easyMultiple Select
200-201 Practice Question: Which TWO of the following are key elements that…
Which TWO of the following are key elements that should be included in an incident response plan?
⚠ Common exam trap
Cisco often tests the distinction between the incident response plan (strategic, process-oriented) and incident response playbooks (tactical, attack-specific), causing candidates to mistakenly select detailed technical instructions or tool lists as key elements of the plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Roles and responsibilities of the incident response team
Option C is correct because a well-structured incident response plan must clearly define the roles and responsibilities of the incident response team, ensuring each member knows their duties (e.g., incident handler, team lead, communications lead) during detection, containment, eradication, and recovery. Option E is correct because communication and escalation procedures are essential plan elements, specifying internal and external notification paths, escalation thresholds, and contact trees so that incidents are reported to the right stakeholders (management, legal, PR, law enforcement) in a timely manner. Options A, B, and D are not key plan elements: antivirus endpoint requirements belong in security baselines or configuration standards, a list of approved forensic tools is an operational/toolkit detail rather than a core plan component, and step-by-step technical remediation instructions for specific attack types belong in playbooks or runbooks that support the plan, not in the plan itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Requirements for antivirus software on endpoints
Why it's wrong here
Endpoint antivirus requirements are a security control baseline, not an incident response plan element; the plan covers preparation, detection, containment, eradication, recovery, and lessons learned. It is tempting because antivirus supports detection, but mandating it belongs in policy or hardening standards.
- ✗
List of approved forensic tools
Why it's wrong here
An incident response plan defines roles, communication paths, escalation criteria, and phases, not a catalogue of approved forensic tools; tool selection belongs to operational procedures or playbooks. It is tempting because forensic tooling matters during investigations, but the plan must remain tool-agnostic to survive environment changes.
- ✓
Roles and responsibilities of the incident response team
Why this is correct
Assigning clear roles and responsibilities ensures each team member knows their exact duties during containment, eradication and recovery, preventing duplicated effort or gaps. This directly satisfies the stem's requirement for key incident response plan elements, since an undocumented team structure leaves response coordination ambiguous when an incident occurs.
- ✗
Step-by-step technical remediation instructions for specific attack types
Why it's wrong here
A plan specifies phases, roles, communication, and escalation, not prescriptive remediation steps for each attack type; those belong in playbooks or runbooks. It is tempting because responders do need technical guidance, yet embedding it in the plan makes the document brittle as threats and tooling evolve.
- ✓
Communication and escalation procedures
Why this is correct
Communication and escalation procedures ensure the right stakeholders are notified within defined timeframes, satisfying the stem's requirement for key incident response plan elements. They define who contacts whom, through which channel, and when to escalate to management or legal, preventing delayed or duplicated notifications during a live incident.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.