ISC2 CC Business Continuity, DR & Incident Response Practice Question
Which TWO of the following are primary objectives of an incident response plan? (Choose two.)
⚠ Common exam trap
ISC2 often tests the distinction between the incident response plan's primary objectives (containment and recovery) and the secondary or post-incident activities (root cause analysis, evidence collection), causing candidates to mistakenly select options like C or E as primary objectives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Return affected systems to normal operation
A primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure business continuity during the incident
Why it's wrong here
BCP handles continuity; IR focuses on response and recovery.
- ✓
Return affected systems to normal operation
Why this is correct
Recovery is a primary objective of IR.
- ✗
Collect evidence for legal proceedings
Why it's wrong here
Evidence collection is secondary; containment and recovery are primary.
- ✓
Minimize the impact of the incident
Why this is correct
Containment and mitigation are core IR objectives.
- ✗
Identify the root cause of the incident
Why it's wrong here
Root cause analysis is part of lessons learned, not an immediate objective.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Eradication
Eradication is the phase in incident response where the root cause of a security breach is completely removed from the system to prevent the attack from happening again.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.