Which of the following reflects an appropriate outcome of an incident post-mortem?

Prepare for the Trusted Agent Exam with engaging questions, flashcards, and detailed explanations. Dive deep into essential topics to increase your chances of success. Ace your exam with confidence!

Multiple Choice

Which of the following reflects an appropriate outcome of an incident post-mortem?

The goal of an incident post-mortem is to translate what happened into concrete changes that prevent similar incidents in the future. After analyzing the root cause, the focus is on implementing corrective actions—updates to processes, controls, runbooks, and training, plus assigning owners and timelines—to reduce the likelihood and impact of recurrence. This reflects learning from the event and strengthening the security posture through practical improvements, not blame or sensational disclosure. Disciplining individuals centers on blame rather than systemic fixes, and can harm morale and hinder honest reporting, which doesn’t reliably prevent future issues. Publicly disclosing all internal vulnerabilities is inappropriate due to safety and confidentiality concerns; sensitive details should be handled carefully to avoid creating new risks. Ceasing future security investments runs counter to the purpose of the post-mortem and leaves the organization more vulnerable. So the best outcome is implementing corrective actions to prevent recurrence.

The goal of an incident post-mortem is to translate what happened into concrete changes that prevent similar incidents in the future. After analyzing the root cause, the focus is on implementing corrective actions—updates to processes, controls, runbooks, and training, plus assigning owners and timelines—to reduce the likelihood and impact of recurrence. This reflects learning from the event and strengthening the security posture through practical improvements, not blame or sensational disclosure.

Disciplining individuals centers on blame rather than systemic fixes, and can harm morale and hinder honest reporting, which doesn’t reliably prevent future issues. Publicly disclosing all internal vulnerabilities is inappropriate due to safety and confidentiality concerns; sensitive details should be handled carefully to avoid creating new risks. Ceasing future security investments runs counter to the purpose of the post-mortem and leaves the organization more vulnerable. So the best outcome is implementing corrective actions to prevent recurrence.

More practice questions