CISSP Security Operations Practice Question
Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Communications lead
The communications lead manages external messaging during an incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Legal counsel
Why it's wrong here
Legal counsel's primary role within an incident response team is to provide expert legal guidance, ensuring all actions comply with relevant laws, regulations, and contractual obligations. They advise on potential legal liabilities, data breach notification requirements, and review external communications for legal accuracy and risk mitigation. However, they do not directly manage the strategic planning or execution of stakeholder communications during an incident.
- ✗
Incident manager
Why it's wrong here
The Incident Manager is responsible for the overall coordination and strategic direction of the incident response effort. This includes assembling the team, allocating resources, tracking progress, and making critical decisions to contain, eradicate, and recover from the incident. While they ensure that communications occur, their focus is on the technical and operational aspects of incident resolution, delegating the specialized task of crafting and disseminating messages to the appropriate lead.
- ✗
Forensic investigator
Why it's wrong here
A forensic investigator's core responsibility is to meticulously collect, preserve, and analyze digital evidence related to the security incident. Their objective is to determine the attack vector, scope of compromise, and impact on systems and data, often to support legal proceedings or improve future defenses. This highly technical role requires specialized skills in data recovery and analysis, and it does not involve managing external or internal stakeholder communications.
- ✓
Communications lead
Why this is correct
The Communications Lead is the designated individual primarily responsible for developing and executing the incident communication strategy. This critical role involves crafting accurate, timely, and consistent messages for all internal and external stakeholders, including employees, customers, partners, regulators, and the media. They manage public relations, coordinate press releases, and ensure that all official statements align with the incident response objectives and organizational values.
Go deeper
Related to this question
Learn chapter
Incident Response and Business Continuity
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.