Domain 4 · Objective reference 4A1 · Chapter 24 of 35
Build an incident-response plan
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: The plan must name who can decide under pressure.
Explore the anchors
Assign command escalation and decision rights.
Concept matching activity
Match this task or description to its concept:
Define practical actions evidence and handoffs.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Make the response plan usable
Management concept and decision mechanism
A response plan coordinates authority, roles, contacts, classification, evidence, actions and communication. Align it with continuity and disaster recovery so containment and service priorities do not conflict silently. Define out-of-hours authority and alternatives when normal communications or identity services are unavailable. Preparation includes access to tools and suppliers, not only a written contact list. Use current applicable obligations with authorized specialists for reporting decisions. Test the plan against specific objectives and update it after material changes or lessons from incidents.
Make the response plan usable
Define incident reporting channels, severity criteria, decision roles, escalation, and access to specialist support. Keep contact information and essential instructions accessible when normal communication systems are unavailable. Establish how business owners, security, technology, legal, and communications teams coordinate.
Practice using realistic scenarios. Check who can authorize containment, how evidence will be protected, and how recovery will be approved. An exercise should reveal assumptions, not merely demonstrate that participants can read the plan aloud.
Worked example
A scenario removes the normal messaging service, so responders exercise approved alternate communications and decision authority.
Check your understanding
Why is a list of technical containment steps not a complete incident plan?
Show explanation
People, authority, business priorities, evidence, supplier coordination, notification and recovery also need explicit arrangements.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.