Which document provides insight into the incident and how to improve response processes in the future?

• A. Detection
• B. After-action Report (AAR)
• C. Event
• D. Incident

Answer: (B)

An after-action report provides insight into what happened and how to improve response processes in the future. It’s a retrospective document created after an incident or drill that records the sequence of events, what went well, and what didn’t, and then translates those observations into concrete lessons learned. By detailing root causes, contributing factors, and the effectiveness of detections, containment, eradication, and recovery steps, it guides updates to playbooks, runbooks, and training. It also assigns owners and timelines for implementing corrective actions, ensuring changes are actually put into practice. This makes it the best fit because it explicitly focuses on learning from the incident to prevent recurrence and enhance future responses. Detections or events describe what happened, but they do not provide structured lessons and improvements.