mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: An organization's incident response plan is…
An organization's incident response plan is tested annually. After a real incident, the team finds that the plan did not address cloud-based assets. What is the BEST action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the incident response plan to include cloud scenarios
The plan should be updated to include cloud assets. Option D is correct. Option A only addresses the symptom; Option B may be unnecessary; Option C adds complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Migrate all cloud assets back on-premises
Why it's wrong here
Drastic and not necessary.
- ✗
Retrain the IR team on cloud incident response
Why it's wrong here
Training is good but the plan itself needs updating.
- ✗
Create a separate cloud incident response plan
Why it's wrong here
Creating a separate cloud incident response plan fragments the response process, introducing coordination overhead between two plans during a hybrid incident. This fails the scenario because the real incident exposed that the existing plan lacked cloud coverage, so the correct action is to integrate cloud-specific procedures into the single plan to ensure unified command and consistent playbooks. It is tempting because separate plans are appropriate when cloud and on-premises environments operate under distinct regulatory frameworks or have entirely independent security teams, making isolation the correct choice in that context.
- ✓
Update the incident response plan to include cloud scenarios
Why this is correct
The plan must be revised based on lessons learned.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.