CISSP Security Operations Practice Question
An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?
⚠ Common exam trap
CISSP often tests whether candidates can distinguish the components of an incident response plan — the trap is confusing the definition of an incident (categories) with the actions taken after an incident (communication, recovery, legal notification).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident categories
Incident categories define the classification scheme that specifies what types of events constitute an incident and how they are grouped (e.g., malware, DoS, unauthorized access). This component establishes the conditions and thresholds that trigger incident declaration, making it the correct answer for 'defining the specific conditions that constitute an incident.' Categories also drive escalation paths and response procedures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Communication plan
Why it's wrong here
A communication plan specifies the stakeholders, methods, and frequency for disseminating information once an incident has been identified and classified. Its primary purpose is to manage internal and external messaging during the incident lifecycle, ensuring timely and appropriate disclosure to affected parties, management, and potentially regulators. It does not, however, establish the criteria or conditions that initially qualify an event as an incident requiring such communication.
- ✗
Recovery procedures
Why it's wrong here
Recovery procedures delineate the systematic steps required to restore affected systems, data, and services to their operational state following an incident's containment and eradication phases. These procedures focus on business continuity and disaster recovery, outlining processes like data restoration from backups, system rebuilding, and service validation. While crucial for minimizing downtime and impact, they do not provide the initial criteria or thresholds for identifying an event as an incident in the first place.
- ✗
Legal notification requirements
Why it's wrong here
Legal notification requirements detail the mandatory reporting obligations an organization faces after a confirmed incident, particularly those involving personally identifiable information (PII) or protected health information (PHI). These requirements specify who must be notified (e.g., affected individuals, regulatory bodies), when (e.g., within 72 hours), and what information must be disclosed. However, these stipulations are triggered by an incident's classification and impact assessment, rather than defining the initial conditions that qualify an event as an incident itself.
- ✓
Incident categories
Why this is correct
Incident categories establish predefined classifications and criteria that help an organization determine whether a particular event constitutes a security incident requiring formal response. These categories, such as "malware infection," "unauthorized access," "denial of service," or "data exfiltration," provide clear definitions and often include specific indicators or thresholds. By categorizing events, organizations can standardize incident identification, prioritize response efforts, and ensure consistent handling based on the nature and potential impact of the security breach.
Go deeper
Related to this question
Learn chapter
Incident Response and Business Continuity
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.