Following a successful phishing incident at the clerk’s office, which action best belongs in the lessons-learned phase?
Select an answer to reveal the explanation.
Short Explanation
Lessons learned is the after-action huddle where the clerk’s office turns bruises into better drills. Updating the phishing playbook and how staff report suspicious mail closes the loop. Wiping everything blindly or deleting the evidence trail wastes the hard-won insight.
Full Explanation
Lessons learned is the formal close of the incident response cycle: the organization captures what happened, what worked, what failed, and what must change. After a phishing incident at the clerk’s office, updating the phishing playbook and user-reporting steps is exactly that work—refining detection cues, escalation contacts, mailbox quarantine procedures, and staff reporting channels based on observed gaps. Those updates reduce recurrence and shorten future response time. Lessons learned may also drive training content, mail-gateway rule tuning, and metrics for report-to-containment time, but the core is converting experience into durable process and control improvement—not performing more blind tactical cleanup.
Citywide reimaging without review is an unfocused eradication/recovery action that may destroy forensic value and waste resources; it is not a lessons-learned deliverable. Deleting SIEM alerts related to the incident destroys investigative history and trend data, undermining both accountability and future detection tuning. Paying an attacker for an “after-action guarantee” is neither a lessons-learned practice nor an acceptable control; it rewards the threat and provides no reliable assurance. Exam questions often disguise busywork or evidence destruction as “cleanup” when the stem asks for lessons learned. Operationally, schedule a facilitated after-action review with clerk staff, SOC, and communications; document concrete playbook edits and training actions with owners and due dates; and verify the next phishing drill uses the revised reporting path before closing the improvement ticket.