What is the goal of the eradication phase in incident response?

To identify the scope of the incident

To remove the root cause of the incident from affected systems

To communicate with stakeholders

To restore systems to normal operation

A mid-sized company is developing its first incident response plan. The CISO wants to ensure that during a major incident, decision-making is clear and that the right people are notified without confusion. Which two elements are most essential to include in the plan to meet this goal?

A defined incident commander role and a communication plan with escalation contacts

A backup schedule and a data retention policy

A list of forensic tools and a detailed malware analysis procedure

A list of all employees and their job titles

What is the purpose of triage in incident detection and analysis?

To permanently delete all incident-related data

To automatically resolve all incidents without human intervention

To prioritize incidents based on their severity and potential impact

To communicate with the media about ongoing incidents

Which statement best describes the goal of incident response?

To minimize the impact of security incidents by responding effectively and recovering quickly

To ensure that all security incidents are automatically prevented before they happen

To transfer the risk of security incidents to third-party insurance providers

To document all security incidents for regulatory compliance purposes only

Certified in Cybersecurity

Domain 2Objective 3

2.3 - Understand Incident Response CC Practice Questions (Page 1)

Part of the Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts domain, which accounts for 10% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 1–5

1foundation · easy
What is the goal of the eradication phase in incident response?
Select an answer first
2application · medium
A mid-sized company is developing its first incident response plan. The CISO wants to ensure that during a major incident, decision-making is clear and that the right people are notified without confusion. Which two elements are most essential to include in the plan to meet this goal?
Select an answer first
3foundation · easy
What is the purpose of triage in incident detection and analysis?
Select an answer first
4foundation · easy
Which component of an incident response program defines the specific actions to take during an incident?
Select an answer first
5foundation · easy
Which statement best describes the goal of incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.