200-201 Question 353
Select 3Following a ransomware attack on a company's network, the security team conducts a post-incident analysis to identify lessons learned. Which of the following actions are appropriate to include in the post-incident analysis process?
- A
Identify gaps in existing security controls and recommend improvements.
- B
Analyze the attack timeline to determine how the attacker gained initial access.
- C
Permanently delete all log files from the incident to free up storage space.
- D
Review the incident response team's actions to evaluate their effectiveness.
- E
Notify all employees about the incident without verifying the details.
Show answer and explanation
Correct answers: A, B, D
Explanation
Post-incident analysis focuses on understanding what went wrong, identifying vulnerabilities, and improving defenses and response processes. Actions such as identifying security gaps, analyzing attack timelines, and evaluating response effectiveness are essential to ensure lessons are learned. Deleting valuable log files or spreading unverified information are counterproductive and should be avoided.
- A. Correct.
Correct: Identifying gaps in security controls and recommending improvements is a critical part of post-incident analysis to prevent similar incidents in the future.
- B. Correct.
Correct: Analyzing the attack timeline helps the team understand how the threat actor gained entry and what vulnerabilities were exploited, which is essential for mitigation planning.
- C. Incorrect.
Incorrect: Deleting log files is highly inappropriate, as they are essential for forensic analysis and compliance purposes.
- D. Correct.
Correct: Reviewing the response team's actions allows the organization to identify areas for improvement in their incident response process.
- E. Incorrect.
Incorrect: Notifying employees without verifying the details can lead to misinformation and panic. Communications should be accurate and based on verified information.