AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/secplus-lessons-learned-meeting

What is the purpose of a lessons learned meeting after a major security incident?

Start playing free

  1. Review the response and identify improvements
  2. Assign blame to one person
  3. Delete all evidence of the incident

🔒 The answer is for AhaBulb members. Members see the answer, why it's right and the official sources for every card of Stuff Every Security Pro Should Know, plus timed practice exams.

The first 50 cards of every test are free to play.

Play the free cards See membership

Like this card?
Play the game

References

  1. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Checked 2026-10-10.
  2. NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn NIST's classic incident response life cycle (SP 800-61 Rev. 2), which phase follows Detection and Analysis?Security & PrivacyWhat is a tabletop exercise in incident response planning?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.