iSACA Cybersecurity Fundamentals Certification Practice Exam

What document summarizes lessons learned from a cybersecurity incident?

1. Incident recovery plan

2. Post-incident activity report

3. Evidence preservation log

4. Forensic analysis summary

The correct answer is: Post-incident activity report

The post-incident activity report is crucial for understanding the lessons learned from a cybersecurity incident. This document typically captures a comprehensive review of the incident, including how it occurred, the response actions taken, and the outcomes of those actions. It serves not only as a record of the incident but also as a tool for improving future incident response efforts. By analyzing the details in the report, organizations can identify gaps in their security posture, processes, or technologies that may have contributed to the incident. These insights enable the development of improved strategies and preventive measures, ensuring that the organization can better protect itself against similar incidents in the future. The post-incident activity report also serves as a communication tool for stakeholders, assessing the effectiveness of the incident response and fostering a culture of continuous improvement in cybersecurity practices. In contrast, an incident recovery plan focuses more on the procedures to restore operations after an incident, while an evidence preservation log documents the chain of custody for evidence related to the incident. A forensic analysis summary presents findings from specific forensic investigations but does not necessarily encapsulate the lessons learned across the incident as a whole.