CIM Incident Response Planning & Coordination 2 — Questions and Answers
Question 1: During a major incident, the Incident Manager notices that two resolver groups are working on the same component without awareness of each other. What coordination action should be taken first?
- Escalate to senior management immediately
- Establish a bridge call to synchronize both groups under unified command (Correct answer)
- Assign one group to a different incident
- Close duplicate tickets and create a single ticket
Correct answer: Establish a bridge call to synchronize both groups under unified command
A bridge call unifies resolver groups under a single communication channel, preventing duplicated effort and potential conflicting changes.
Question 2: Which element of an Incident Response Plan defines who has authority to declare a Major Incident?
- Escalation matrix
- RACI chart
- Declaration criteria and authority section (Correct answer)
- Service catalog
Correct answer: Declaration criteria and authority section
The declaration criteria and authority section specifies thresholds and which roles are empowered to officially declare a major incident.
Question 3: A CIM candidate is reviewing a post-incident report and finds the 'timeline of events' section is missing. Why is this section critical?
- It satisfies regulatory audit requirements only
- It enables root cause analysis and reveals coordination gaps during the incident (Correct answer)
- It is required for SLA credit calculations
- It documents the names of resolvers for performance reviews
Correct answer: It enables root cause analysis and reveals coordination gaps during the incident
A chronological timeline exposes decision points, delays, and coordination failures that inform prevention and process improvements.
Question 4: When an incident affects multiple business units simultaneously, which coordination model is most effective for the Incident Manager?
- Siloed response with separate incident managers per unit
- Centralized command with designated liaisons from each business unit (Correct answer)
- Allow each unit to self-resolve independently
- Defer coordination to the Change Advisory Board
Correct answer: Centralized command with designated liaisons from each business unit
Centralized command with business unit liaisons ensures consistent messaging, avoids conflicting remediation actions, and provides a single point of authority.
Question 5: What is the primary purpose of a 'war room' or virtual command center during a major incident?
- To isolate the incident from normal service desk operations
- To provide a dedicated, real-time collaboration space for all key responders (Correct answer)
- To store incident documentation for post-incident review
- To host management briefings after the incident is resolved
Correct answer: To provide a dedicated, real-time collaboration space for all key responders
A war room concentrates decision-makers and resolvers in one environment to accelerate communication, reduce handoff delays, and enable rapid coordinated response.
Question 6: An organization's incident response plan has not been tested in 18 months. What is the MOST significant risk of an untested plan?
- The plan may reference outdated contact information, roles, or procedures that no longer reflect reality (Correct answer)
- Staff will not be aware of SLA targets
- The plan will not comply with ITIL v4 guidelines
- Management will not approve future incident budgets
Correct answer: The plan may reference outdated contact information, roles, or procedures that no longer reflect reality
Untested plans frequently contain stale contact lists, changed responsibilities, and obsolete procedures that cause failures when real incidents occur.
Question 7: Which metric BEST measures the effectiveness of incident coordination during a major incident?
- Number of tickets opened during the incident
- Mean Time to Restore (MTTR) compared against SLA targets (Correct answer)
- Number of resolver groups engaged
- Total customer complaint volume
Correct answer: Mean Time to Restore (MTTR) compared against SLA targets
MTTR directly reflects how efficiently coordination activities accelerated restoration, making it the most meaningful coordination effectiveness metric.
CIM Incident Response Planning & Coordination 2
During a major incident, the Incident Manager notices that two resolver groups are working on the same component without awareness of each other.
What coordination action should be taken first?