easyMultiple Select
CS0-003 Practice Question: Which TWO of the following are key components of…
Which TWO of the following are key components of an incident communication plan?
⚠ Common exam trap
CompTIA often tests the distinction between operational/forensic artifacts (like network diagrams, logs, or encryption keys) and the structured communication components (contacts and scripts) that are explicitly defined in the incident communication plan, leading candidates to mistakenly include technical tools as part of the plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalation contact list
An incident communication plan must include an escalation contact list (A) to ensure that the right stakeholders—such as the incident response team, legal counsel, and executive management—are notified promptly based on the severity of the incident. Pre-approved public statements or scripts (B) are critical to maintain consistent, accurate, and legally vetted messaging to external parties (e.g., customers, media, regulators) during a crisis, preventing unauthorized disclosures that could worsen the situation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Escalation contact list
Why this is correct
An escalation contact list is a foundational element of an incident communication plan, defining the specific internal and external stakeholders to notify as an incident's severity or impact increases. It establishes clear lines of authority, contact methods, and backup personnel to prevent communication bottlenecks during high-pressure response phases.
- ✓
Pre-approved public statements or scripts
Why this is correct
Pre-approved public statements and communication templates allow the public relations and legal teams to quickly disseminate accurate information to the media and customers. Having these scripts ready beforehand minimizes the risk of leaking sensitive technical details or violating regulatory compliance requirements during a crisis.
- ✗
Network topology diagrams
Why it's wrong here
While network topology diagrams are critical for the containment and eradication phases of incident response, they do not belong in a communication plan. These technical schematics help analysts map out affected subnets and assets, whereas communication plans focus strictly on the flow of information to stakeholders.
- ✗
Encryption keys for secure communications
Why it's wrong here
Encryption keys and certificates are technical mechanisms used to secure out-of-band communication channels, such as encrypted chat or email. They are managed under cryptographic key management policies rather than being documented as core components within the incident communication plan itself.
- ✗
System event logs
Why it's wrong here
System event logs are vital forensic artifacts analyzed during the detection and analysis phase of an incident to determine the scope of a breach. They do not serve a purpose in the communication plan, which is designed to coordinate messaging and manage stakeholder expectations rather than perform technical root-cause analysis.
Go deeper
Related to this question
Learn chapter
Incident Categories and Severity
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.