Incident Response Planning & Coordination Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response Planning & Coordination flashcards as text
A P1 incident has been open for 45 minutes with no resolution in sight. According to escalation best practices, what should the Incident Manager do?
Answer: Proactively escalate to senior technical resources and notify relevant stakeholders per the escalation matrix
Proactive escalation at defined thresholds ensures senior expertise is engaged and stakeholders are informed before SLA breach, not after.
In an Incident Response Plan, what does a 'communication tree' primarily define?
Answer: The structured chain and frequency of notifications to stakeholders at each escalation level
A communication tree maps out who notifies whom, at what intervals, and through which channels as incident severity increases.
During a tabletop exercise, team members realize they do not know how to access the backup communication channel if the primary system fails. This gap is BEST addressed by:
Answer: Immediately testing the backup channel during the exercise and updating the IRP with clear access procedures
Testing the backup channel during the exercise validates it works and embedding procedures in the IRP ensures knowledge is institutionalized rather than individual.
Which ITIL practice is most closely aligned with Incident Response Planning & Coordination?
Answer: Incident Management
ITIL's Incident Management practice directly encompasses the processes, roles, and tools for coordinating responses to restore service, which IRP formalizes.
A company experiences a cyberattack that causes a service outage. The Incident Manager coordinates both the IT incident and the security breach response. What principle governs managing these two tracks?
Answer: Both tracks run in parallel with a unified Incident Manager maintaining overall coordination and clear delineation of workstreams
Parallel workstreams under unified coordination allow simultaneous service restoration and security containment without one blocking the other.
What is the role of a 'scribe' or 'incident recorder' during a major incident bridge call?
Answer: To maintain a real-time log of actions taken, decisions made, and timestamps during the incident
The scribe creates an authoritative contemporaneous record that supports post-incident review, audit trails, and timeline reconstruction.
When reviewing an IRP for completeness, which of the following is MOST often found to be missing in immature plans?
Answer: Clear criteria for downgrading or closing a major incident
Many plans detail how to escalate and respond but omit explicit criteria for when an incident can be downgraded or officially closed, leading to prolonged major incident status.