SSCP Incident Response and Recovery Practice Question
During the preparation phase of incident response, which TWO components are essential for an effective incident response plan? (Select TWO)
⚠ Common exam trap
Candidates often confuse operational logistics (like vendor lists or network diagrams) with the core structural components of an incident response plan, which must prioritize communication and recovery to enable a coordinated and effective response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A communication plan with contact information for key stakeholders
Option C is correct because an incident response plan must include a communication plan with up-to-date contact information for key stakeholders (e.g., incident handlers, management, legal, PR, and law enforcement) so that notifications and escalations occur quickly and in the proper order during an incident. Option E is correct because detailed recovery procedures for each critical system provide the documented, tested steps (such as restoration order, RTO/RPO targets, and system-specific rebuild or failover instructions) needed to return operations to normal after containment and eradication. Option A is not essential to the plan itself, since vendor lists support logistics but are not a core IR plan component. Option B is incorrect and a security risk, as storing all employee passwords violates least privilege and credential-management best practices. Option D, while useful for scoping and containment, is supporting documentation rather than one of the two essential components emphasized here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A list of approved vendors for hardware replacement
Why it's wrong here
Vendor lists support hardware replacement during recovery, not preparation of response capability. It is tempting because procurement matters after destructive incidents, but essential preparation components are the incident response plan and the trained response team, with communications and documentation.
- ✗
A list of all employee passwords
Why it's wrong here
Storing employee passwords undermines accountability and violates authentication principles; credentials are never an incident response component. It is tempting as an access-recovery aid, but essential preparation components are the incident response plan and the trained response team, supported by communications and documentation.
- ✓
A communication plan with contact information for key stakeholders
Why this is correct
A communication plan with stakeholder contact details satisfies the coordination constraint during preparation, ensuring the right people are reachable the moment an incident is declared. Without predefined escalation paths and contacts, response stalls while responders hunt for decision-makers, delaying containment and violating the plan's requirement for clear internal and external notification procedures.
- ✗
Network topology diagrams
Why it's wrong here
Topology diagrams aid containment and impact assessment, but the preparation phase requires the plan itself and the team's defined roles, not environmental documentation. They are genuinely useful during detection and recovery, when tracing affected segments, which is why they tempt.
- ✓
Detailed recovery procedures for each critical system
Why this is correct
Documented recovery procedures per critical system let responders restore services in a defined, tested order rather than improvising under pressure. This satisfies the preparation-phase requirement for pre-approved restoration steps that minimise downtime and data loss.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.