easyMultiple SelectObjective-mapped
SSCP Practice Question: Which TWO roles are typically part of an incident…
Which TWO roles are typically part of an incident response team?
⚠ Common exam trap
Many candidates confuse operational support roles (like Network Administrator) with core incident response team roles, or mistakenly include executive/legal positions as permanent team members rather than as external stakeholders consulted on an as-needed basis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident Manager
The Incident Manager (C) is the central coordinator who manages the incident response process, ensures communication among stakeholders, and makes strategic decisions during an incident. The Forensic Analyst (D) is responsible for collecting, preserving, and analyzing digital evidence in a forensically sound manner, often using tools like FTK Imager or EnCase to maintain chain of custody. Both roles are essential for a structured and legally defensible incident response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Chief Financial Officer
Why it's wrong here
CFO is not involved in technical response.
- ✗
Network Administrator
Why it's wrong here
Network Admin may assist but is not a standard role on the IR team.
- ✓
Incident Manager
Why this is correct
The Incident Manager coordinates the response effort.
- ✓
Forensic Analyst
Why this is correct
Forensic Analysts collect and analyze evidence.
- ✗
Legal Counsel
Why it's wrong here
Legal Counsel provides advice but is not a core IR role.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.