CSA (312-39) SOC Simulation Lab

Step into the aftermath of a major ransomware incident. You will learn how mature SOCs conduct "Lessons Learned" reviews, calculate business impact, and drive continuous security improvements in accordance with the NIST Incident Response lifecycle.

Scenario Context

Organization: LogiChain Freight (Logistics & Supply Chain)

The Situation: One week ago, a LockBit 3.0 ransomware variant infected the company's regional distribution center network. The attack was successfully stopped, malware was purged from the environment, and backups have been restored. Operations are back to 100% capacity.

The Problem: The CISO needs a formal breakdown of what failed, how much the incident cost the business, and a roadmap to ensure this specific attack vector cannot be exploited again.

The Objective: Sarah, a Tier 3 SOC Analyst, is leading a cross-functional meeting with IT Operations, Network Security, and Logistics Business Leaders to finalize the incident report, document financial damages, and assign ownership to seven critical remediation tasks.

Security Environment Data

Snippet from the Jira Service Management Incident Ticket (IR-2026-044) Final Summary tab.

--- INCIDENT REVIEW SUMMARY: IR-2026-044 ---
Meeting Date: 2026-04-15 (T+7 days post-recovery)
Lead Analyst: Sarah M. (SOC Tier 3)

[Financial Impact Assessment]
- Downtime (14 hours @ $10k/hr): $140,000
- Data Recovery Overtime: $12,000
- External IR Retainer Fees: $5,000
Total Estimated Impact: $157,000

[Root Cause & Gap Analysis]
1. Initial Access: Phishing email bypassed Secure Email Gateway (SEG).
2. Gap: Lack of MFA on legacy VPN allowed attacker to pivot internally.
3. Gap: EDR was in "Audit Mode" on legacy file servers, failing to block encryption.

[Action Items (Assigned)]
ACT-01: Enforce MFA on ALL VPN profiles (Owner: IT-Net) - Due: 48h
ACT-02: Move EDR to "Protect" mode on all servers (Owner: SOC) - Due: 24h
ACT-03: Update Phishing Playbook with new IOCs (Owner: SOC) - Due: 7d

SOC Assessment Question

One week after a ransomware attack disrupted operations, Sarah, a SOC analyst, leads a review meeting with the IT team, Security engineers, and business unit representatives. The group reviews the incident timeline, calculates a business impact of $157,000 due to downtime and data loss, and identifies seven critical improvements to enhance detection and response processes. Which of the following Incident Response phase is this?

Expert Insight: Senior Analyst Mentoring

1. What is Happening Here?

The active threat has been neutralized, and the business has resumed operations. Now, the SOC is conducting a "Lessons Learned" or Post-Incident Review (PIR) meeting. This is a critical administrative and strategic function where the team analyzes the incident timeline, evaluates the effectiveness of their response, calculates the financial damage, and commits to systemic improvements to prevent a recurrence.

2. Why Post-incident Activities is Correct

Post-incident Activities (specifically defined in NIST SP 800-61 Rev. 2) is the final phase of the incident response lifecycle. It encompasses the creation of the final incident report, conducting the lessons learned meeting, generating metrics (like the $157k impact calculation), and feeding identified gaps back into the Preparation phase. Since Sarah is leading a review meeting to identify improvements after the event, she is squarely in this phase.

3. Why the Others Miss the Mark

Containment: This is the triage phase where analysts try to stop the bleeding (e.g., isolating infected hosts, blocking IPs). It happens *during* the active attack.
Eradication: This involves removing the threat from the environment entirely (e.g., deleting malware, applying emergency patches, resetting compromised passwords).
Recovery: This focuses on restoring systems to normal operations (e.g., restoring servers from clean backups, bringing services back online). The scenario explicitly notes the review is happening "one week after... operations disrupted," meaning recovery is already complete.

Mandatory Mini-Lesson: The Feedback Loop of Incident Response

According to NIST SP 800-61 Rev. 2, the Incident Response Lifecycle is not a straight line; it is a cycle consisting of four phases:

Preparation: Establishing policies, deploying tools (SIEM/EDR), and training.
Detection & Analysis: Alerts fire, and the SOC determines if an event is an actual incident.
Containment, Eradication, & Recovery: Stopping the attacker, kicking them out, and fixing the damage.
Post-Incident Activity: The "Lessons Learned" review.

The crucial takeaway:

Phase 4 feeds directly back into Phase 1. The 7 improvements Sarah's team identified (like turning on EDR block mode) become the new *Preparation* steps for the next inevitable attack. Without Phase 4, a SOC will continually fight the exact same fires.

Real-world SOC Application: Never skip the Post-Incident Review. In the real world, the PIR is exactly how SOC managers justify budget increases to executives. "This incident cost us $157,000 in downtime because we lacked MFA. Implementing an enterprise MFA solution costs $40,000. It pays for itself."

Ready to sharpen your SOC skills further?

Explore more CSA simulations