Major Incident Management Procedures Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Major Incident Management Procedures flashcards as text
During a major incident, who is responsible for authorizing emergency changes to production systems?
Answer: The Emergency Change Advisory Board (ECAB)
The ECAB is convened to rapidly assess and authorize emergency changes during major incidents without requiring a full CAB meeting.
What is the primary purpose of a Post-Incident Review (PIR) following a major incident?
Answer: To identify root causes and prevent recurrence
The PIR focuses on identifying root causes, contributing factors, and improvement actions to prevent the incident from recurring.
Which communication approach is most appropriate when notifying senior stakeholders during an active major incident?
Answer: Deliver concise status updates focused on business impact and ETR
Senior stakeholders need concise, business-impact-focused updates with estimated time to restore (ETR) rather than technical details.
A major incident is declared at 2:00 AM. The on-call engineer cannot resolve the issue within 30 minutes. What should happen next?
Answer: Escalate to the next support tier and invoke the major incident process
Time-based escalation triggers ensure the major incident process is activated and additional resources are engaged regardless of time of day.
In the context of major incident management, what does 'war room' refer to?
Answer: A centralized physical or virtual space where the response team coordinates
A war room brings key responders together in a single location (physical or virtual) to improve coordination and speed of resolution.
Which metric is most useful for measuring the effectiveness of a major incident response team?
Answer: Mean Time to Restore (MTTR)
MTTR measures the average time taken to restore normal service, directly reflecting the team's response effectiveness.
A major incident affects a business-critical application shared by multiple customer accounts. What is the BEST initial stakeholder notification strategy?
Answer: Send a single broadcast notification to all affected customers simultaneously
All affected customers should be notified simultaneously with an initial impact statement to maintain transparency and prevent fragmented communication.