CISSP Security Operations Practice Question
An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident categories
Incident categories define what events are considered incidents, enabling consistent classification and response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Communication plan
Why it's wrong here
A communication plan specifies the stakeholders, methods, and frequency for disseminating information once an incident has been identified and classified. Its primary purpose is to manage internal and external messaging during the incident lifecycle, ensuring timely and appropriate disclosure to affected parties, management, and potentially regulators. It does not, however, establish the criteria or conditions that initially qualify an event as an incident requiring such communication.
- ✗
Recovery procedures
Why it's wrong here
Recovery procedures delineate the systematic steps required to restore affected systems, data, and services to their operational state following an incident's containment and eradication phases. These procedures focus on business continuity and disaster recovery, outlining processes like data restoration from backups, system rebuilding, and service validation. While crucial for minimizing downtime and impact, they do not provide the initial criteria or thresholds for identifying an event as an incident in the first place.
- ✗
Legal notification requirements
Why it's wrong here
Legal notification requirements detail the mandatory reporting obligations an organization faces after a confirmed incident, particularly those involving personally identifiable information (PII) or protected health information (PHI). These requirements specify who must be notified (e.g., affected individuals, regulatory bodies), when (e.g., within 72 hours), and what information must be disclosed. However, these stipulations are triggered by an incident's classification and impact assessment, rather than defining the initial conditions that qualify an event as an incident itself.
- ✓
Incident categories
Why this is correct
Incident categories establish predefined classifications and criteria that help an organization determine whether a particular event constitutes a security incident requiring formal response. These categories, such as "malware infection," "unauthorized access," "denial of service," or "data exfiltration," provide clear definitions and often include specific indicators or thresholds. By categorizing events, organizations can standardize incident identification, prioritize response efforts, and ensure consistent handling based on the nature and potential impact of the security breach.
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.