Certified Incident Handler (CIH) Practice Ecam

What is the purpose of an after-action report (AAR) in incident handling?

1. To assess the completeness of the security policy

2. To evaluate the effectiveness of the incident response

3. To update organizational structure

4. To announce the incident publicly

The correct answer is: To evaluate the effectiveness of the incident response

The purpose of an after-action report (AAR) in incident handling is fundamentally to evaluate the effectiveness of the incident response. After an incident has been managed, an AAR provides a structured review that captures what happened, how the incident was addressed, the outcomes of the incident handling process, and what could be improved in future responses. This evaluation is critical for identifying strengths and weaknesses in the response plan and execution, offering insights into the decisions made, the overall coordination of the response team, and the technical execution of incident handling. This ongoing learning process helps organizations to refine their incident response strategies, ensuring that lessons learned lead to improved preparedness and response efforts for future incidents. The correct answer reflects the central objective of the AAR within the framework of incident management, which is to foster continuous improvement in handling security incidents. Other options, while related to organizational functions, do not specifically capture the core intention of an AAR in the context of incident response.