During a major incident, the incident commander is overwhelmed with technical details and is not making timely decisions. The lead analyst is providing detailed forensic reports, but the response is stalling. Which adjustment would most effectively improve the incident response?

Delegate technical analysis to the lead analyst and have the incident commander focus on strategic decisions

Stop all communication with stakeholders until the incident is resolved

Eliminate the communications lead to reduce the number of people involved

Have the incident commander perform the forensic analysis themselves

After a security incident, the incident response team completes a lessons-learned review. They find that the response was delayed because the on-call analyst did not know how to escalate the incident. Which improvement would most directly address this finding?

Disable the on-call rotation to avoid future delays

Increase the number of on-call analysts

Purchase additional security monitoring tools

Update the incident response plan to include a clear escalation path and conduct training on it

A company is responding to a malware outbreak. The incident response team has confirmed the infection and is now working through the response phases. Which of the following actions are part of the containment phase? (Select all that apply.)

Removing malware from infected systems

Blocking malicious IP addresses at the firewall

Isolating infected systems from the network

Disabling compromised user accounts

Certified in Cybersecurity

Domain 2Objective 3

2.3 - Understand Incident Response CC Practice Questions (Page 4)

Part of the Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts domain, which accounts for 10% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 16–20

16expert · hard
During a major incident, the incident commander is overwhelmed with technical details and is not making timely decisions. The lead analyst is providing detailed forensic reports, but the response is stalling. Which adjustment would most effectively improve the incident response?
Select an answer first
17expert · hard
After a security incident, the incident response team completes a lessons-learned review. They find that the response was delayed because the on-call analyst did not know how to escalate the incident. Which improvement would most directly address this finding?
Select an answer first
18foundation · easy
Which role in an incident response team is responsible for coordinating the overall response effort?
Select an answer first
19foundation · easy
Which incident response team role is primarily responsible for managing external communications with the media and stakeholders?
Select an answer first
20expert · hard · select all that apply
A company is responding to a malware outbreak. The incident response team has confirmed the infection and is now working through the response phases. Which of the following actions are part of the containment phase? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.

2.3 - Understand Incident Response CC Practice Questions (Page 4)

Questions 16–20

During a major incident, the incident commander is overwhelmed with technical details and is not making timely decisions. The lead analyst is providing detailed forensic reports, but the response is stalling. Which adjustment would most effectively improve the incident response?

After a security incident, the incident response team completes a lessons-learned review. They find that the response was delayed because the on-call analyst did not know how to escalate the incident. Which improvement would most directly address this finding?

Which role in an incident response team is responsible for coordinating the overall response effort?

Which incident response team role is primarily responsible for managing external communications with the media and stakeholders?

A company is responding to a malware outbreak. The incident response team has confirmed the infection and is now working through the response phases. Which of the following actions are part of the containment phase? (Select all that apply.)

Keep studying — Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts