GIAC Foundational Cybersecurity Technologies Practice Test

At which stage of incident response is the adequacy of policies reviewed?

1. Lessons learned

2. Eradication

3. Recovery

4. Preparation

The correct answer is: Lessons learned

The stage of incident response where the adequacy of policies is reviewed is during the lessons learned phase. This is a crucial step where the organization evaluates the incident handling process, analyzes what went well and what did not, and assesses the effectiveness of current policies and procedures. In this phase, the team reflects on the incident response execution and identifies areas for improvement, which includes considering whether existing policies were effective or if they need revision. The feedback gathered during this review process is essential for enhancing the organization's overall security posture and ensuring that future incidents are managed more efficiently. While preparation is about establishing policies before incidents occur, and recovery focuses on restoring systems and data, these stages do not involve the in-depth review of policy effectiveness that is characteristic of the lessons learned phase.