Final answer:
A lessons-learned review in the incident-handling process should take place in the Post-Incident Activity phase, after identification, containment, eradication, and recovery steps have been completed.
Step-by-step explanation:
During the incident-handling process, the lessons-learned review of the incident should be conducted after the incident has been fully resolved. The correct stage for this review is not during the identification, containment, eradication, or recovery phases, but rather after all these steps have been completed. The review is a critical part of the Post-Incident Activity phase, where an organization assesses what happened, how it was handled, what could have been done better, and what changes or improvements need to be made to prevent future incidents or improve the response for the next time.