ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Notifying affected customers
Option A (Notifying affected customers) is correct because crisis communications during a data breach must include timely, clear notification to the individuals whose personal data was compromised, enabling them to take protective steps such as changing passwords or monitoring accounts. Option C (Complying with regulatory notification requirements) is correct because laws and regulations such as GDPR, HIPAA, and state breach-notification statutes mandate specific disclosures to regulators and affected parties within defined timeframes, making compliance a core communications obligation. Option D (Informing the organization's executive management) is correct because executives need accurate, prompt situational awareness to authorize response actions, allocate resources, and serve as the organization's authoritative voice internally and externally. Option B is not correct because publicly revealing technical attack details can expose unpatched vulnerabilities, aid attackers, and jeopardize ongoing forensic investigations. Option E is not correct because deleting logs destroys evidence, violates legal hold and retention obligations, and would obstruct incident response and regulatory compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Notifying affected customers
Why this is correct
Notifying affected customers is a core crisis communication duty, ensuring individuals can take protective action against identity theft or fraud. It satisfies the stem's requirement for essential breach communication components, complementing regulatory notification and executive briefing.
- ✗
Revealing technical details of the attack to the public
Why it's wrong here
Publishing attack specifics exposes unpatched weaknesses and aids copycat intrusions, while crisis communications should deliver approved, legally vetted messaging to affected parties and regulators. Technical indicators belong in confidential threat-intelligence sharing such as an ISAC, not public disclosure during an active incident.
- ✓
Complying with regulatory notification requirements
Why this is correct
Regulatory notification requirements impose statutory deadlines and prescribed recipient lists that crisis communications must satisfy during a breach. Embedding these obligations ensures affected individuals, regulators and other mandated parties receive timely, accurate disclosure, preventing additional penalties and preserving the organisation's legal standing throughout incident response.
- ✓
Informing the organization's executive management
Why this is correct
Informing executive management ensures leadership can authorise containment decisions, allocate resources and meet governance duties during a breach. It satisfies the crisis communications requirement by establishing an internal escalation path, distinct from external notification to regulators or affected customers, so command decisions are made promptly.
- ✗
Deleting all logs to prevent evidence leakage
Why it's wrong here
Destroying logs eliminates the forensic timeline needed to determine breach scope and satisfy notification duties, and may itself breach retention regulations. Log preservation is the actual requirement. Retention and legal hold policies are what an incident response plan should invoke, not deletion, which only serves attackers covering their tracks.
Go deeper
Related to this question
Learn chapter
Security Awareness and Training
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.