Exam CISM topic 1 question 262 discussion

A post-incident review is an important step in the incident response process. It allows the incident response team to evaluate their response to the incident and identify any areas for improvement. By conducting a thorough analysis of the incident, including the cause, the actions taken and the outcomes, the team can identify any gaps in their knowledge or processes that led to the incident taking longer to identify. This information can then be used to improve incident response procedures and to develop new strategies for identifying similar incidents more quickly in the future.

B. A Post Incident review can point out the Gap of not having an SIEM solution.

Pretty sure this is D. Trying to identify would have been easier with a SIEM solution to correlate all the event and incident data.

D. Implement a SIEM solution.

2nd thought since the team already knows the "event" but spend much time to solve it, a post-incident review seems to be more helpful. So, B.

D. For sure. B is for IR process improvement, but without SIEM you never be able to identify complex and new cyber attacks in time.

I think D