mediumMultiple SelectObjective-mapped
CCSP Practice Question: A cloud security team is developing an incident…
A cloud security team is developing an incident response plan for a SaaS application hosted on a public cloud. During the preparation phase, which TWO steps are most critical to include?
⚠ Common exam trap
ISC2 often tests the distinction between preparation-phase activities (planning, training, documentation) and operational-phase activities (detection, containment, recovery), leading candidates to mistakenly select automated response or monitoring tools as preparation steps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct regular tabletop exercises to simulate incident scenarios
Conducting regular tabletop exercises (Option A) is critical during the preparation phase because it validates the incident response plan's effectiveness, identifies gaps in team coordination, and ensures stakeholders understand their roles without impacting production systems. This proactive simulation aligns with NIST SP 800-61 and CCSP best practices for readiness testing before an actual incident occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct regular tabletop exercises to simulate incident scenarios
Why this is correct
Tabletop exercises help validate the plan and train the response team before an incident.
- ✗
Conduct a post-mortem analysis of previous incidents
Why it's wrong here
Post-mortem analysis occurs after incidents, not during preparation.
- ✗
Implement automated isolation of compromised instances
Why it's wrong here
Automation is implemented during the detection and response phases, not preparation.
- ✓
Define and document communication escalation paths
Why this is correct
Clear communication channels are essential for coordination during an incident.
- ✗
Deploy a security information and event management (SIEM) system
Why it's wrong here
SIEM deployment is part of detection/visibility, not preparation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.