Incident Response Planning & Coordination Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response Planning & Coordination flashcards as text
An Incident Manager is asked to evaluate whether an incident response plan is 'fit for purpose.' Which test BEST validates this?
Answer: Conducting a full-scale simulation exercise that mirrors likely real-world scenarios
Simulation exercises expose gaps in procedures, tools, and human response that document reviews alone cannot reveal.
During incident coordination, the Incident Manager learns that a resolver group lacks access to a critical system needed for diagnosis. What should the Incident Manager do?
Answer: Invoke the emergency access provisioning procedure defined in the IRP to grant temporary access
IRPs should include emergency access provisioning procedures that override standard request workflows to avoid resolution delays during critical incidents.
What is the MAIN difference between an Incident Response Plan and a Business Continuity Plan (BCP)?
Answer: An IRP targets restoring normal IT service operations, while a BCP ensures business functions continue during prolonged disruptions
IRPs address rapid service restoration within IT operations, while BCPs provide broader organizational continuity strategies for extended disruptions beyond IT's scope.
A Certified Incident Manager is onboarding a new responder to the major incident team. Which competency is MOST important to develop first?
Answer: Understanding of the IRP structure, escalation paths, and their specific role responsibilities
Role clarity and plan familiarity ensure the new responder can act correctly within the coordinated response structure before developing specialized technical skills.
An organization has separate incident response plans for each IT domain (network, application, database). What is the PRIMARY coordination risk of this approach?
Answer: Cross-domain incidents may fall into gaps where no single plan owns overall coordination
Domain-siloed plans lack a master coordination layer, so multi-domain incidents — the most complex and common major incidents — have no clear overall owner or unified process.
Which activity should occur IMMEDIATELY after service restoration in a major incident, before the incident is officially closed?
Answer: Confirmation from business stakeholders that service is restored to acceptable levels
Business stakeholder confirmation validates that restoration meets user requirements, not just that technical indicators are green, before the incident can be officially closed.
A post-incident review finds that the Incident Manager failed to update stakeholders for 90 minutes during a P1 incident. Which IRP component would have MOST directly prevented this?
Answer: Defined communication cadence requirements specifying maximum intervals between stakeholder updates
Mandatory update cadences (e.g., every 20-30 minutes for P1) create accountability and prevent communication gaps regardless of incident complexity.