200-201 Security Policies and Procedures Practice Question
During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?
⚠ Common exam trap
Watch out — candidates often confuse 'exercising the plan' with 'improving the plan after an incident' — candidates often pick Post-Incident Activity because both involve the plan, but only Preparation covers initial development and drills.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preparation
The Preparation phase of NIST SP 800-61 Rev 2 covers establishing the incident response capability, including developing the IR plan, acquiring tools, training staff, and exercising the plan through tabletop and functional exercises. Exercising the plan before an incident occurs is explicitly a Preparation activity, not something done during or after an event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preparation
Why this is correct
Preparation is the phase where organisations build incident response capability before incidents occur, including developing the plan, defining roles, and conducting exercises. NIST SP 800-61 Rev 2 places plan creation and training squarely here, satisfying the stem's requirement to both develop and exercise the plan ahead of any detection or containment activity.
- ✗
Post-Incident Activity
Why it's wrong here
Post-Incident Activity covers reviewing lessons learned and improving defences after an incident closes, not authoring or exercising the plan itself. It is tempting because plan updates often follow a post-mortem, but NIST SP 800-61 Rev 2 places plan development and exercising in Preparation.
- ✗
Detection and Analysis
Why it's wrong here
Detection and Analysis identifies and scopes incidents using the plan's procedures and contacts. It is tempting because the plan is consulted here, but NIST SP 800-61 Rev 2 places developing and exercising the plan in Preparation, which precedes detection and equips the team beforehand.
- ✗
Containment, Eradication, and Recovery
Why it's wrong here
Containment, Eradication, and Recovery executes the plan against a live incident, limiting damage and restoring systems. It is tempting because responders follow documented procedures here, but NIST SP 800-61 Rev 2 assigns developing and exercising the plan to Preparation, before any incident occurs.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.