CIM Cheat Sheet 2026

The 30 highest-yield CIM facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which type of change requires the most comprehensive documentation and formal approval process? → High-risk normal change
2. A CIM notices that MTTR has decreased by 20% over three months but incident recurrence rate has increased. What does this suggest? → The team is resolving incidents faster without addressing root causes
3. Which approach to risk assessment relies on historical data, loss databases, and statistical models to assign numeric probabilities? → Quantitative risk assessment
4. Which ITIL practice ensures that accurate information about the configuration of services and CIs is available when needed? → Service Configuration Management
5. Which ITIL practice is most closely aligned with Incident Response Planning & Coordination? → Incident Management
6. What is the primary purpose of a Post-Incident Review (PIR) following a major incident? → To identify root causes and prevent recurrence
7. Who is typically responsible for risk management? → Project manager or risk manager
8. During a major incident, an Incident Manager identifies that the workaround also affects a secondary system. Which ITIL practice should be engaged immediately? → Problem Management
9. When should a press statement be prepared for a major public-facing incident? → Proactively, before or during the incident, approved by legal and PR teams
10. Who should be involved in the post-incident review? → All key stakeholders and response team members
11. What is the primary risk of consistently under-prioritizing incidents at intake? → SLA breaches and unresolved business-critical outages
12. Which document pre-defines escalation paths and contact lists for use during major incidents? → Incident escalation policy and runbook
13. Which concept refers to the geographic distribution of data centers to ensure a regional disaster does not affect all copies of critical data? → Geographic redundancy
14. Why is timely reporting important after an incident? → Ensures information is fresh and actionable
15. What does 'service restoration' mean in the context of major incident management? → Normal or agreed service operation has been resumed, even if via a workaround
16. During a prolonged incident, which practice helps maintain stakeholder confidence even when resolution progress is slow? → Providing regular honest updates with actions being taken and expected next steps
17. A healthcare organization identifies that ransomware attacks on similar hospitals have increased 40% year-over-year. This information is BEST classified as: → Threat intelligence used to update risk likelihood scores
18. In SLA management, what is a 'service credit'? → A financial compensation or remedy offered to the customer when an SLA is breached
19. A stakeholder requests a root cause in the initial incident notification. The incident manager should: → State that the cause is under investigation and a follow-up will be provided
20. When an incident is escalated to a third-party vendor for resolution, which ITIL practice governs the formal relationship and obligations involved? → Supplier Management
21. Which metric measures the average time required to restore a failed system or component to full operation? → Mean Time to Repair (MTTR)
22. What is the role of the 'Change Advisory Board' (CAB) in ITIL? → To provide guidance and authorize significant changes
23. Which of the following BEST describes a 'black swan' event in risk management? → A rare, high-impact event that was not predicted by historical models
24. A service desk manager notices that 40% of incidents are being escalated to Tier 2 without any troubleshooting attempt. What is the BEST corrective action? → Review and update service desk knowledge base and provide additional training
25. An Incident Manager is coordinating a response across three geographic time zones. Which planning element is MOST critical to address in the IRP? → Defining on-call schedules and follow-the-sun handoff procedures across time zones
26. A regulatory body contacts your organization during an active cybersecurity incident. The incident manager's FIRST action should be: → Notify legal counsel and the designated compliance contact before responding
27. In a multi-team incident response, who is typically responsible for managing external communications? → The Communications Lead or Public Relations representative
28. What does SLA stand for in the context of incident management? → Service Level Agreement
29. What is 'social media monitoring' most useful for during a public-facing incident? → Detecting real-time public sentiment, spread of misinformation, and emerging concerns
30. What does SLA stand for in the context of incident management? → Service Level Agreement