ISC Updated CC Exam Questions and Answers by igor

An incident response policy establishes authority, scope, and direction. Without management approval, IR activities lack legitimacy.

Preparation is the foundational phase of incident response. It defines policies, roles, responsibilities, tools, training, and communication procedures. Without preparation, all other phases become chaotic and ineffective.

NIST SP 800-61 emphasizes preparation as the first phase because it ensures responders understand escalation paths, legal considerations, evidence handling, and authority. A new security engineer must understand preparation to operate effectively during real incidents.

ATrojanis a direct form of malware that disguises itself as legitimate software to perform malicious actions.

While managementparticipatesin BCP, “management” alone is not a documented component. The other options represent formal, documented BCP elements.