ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
An organization is developing an incident response plan. Which TWO phases are part of the incident response lifecycle according to the NIST framework? (Select two.)
⚠ Common exam trap
The trap is that BIA and Risk Assessment sound like security lifecycle activities, so candidates pick them — but the exam is asking specifically for NIST SP 800-61 IR phases, not general security management activities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preparation
Option A (Preparation) is correct because the NIST SP 800-61 incident response lifecycle begins with the Preparation phase, which covers establishing an IR capability, acquiring tools and resources, and developing policies and procedures before an incident occurs. Option C (Recovery) is correct because NIST defines Recovery as the phase in which systems are restored to normal operation, data is validated, and lessons learned are captured after containment and eradication. The other options do not belong: Business impact analysis (B) is part of business continuity planning, Risk assessment (D) is a risk management activity, and Vulnerability scanning (E) is a technical security control, none of which are named phases of the NIST incident response lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preparation
Why this is correct
Preparation establishes the capabilities required before an incident occurs, including incident response policy, tooling, communications plans and trained personnel. NIST SP 800-61 places Preparation as the first lifecycle phase, directly satisfying the stem's requirement for a framework-defined phase that precedes detection and analysis, containment, eradication, recovery and post-incident activity.
- ✗
Business impact analysis
Why it's wrong here
Business impact analysis is a continuity-planning activity that determines critical processes and recovery objectives; it is not one of NIST's incident response lifecycle phases. It is tempting because BIA results inform preparation and recovery priorities, but the framework lists Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
- ✓
Recovery
Why this is correct
Recovery is a core NIST incident response lifecycle phase, following containment, eradication and lessons learned. It restores affected systems and services to normal operation, satisfying the stem's requirement for a genuine lifecycle phase rather than a preparatory or detection activity.
- ✗
Risk assessment
Why it's wrong here
Risk assessment identifies and prioritises threats and is performed during preparation, not as a distinct NIST incident response lifecycle phase. It is tempting because preparation relies on risk assessment outputs, yet the framework's phases are Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
- ✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning is a proactive security assessment activity, not one of NIST's four incident response lifecycle phases (Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity). It is tempting because scanning supports preparation, but it occurs before an incident rather than within the response lifecycle.
Go deeper
Related to this question
Learn chapter
BC/DR Planning and Testing
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.