ISC2 CC Incident Response: Read the Situation Before Acting

How do an event and an incident differ?

To tell the tasks apart in an ISC2 CC scenario, ask what the question wants done: monitoring observes events, triage sorts them, and incident response acts under a plan on an occurrence that jeopardizes security. NIST's glossary entries open this way: an event is “Any observable occurrence involving computing assets” (SP 800-61 Revision 3), and an incident is “An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability” (FIPS 200). ISC2 places monitoring, triage, threat intelligence, and response exercises in Domain 5, Security Operations and Incident Response, weighted 17.3% in the outline effective September 1, 2026, checked November 3, 2026. That weight shows emphasis; it does not establish a fixed number of questions on your test.

Under the FIPS 200 wording, “potentially” means a case does not need proven damage to be an incident. Definitions vary by publication, though: other incident entries in NIST's glossary, checked November 6, 2026, say “actually or imminently jeopardizes, without lawful authority”. The sources we read do not show ISC2 adopting one definition for CC, so use these as a study aid and let the scenario's wording decide.

Every case here is an original teaching example, not an actual or recalled ISC2 exam item. To name the property at stake, use the CIA reasoning in the ISC2 CC security principles guide.

How do monitoring and triage differ?

Monitoring produces the observation; triage decides what it deserves. NIST's glossary gave us no entry for triage (checked November 6, 2026), so this is our plain-language gloss, not an official definition: deciding which events need attention first and why. The table is an editorial study aid, not ISC2 wording.

Our paraphrase in the ISC2 CC domains guide puts monitoring, event triage, and threat intelligence under security operations (5.2), and using and testing a response plan under incident response (5.3); the ISC2 PDF has the exact wording. ISC2's August 6, 2026 article says the update moved incident response into operations, so an older resource may still file it with business continuity and disaster recovery. An old heading is a reason to check coverage, not proof that the material is wrong.

Threat intelligence informs triage. NIST's glossary calls it “Cyber threat information that has been aggregated, transformed, analyzed, interpreted, or enriched” and says it gives context for decisions. A warning that similar organizations are seeing a pattern may raise an event's priority, but it does not establish what happened in yours.

To see this domain beside the other four, full ISC2 CC prep planned for launch is organized by the five domains, including Security Operations and Incident Response.

What does a response plan help you decide?

A response plan helps settle who acts, who is told, and what is recorded, so your answer should follow the plan the scenario gives you. NIST SP 800-61 Revision 3 (April 2025, superseding Revision 2, checked November 3, 2026) says plans reflect an organization's needs, mission, size, and resources. Two organizations can therefore handle the same facts differently.

The publication sets no universal reporting deadline for every organization, so use a deadline only if the scenario states one. It also sets no rule that shutting a system down always comes first. The next action depends on the evidence, your authority, and the task the question names. If the scenario states a plan or a role, apply it. If it does not, do not invent one: choose a step inside your stated authority, such as escalating to the responsible role.

Which facts are missing from the scenario?

Before choosing an action, list what the scenario states, what it leaves out, and what it asks.

Case 1: repeated failed sign-ins, then a success from a new location

Change one fact: the employee says they never signed in from there. The facts now point to unauthorized access, so the task moves from triage to response, including limiting harm as the plan allows. If the stated plan permits a temporary account lock on suspicion alone, that step could come sooner. The ISC2 CC identity and access-control guide covers how access is reviewed and removed.

Case 2: an alert on a server during a recorded change window

Change one fact: the change record covers a different server. That does not prove an attack, but the expected explanation is gone, so the alert moves up the queue and goes to the responsible role.

To repeat this habit across the syllabus, full ISC2 CC prep is planned for launch with 900 questions across the five domains.

What can a tabletop exercise test?

NIST's glossary, citing SP 800-84, describes a tabletop as “A discussion-based exercise where personnel with roles and responsibilities in a particular IT plan” take part, and adds: “A facilitator initiates the discussion by presenting a scenario and asking questions based on the scenario.” SP 800-61 Revision 3 notes that “Incident response exercises and tests may provide helpful information for program evaluation”.

Because a tabletop is discussion-based, it can show gaps in roles, decisions, and plan wording, but it does not prove that a system or control works.

Here is a one-page tabletop for a study group, or for one person taking each role in turn. It is an editorial outline, not an ISC2 or NIST template. If you have no plan to test, write five lines of a fictional one first.

1. Facilitator: one person reads the scenario and asks the questions without supplying answers.
2. Scenario: use Case 1 in two stages, first the sign-ins, then the employee's reply.
3. Roles: assign hypothetical roles, such as help desk, incident lead, and communications contact.
4. Questions: Who sees this first? Who can lock the account? Who must be told? What is recorded?
5. Plan gaps: list each question the plan could not answer, with the role that should resolve it.

Terms such as event, incident, and tabletop blur easily, and full ISC2 CC prep is planned for launch with 450 flashcards for terminology review.

How should you explain your next action?

Write four lines for any response scenario. This routine is an editorial study method, not an ISC2 scoring rule.

1. Stated: what the scenario establishes.
2. Missing: the one fact that would change your answer.
3. Task: monitoring, triage, or response, and who has authority.
4. Next step: the action those facts support, and why the tempting alternative is not yet justified.

For Case 1: “Stated: repeated failures, then a success from a new location. Missing: whether the employee signed in. Task: triage, by the alert reviewer. Next step: confirm with the employee and escalate as the plan says; announcing a breach is not yet justified because unauthorized access is not established.”

Do not answer by reciting an order. NIST's CSF 2.0 (February 2024, checked November 5, 2026) describes outcomes, and the listing of its six functions is not a mandatory incident sequence. The ISC2 sources we read do not assign one list of phases to CC. If your course teaches phases, use them as vocabulary and still reason from the scenario.

Apply the four lines to the 20 free ISC2 CC practice questions, then use the free ISC2 CC study plan to choose your next review. The eight-week ISC2 CC study plan guide places this domain in week 7 of its editorial schedule.

These cases cover monitoring, triage, and response only. Domain 5 also includes data protection, asset and change management, and security testing, so mark those objectives separately. Recheck the outline on ISC2's site before you book.

For a longer mixed session, a 125-question mock exam is planned for launch as part of full ISC2 CC prep. If you are also setting a budget, the ISC2 CC exam cost guide covers the fees.