In the incident response lifecycle, which phase focuses on capturing what happened and identifying improvements after the incident?

• A. Preparation
• B. Lessons Learned
• C. Detection
• D. Containment

Answer: (B)

The phase that focuses on capturing what happened and identifying improvements after an incident is the Lessons Learned phase. This retrospective step reconstructs the incident timeline, analyzes what occurred, and examines how well the response worked. It yields a post-incident report and actionable recommendations, such as root-cause findings, updates to playbooks, training needs, and changes to controls or detection methods that prevent recurrence. In contrast, Preparation is about getting ready before incidents happen, Detection is about recognizing that an incident is occurring, and Containment is about stopping the incident from spreading.