Post-Incident Analysis & Reporting Flashcards
7 cards from real CIM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Post-Incident Analysis & Reporting flashcards as text
An incident report includes an 'impact statement.' What should this section quantify?
Answer: The business, financial, customer, and reputational effects of the incident
The impact statement quantifies business harm—affected users, revenue loss, SLA breaches, regulatory exposure—to prioritize remediation investments.
What is the difference between a 'post-incident review' (PIR) and a 'problem record' in ITIL-aligned incident management?
Answer: A PIR is a meeting/report analyzing a specific incident; a problem record tracks the underlying root cause for longer-term resolution
A PIR reviews the specific incident response, while a problem record is a longer-lived ITIL artifact tracking root cause investigation and fix progress.
Which section of a post-incident report is typically read by executives who want to understand impact and next steps without technical detail?
Answer: Executive summary
The executive summary provides a concise overview of the incident, business impact, and key remediation commitments in non-technical language.
During a post-incident analysis, a responder reveals they deviated from the runbook because 'it didn't match the actual system state.' What is the best follow-up action?
Answer: Update the runbook to reflect reality and investigate why it became out of date
Runbook drift indicates a documentation maintenance failure; the correct action is updating the runbook and establishing a review cadence.
What does 'SMART' stand for when defining corrective actions in a post-incident report?
Answer: Specific, Measurable, Achievable, Relevant, Time-bound
SMART criteria ensure corrective actions are Specific, Measurable, Achievable, Relevant, and Time-bound so they can be tracked and verified.
Which participant is typically responsible for facilitating a post-incident review meeting to ensure it remains blameless and productive?
Answer: A neutral facilitator, often the incident manager or a designated SRE
A neutral facilitator—typically the incident manager or an SRE—guides the PIR discussion to keep it focused, blameless, and outcome-oriented.
When calculating MTTR in a post-incident report, the clock stops when which condition is met?
Answer: Service is fully restored to normal operation for all affected users
MTTR (Mean Time to Repair/Restore) ends when the service is fully restored to normal operation, not when diagnosis or documentation is complete.