CIM Incident Response Planning & Coordination 3 — Questions and Answers
Question 1: A P1 incident has been open for 45 minutes with no resolution in sight. According to escalation best practices, what should the Incident Manager do?
- Wait for the technical team to exhaust all options before escalating
- Proactively escalate to senior technical resources and notify relevant stakeholders per the escalation matrix (Correct answer)
- Close and reopen the ticket to reset SLA timers
- Transfer ownership to the service desk
Correct answer: Proactively escalate to senior technical resources and notify relevant stakeholders per the escalation matrix
Proactive escalation at defined thresholds ensures senior expertise is engaged and stakeholders are informed before SLA breach, not after.
Question 2: In an Incident Response Plan, what does a 'communication tree' primarily define?
- Technical architecture of communication systems used during incidents
- The structured chain and frequency of notifications to stakeholders at each escalation level (Correct answer)
- Social media response guidelines for public incidents
- The hierarchy for approving incident-related change requests
Correct answer: The structured chain and frequency of notifications to stakeholders at each escalation level
A communication tree maps out who notifies whom, at what intervals, and through which channels as incident severity increases.
Question 3: During a tabletop exercise, team members realize they do not know how to access the backup communication channel if the primary system fails. This gap is BEST addressed by:
- Documenting the gap in the post-exercise report and scheduling a future training session
- Immediately testing the backup channel during the exercise and updating the IRP with clear access procedures (Correct answer)
- Purchasing a new communication system before the next exercise
- Assigning a single person as the backup channel owner
Correct answer: Immediately testing the backup channel during the exercise and updating the IRP with clear access procedures
Testing the backup channel during the exercise validates it works and embedding procedures in the IRP ensures knowledge is institutionalized rather than individual.
Question 4: Which ITIL practice is most closely aligned with Incident Response Planning & Coordination?
- Change Enablement
- Service Level Management
- Incident Management (Correct answer)
- Problem Management
Correct answer: Incident Management
ITIL's Incident Management practice directly encompasses the processes, roles, and tools for coordinating responses to restore service, which IRP formalizes.
Question 5: A company experiences a cyberattack that causes a service outage. The Incident Manager coordinates both the IT incident and the security breach response. What principle governs managing these two tracks?
- Security incidents always supersede IT incidents and the IT track should be closed
- Both tracks run in parallel with a unified Incident Manager maintaining overall coordination and clear delineation of workstreams (Correct answer)
- The security team assumes full incident management authority and the IT Incident Manager stands down
- IT restoration takes priority; security investigation begins after service is restored
Correct answer: Both tracks run in parallel with a unified Incident Manager maintaining overall coordination and clear delineation of workstreams
Parallel workstreams under unified coordination allow simultaneous service restoration and security containment without one blocking the other.
Question 6: What is the role of a 'scribe' or 'incident recorder' during a major incident bridge call?
- To make technical decisions when the Incident Manager is busy
- To maintain a real-time log of actions taken, decisions made, and timestamps during the incident (Correct answer)
- To communicate with customers on behalf of the organization
- To manage escalation approvals
Correct answer: To maintain a real-time log of actions taken, decisions made, and timestamps during the incident
The scribe creates an authoritative contemporaneous record that supports post-incident review, audit trails, and timeline reconstruction.
Question 7: When reviewing an IRP for completeness, which of the following is MOST often found to be missing in immature plans?
- List of IT assets
- Clear criteria for downgrading or closing a major incident (Correct answer)
- Network topology diagrams
- Vendor contact information
Correct answer: Clear criteria for downgrading or closing a major incident
Many plans detail how to escalate and respond but omit explicit criteria for when an incident can be downgraded or officially closed, leading to prolonged major incident status.
CIM Incident Response Planning & Coordination 3
A P1 incident has been open for 45 minutes with no resolution in sight.
According to escalation best practices, what should the Incident Manager do?