CISSP Security Operations Practice Question
An organization is developing an incident response plan. Which component is primarily responsible for defining the criteria for escalating an incident to senior management and legal counsel?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalation paths
Escalation paths specify the conditions and hierarchy for notifying higher-level management and legal teams based on incident severity and impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Escalation paths
Why this is correct
Escalation paths are a critical component of an incident response plan, explicitly detailing the predefined triggers and the hierarchical notification process for significant incidents. They specify which individuals or departments, such as senior management, legal counsel, or public relations, must be informed at various stages of an incident based on its severity, impact, or regulatory implications. This ensures that appropriate leadership and specialized expertise are engaged promptly to manage the broader organizational consequences.
- ✗
Communication plan
Why it's wrong here
A communication plan outlines the strategies, channels, and templates for disseminating information to various internal and external stakeholders during an incident. While it defines how and what information is shared with employees, customers, or media, it does not establish the specific criteria or hierarchical structure for escalating the incident to higher levels of management or specialized legal/executive teams based on its evolving severity or impact. Its focus is on information dissemination, not the decision-making chain for incident management.
- ✗
Recovery procedures
Why it's wrong here
Recovery procedures are primarily focused on the post-incident phase, detailing the steps required to restore affected systems, data, and services to normal operational status. These procedures, often part of business continuity and disaster recovery plans, address the technical and logistical actions needed to mitigate long-term impact and resume business functions. They do not, however, define the initial incident detection, analysis, or the critical process of escalating an active incident to appropriate management or legal authorities during the response phase.
- ✗
Incident categories
Why it's wrong here
Incident categories serve to classify and group different types of security incidents based on their nature, such as malware infection, data breach, or denial-of-service attack. While these classifications are essential for initial assessment and determining potential impact, they do not inherently define the specific triggers, thresholds, or the hierarchical chain of command for escalating an incident to senior leadership or legal counsel. Categories inform the why and what of an incident, but not the who and when of its formal escalation.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Incident severity
Incident severity is a classification used in IT incident management to describe the level of impact and urgency of an event, guiding response priority.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.