CISSP Security Operations Practice Question
An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Roles and responsibilities
An IR plan should include roles, communication plan, and recovery procedures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Roles and responsibilities
Why this is correct
Establishing clearly defined roles and responsibilities is a foundational requirement of an incident response plan. It ensures that the incident response team members, such as the incident commander, technical leads, and legal liaisons, understand their specific duties, preventing chaos and ensuring coordinated execution during a high-pressure security event.
- ✗
Vendor product list
Why it's wrong here
A comprehensive inventory of all vendor products is typically maintained within asset management databases or configuration management systems rather than the incident response plan itself. While knowing the environment is important, cluttering the IR plan with static product lists reduces its operational agility and makes maintenance unnecessarily complex.
- ✗
Employee performance reviews
Why it's wrong here
Employee performance reviews are human resources administrative records used for career development and compensation adjustments. They serve no operational purpose during active containment, eradication, or recovery phases of an incident, and including them would violate privacy principles and distract from technical response objectives.
- ✓
Communication plan
Why this is correct
A robust communication plan is critical for defining how information flows to internal stakeholders, external partners, regulatory bodies, and the public during a breach. It prevents unauthorized disclosures, ensures compliance with legal notification mandates, and maintains organizational trust during a crisis.
- ✓
Recovery procedures
Why this is correct
Recovery procedures provide the technical and operational steps required to safely restore affected systems and data back to a validated, secure baseline operational state. These procedures guide the team in conducting tasks like system re-imaging, data restoration from clean backups, and post-recovery monitoring to ensure the threat has been fully neutralized.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.