CAS-004 Governance, Risk, and Compliance Practice Question
A security analyst is reviewing the organization's incident response plan. The plan includes a section on communication with external parties. Which of the following best describes the primary purpose of a communication plan during a security incident?
⚠ Common exam trap
The trap here is equating the communication plan with technical response actions, when it actually governs stakeholder messaging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To ensure timely and accurate information sharing with stakeholders, regulators, and the public.
The communication plan is a component of incident response that focuses on information sharing with stakeholders, including executives, legal, regulators, and customers. Its primary goal is to ensure timely, accurate, and compliant messaging. Technical containment and evidence handling are separate processes, making the stakeholder communication purpose the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To outline the technical steps for containing the incident.
Why it's wrong here
Containment steps are part of the incident response procedures, not the communication plan. The communication plan is about information dissemination, not tactical actions. Confusing the two can lead to delays in notifying affected parties, which may have regulatory consequences.
- ✗
To document the chain of custody for forensic evidence.
Why it's wrong here
Chain of custody is part of evidence handling procedures, not the communication plan. It ensures evidence integrity for legal proceedings. The communication plan addresses messaging and notifications, not the procedural documentation of evidence, which is a separate forensic requirement.
- ✗
To provide technical details of the incident to the security operations team.
Why it's wrong here
Technical details are typically shared through incident ticketing systems and internal briefings, not the overarching communication plan. The plan focuses on strategic and external communication. While technical teams need information, that is not the primary purpose of the communication plan, which is broader stakeholder management.
- ✓
To ensure timely and accurate information sharing with stakeholders, regulators, and the public.
Why this is correct
A communication plan defines who communicates what, when, and to whom during an incident. Its primary purpose is to manage information flow to internal and external stakeholders, maintain trust, and meet legal obligations. This reduces confusion and helps control the narrative, which is critical for incident response.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.