CIM Incident Response Planning & Coordination 3

Question 1

A P1 incident has been open for 45 minutes with no resolution in sight. According to escalation best practices, what should the Incident Manager do?

Accepted Answer

Proactively escalate to senior technical resources and notify relevant stakeholders per the escalation matrix

Answer

Proactive escalation at defined thresholds ensures senior expertise is engaged and stakeholders are informed before SLA breach, not after.

Question 2

In an Incident Response Plan, what does a 'communication tree' primarily define?

Accepted Answer

The structured chain and frequency of notifications to stakeholders at each escalation level

Answer

A communication tree maps out who notifies whom, at what intervals, and through which channels as incident severity increases.

Question 3

During a tabletop exercise, team members realize they do not know how to access the backup communication channel if the primary system fails. This gap is BEST addressed by:

Accepted Answer

Immediately testing the backup channel during the exercise and updating the IRP with clear access procedures

Answer

Testing the backup channel during the exercise validates it works and embedding procedures in the IRP ensures knowledge is institutionalized rather than individual.

Question 4

Which ITIL practice is most closely aligned with Incident Response Planning & Coordination?

Accepted Answer

Incident Management

Answer

ITIL's Incident Management practice directly encompasses the processes, roles, and tools for coordinating responses to restore service, which IRP formalizes.

Question 5

A company experiences a cyberattack that causes a service outage. The Incident Manager coordinates both the IT incident and the security breach response. What principle governs managing these two tracks?

Accepted Answer

Both tracks run in parallel with a unified Incident Manager maintaining overall coordination and clear delineation of workstreams

Answer

Parallel workstreams under unified coordination allow simultaneous service restoration and security containment without one blocking the other.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Incident Response Planning & Coordination 3