CISSP Security Operations Practice Question
An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?
⚠ Common exam trap
CISSP often tests the confusion between core incident response plan components and ancillary documents like asset inventories or HR records, so candidates must recognize the three essential elements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Roles and responsibilities
Option A (Roles and responsibilities) is correct because an incident response plan must define who does what during an incident, assigning clear ownership of tasks such as detection, triage, containment, eradication, and recovery so that actions are not duplicated or missed. Option D (Communication plan) is correct because it specifies internal and external notification paths, escalation thresholds, contact trees, and stakeholder/customer/regulator messaging, which is essential for coordinated response and meeting breach-notification obligations. Option E (Recovery procedures) is correct because the plan must document the steps to restore affected systems and services to normal operation, including validation, prioritization, and return-to-production criteria. Option B (Vendor product list) is not a required component; while asset and vendor inventories can support response, a mere product list is not part of the core plan structure. Option C (Employee performance reviews) is unrelated to incident response and belongs to HR performance management, not the IR plan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Roles and responsibilities
Why this is correct
Establishing clearly defined roles and responsibilities is a foundational requirement of an incident response plan. It ensures that the incident response team members, such as the incident commander, technical leads, and legal liaisons, understand their specific duties, preventing chaos and ensuring coordinated execution during a high-pressure security event.
- ✗
Vendor product list
Why it's wrong here
A comprehensive inventory of all vendor products is typically maintained within asset management databases or configuration management systems rather than the incident response plan itself. While knowing the environment is important, cluttering the IR plan with static product lists reduces its operational agility and makes maintenance unnecessarily complex.
- ✗
Employee performance reviews
Why it's wrong here
Employee performance reviews are human resources administrative records used for career development and compensation adjustments. They serve no operational purpose during active containment, eradication, or recovery phases of an incident, and including them would violate privacy principles and distract from technical response objectives.
- ✓
Communication plan
Why this is correct
A robust communication plan is critical for defining how information flows to internal stakeholders, external partners, regulatory bodies, and the public during a breach. It prevents unauthorized disclosures, ensures compliance with legal notification mandates, and maintains organizational trust during a crisis.
- ✓
Recovery procedures
Why this is correct
Recovery procedures provide the technical and operational steps required to safely restore affected systems and data back to a validated, secure baseline operational state. These procedures guide the team in conducting tasks like system re-imaging, data restoration from clean backups, and post-recovery monitoring to ensure the threat has been fully neutralized.
Go deeper
Related to this question
Learn chapter
Incident Response and Business Continuity
Key term
Asset
In IT and cybersecurity, an asset is anything valuable that an organization owns or controls, including data, hardware, software, people, and intellectual property.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.