Fill in the blank: During the __________ phase, security teams may conduct a full-scale analysis to determine the root cause of an incident and use what they learn to improve the company’s overall security posture. A. eradication and recovery
B. post-incident activity
C. containment
D. detection and analysis
The correct answer is B. post-incident activity.
During the post-incident activity phase, security teams assess what occurred during the incident, analyze the root cause, and document their findings. This allows them to implement improvements to the company’s security measures to prevent similar incidents in the future.