200-201 Security Concepts Practice Question
A security analyst is reviewing the organization's incident response plan and wants to ensure it aligns with the NIST incident response lifecycle. Which two phases are part of the NIST incident response lifecycle? (Choose two.)
⚠ Common exam trap
Candidates often confuse proactive security activities like vulnerability scanning and penetration testing with the defined phases of the incident response lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preparation
The NIST incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation and Detection and Analysis are two of these phases, while vulnerability scanning, risk assessment, and penetration testing are separate security activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preparation
Why this is correct
Preparation is the first phase of the NIST incident response lifecycle. It involves establishing policies, training staff, acquiring tools, and building communication plans before an incident occurs. This phase ensures the organization is ready to detect and respond effectively, making it a correct component of the lifecycle.
- ✓
Detection and Analysis
Why this is correct
Detection and Analysis is a core phase of the NIST incident response lifecycle. It covers monitoring for signs of an incident, validating alerts, and determining the scope and impact. This phase is essential for identifying and understanding an incident before containment, so it is a correct component.
- ✗
Vulnerability Scanning
Why it's wrong here
Vulnerability scanning is a proactive security activity that identifies weaknesses, but it is not one of the four phases of the NIST incident response lifecycle. While scanning supports preparation by revealing exposures, it is not a named phase in the lifecycle itself.
- ✗
Penetration Testing
Why it's wrong here
Penetration testing is an offensive security exercise that simulates attacks to find exploitable flaws. It is not a phase of the NIST incident response lifecycle. While it can inform preparation and post-incident improvements, it is not a defined phase in the lifecycle.
- ✗
Risk Assessment
Why it's wrong here
Risk assessment is a broader risk management activity that evaluates threats and vulnerabilities to determine potential impact. It is not one of the four phases of the NIST incident response lifecycle, which are Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.