker’s artifacts and the threat itself, which is part of the cleanup after containment. Contingency planning is about preparing for business continuity during disruptions, rather than documenting lessons and driving process improvements from a past incident.