Major Incident Management Procedures Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Major Incident Management Procedures flashcards as text
A major incident involves a third-party vendor whose fix requires a 4-hour maintenance window. The SLA requires service restoration within 2 hours. What is the BEST course of action?
Answer: Explore alternative workarounds and escalate within the vendor organization while communicating the SLA breach risk to stakeholders
The Major Incident Manager must pursue parallel tracks — pushing the vendor for expedited resolution while pursuing workarounds and keeping stakeholders informed of SLA breach risk.
Which element MUST be included in every major incident declaration?
Answer: Named Incident Commander or Major Incident Manager
A named Incident Commander or Major Incident Manager must be assigned immediately upon major incident declaration to ensure clear ownership and coordination.
What is the purpose of establishing a 'bridge' or 'command call' during a major incident?
Answer: To bring all key responders onto a single real-time communication channel for coordinated response
A bridge call creates a shared communication channel that eliminates information silos and enables rapid coordinated decision-making during response.
An organization experiences the same type of major incident for the third time in six months. What does this MOST likely indicate?
Answer: Problem Management actions from prior PIRs were not effectively implemented
Recurring major incidents indicate that root causes were not eliminated, pointing to a failure in implementing PIR action items through Problem Management.
During a major incident, a junior team member proposes a high-risk fix that could either resolve the issue or cause additional outages. What should the Major Incident Manager do?
Answer: Assess the risk with senior technical staff and the change process before authorizing
High-risk changes during incidents must go through rapid risk assessment with qualified personnel before authorization, even under time pressure.
What is the key difference between an 'incident' and a 'major incident'?
Answer: Major incidents exceed defined impact, urgency, or SLA thresholds requiring elevated response
A major incident is defined by exceeding organizational thresholds for impact, urgency, or SLA risk, triggering a specialized escalated response process.
Which technique is commonly used to structure the timeline reconstruction during a major incident Post-Incident Review?
Answer: 5 Whys and timeline walkthrough
The 5 Whys technique combined with a timeline walkthrough helps identify the chain of events and causal factors that led to and prolonged the incident.