The correct answer is Perform a post incident review and implement new countermeasures.

Perform a post incident review and implement new countermeasures is the right choice because this step occurs after containment and service restoration and focuses on preventing recurrence. The review phase captures lessons learned and performs root cause analysis so the organization can identify what failed and which controls need strengthening.

The team should update incident response plans and playbooks and implement technical and procedural countermeasures such as improved detection rules, configuration changes, and targeted user training. Turning the findings of the post incident review into concrete changes is how an organization reduces the likelihood of the same incident happening again.

Detection analysis and escalation is incorrect because that activity belongs to the identification and triage phases when an incident is first detected. It is not the action you perform after containment and normal operations have resumed.

Service recovery is incorrect because recovering services is the step that restores normal operations. The question states that normal operations have already resumed and asks what to do next to prevent recurrence.

Proactive preparation is incorrect because preparation happens before an incident. Proactive measures are important but they are not the post incident step that turns lessons learned into new countermeasures.

Full AWS Practitioner Certification Question