mediumMultiple SelectObjective-mapped
CISM Practice Question: Which TWO of the following are key components of…
Which TWO of the following are key components of an effective incident response plan?
⚠ Common exam trap
ISACA often tests the distinction between the plan's structural components (like chain of command and communication plans) and operational tools or overly rigid scripts, tempting candidates to select automatic tools or exhaustive scripts as key components when they are not foundational to the plan's design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A clear chain of command and escalation procedures.
A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A clear chain of command and escalation procedures.
Why this is correct
This ensures decision-making authority is defined.
- ✗
Automatic detection and response tools.
Why it's wrong here
Tools support the plan but are not components of the plan itself.
- ✗
Predefined response scripts for every possible incident.
Why it's wrong here
Scripts are impractical; plans focus on processes.
- ✓
A communication plan for internal and external stakeholders.
Why this is correct
Communication is critical during an incident.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.