Incident Response Planning & Coordination Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response Planning & Coordination flashcards as text
An Incident Manager is coordinating a response across three geographic time zones. Which planning element is MOST critical to address in the IRP?
Answer: Defining on-call schedules and follow-the-sun handoff procedures across time zones
Follow-the-sun handoff procedures and on-call schedules ensure continuous coverage and smooth ownership transitions across geographic boundaries.
A new Incident Manager inherits a plan that lists functional roles (e.g., 'Network Lead') rather than named individuals. What is the advantage of this approach?
Answer: It makes the plan resilient to personnel changes, as roles persist even when individuals leave
Role-based plans remain valid when staff turn over, while name-based plans become outdated immediately when individuals change positions.
During a high-profile incident, a senior executive demands a status update directly from the lead technician, bypassing the Incident Manager. What is the BEST response by the Incident Manager?
Answer: Intercept the request, provide the status update to the executive, and redirect future inquiries to preserve the technician's focus
The Incident Manager's role includes shielding technical resolvers from distractions; providing the update directly preserves focus and maintains the command structure.
What distinguishes a 'workaround' from a 'permanent fix' in the context of incident response coordination?
Answer: A workaround restores service temporarily while root cause investigation continues; a permanent fix eliminates the root cause
Workarounds restore acceptable service levels quickly without solving the underlying cause, allowing problem management to pursue permanent resolution separately.
An IRP review reveals that resolver teams consistently bypass the designated Incident Manager role and self-coordinate during incidents. What is the PRIMARY organizational risk?
Answer: Uncoordinated self-management leads to conflicting changes, missed communications, and slower resolution
Without a coordinating authority, teams may implement conflicting fixes, fail to notify key stakeholders, and lose situational awareness, all of which extend incident duration.
Which of the following BEST describes the purpose of predefined communication templates in an IRP?
Answer: To ensure consistent, timely, and accurate messaging to stakeholders without requiring composition under pressure
Pre-written templates reduce cognitive load during high-stress situations and ensure all required information is communicated consistently and promptly.
A lessons-learned session reveals that during the last major incident, no one had authority to approve an emergency change needed for restoration. Which IRP section should be updated?
Answer: Emergency change authority and pre-authorized change provisions
Pre-authorized emergency change provisions or delegated change authority definitions ensure resolvers can implement necessary fixes without waiting for standard approval cycles.