Two weeks after an agency restores service, the team rewrites a detection that missed the forwarding rule used in the incident. Which incident-handling phase is that rewrite?
Select an answer to reveal the explanation.
Short Explanation
Fixing the alarm that stayed quiet, after the shop is already open again, is the lesson from the last break-in. You place that detection rewrite in post-incident analysis. The trap is last year's preparation, a brand-new incident, or containment of a host that is already clean.
Full Explanation
Post-incident analysis is where the team records what the response missed and changes detection. The rewrite is two weeks after service returned and targets the rule that missed this incident. That timing is lessons learned. "Post-incident analysis: lessons learned by rewriting the detection that missed the forwarding rule". Rewriting the detection that missed the forwarding rule, after service returned, is the lesson from this incident. "Preparation done the year before the incident, when the agency first wrote the handling plan". Preparation is plan writing before the incident. Work done the year before is not a rewrite driven by a miss the team has now lived through. "Detection and analysis of a new incident that has just opened on a different agency system". Detection and analysis applies while an incident is being found and understood. The stem does not open a new incident; it improves a detection after recovery. "Containment, eradication, and recovery repeated for a host that is already clean and restored to service". Containment, eradication, and recovery acts on a host that still needs isolation, cleanup, or restore. Repeating that phase for a host already clean does not describe a detection rewrite. Exam caveat: NIST SP 800-61 Rev. 3 maps the phase names onto CSF 2.0 Functions. The exam still uses the four names, and that mapping is not the only model in Rev. 3. Operational check: link the detection change to the closed incident's lessons record, dated after service was restored.