Conducting a lessons-learned review session would occur in the __________________ incident response phase.
a. Pre-incident planning
b. Detection and analysis
c. Containment, eradication, and recovery
d. Post-incident activity