mediumMultiple Select
CISM Practice Question: Which THREE of the following are considered key…
Which THREE of the following are considered key components of an incident response plan?
⚠ Common exam trap
ISACA CISM often tests the distinction between incident response plan components and supporting artifacts or adjacent processes, so candidates mistakenly select network diagrams or disaster recovery procedures as key components when they are merely supplementary or belong to a different domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-incident review process
A post-incident review process (A) is a key component because it captures lessons learned, root-cause analysis, and corrective actions after an incident is contained and eradicated, feeding continuous improvement back into the plan. A communication escalation matrix (B) is essential because it defines who is notified, in what order, within what timeframes, and through which channels (e.g., phone, email, pager) during an incident, ensuring timely stakeholder and management engagement. Roles and responsibilities (C) are a core element because they assign clear ownership of incident response activities — such as incident commander, communications lead, and forensics analyst — preventing confusion and gaps during an active incident. Network diagrams (D) are useful reference artifacts for troubleshooting and scoping, but they are supporting documentation rather than a defining component of an incident response plan. Disaster recovery procedures (E) belong to the disaster recovery plan (DRP) and business continuity planning, which address restoring critical systems and operations after major disruptions, not the structured detection, containment, eradication, and recovery workflow of incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Post-incident review process
Why this is correct
A post-incident review captures lessons learned, root cause and corrective actions after containment, feeding improvements back into the plan. It satisfies the requirement for a key component by ensuring the response matures, rather than treating incident closure as the endpoint.
- ✓
Communication escalation matrix
Why this is correct
A communication escalation matrix defines who is notified, when and through which channel during an incident. It satisfies the key-component requirement by ensuring timely, consistent notification of management, legal and technical stakeholders, preventing delays or missed escalation during high-pressure response.
- ✓
Roles and responsibilities
Why this is correct
Roles and responsibilities assign specific incident response tasks to named individuals or teams, removing ambiguity about who contains, investigates and communicates. This satisfies the key-component requirement by ensuring accountability and coordination across the response, which unstructured plans lack.
- ✗
Network diagrams
Why it's wrong here
Network diagrams document infrastructure topology; they are reference material supporting response, not a plan component specifying roles, escalation, communication or containment steps. They are tempting because responders genuinely need topology during triage, and diagrams belong in the supporting appendices of a plan rather than its core structure.
- ✗
Disaster recovery procedures
Why it's wrong here
Disaster recovery procedures restore IT services after major disruption, addressing availability and continuity, whereas incident response plans contain detection, analysis, containment, eradication and recovery steps for security incidents. They are tempting because both are invoked during crises and share escalation paths, but DR sits in the BCP/DR domain.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.