CIM Incident Response Planning & Coordination 4 — Questions and Answers
Question 1: An Incident Manager is coordinating a response across three geographic time zones. Which planning element is MOST critical to address in the IRP?
- Defining on-call schedules and follow-the-sun handoff procedures across time zones (Correct answer)
- Using a single centralized team to avoid coordination complexity
- Standardizing all communication in the headquarters local time
- Requiring all resolvers to be available 24/7 regardless of location
Correct answer: Defining on-call schedules and follow-the-sun handoff procedures across time zones
Follow-the-sun handoff procedures and on-call schedules ensure continuous coverage and smooth ownership transitions across geographic boundaries.
Question 2: A new Incident Manager inherits a plan that lists functional roles (e.g., 'Network Lead') rather than named individuals. What is the advantage of this approach?
- It prevents accountability since no individual is named
- It makes the plan resilient to personnel changes, as roles persist even when individuals leave (Correct answer)
- It reduces the need for training because anyone can fill any role
- It simplifies the escalation matrix by removing personal contact details
Correct answer: It makes the plan resilient to personnel changes, as roles persist even when individuals leave
Role-based plans remain valid when staff turn over, while name-based plans become outdated immediately when individuals change positions.
Question 3: During a high-profile incident, a senior executive demands a status update directly from the lead technician, bypassing the Incident Manager. What is the BEST response by the Incident Manager?
- Allow the technician to answer to avoid conflict with the executive
- Intercept the request, provide the status update to the executive, and redirect future inquiries to preserve the technician's focus (Correct answer)
- Escalate the executive's behavior to HR
- Pause the incident response until the chain of command issue is resolved
Correct answer: Intercept the request, provide the status update to the executive, and redirect future inquiries to preserve the technician's focus
The Incident Manager's role includes shielding technical resolvers from distractions; providing the update directly preserves focus and maintains the command structure.
Question 4: What distinguishes a 'workaround' from a 'permanent fix' in the context of incident response coordination?
- A workaround restores service temporarily while root cause investigation continues; a permanent fix eliminates the root cause (Correct answer)
- A workaround is implemented by the problem management team; a permanent fix is implemented by the incident team
- A workaround requires CAB approval; a permanent fix does not
- A workaround closes the incident ticket; a permanent fix closes the problem ticket
Correct answer: A workaround restores service temporarily while root cause investigation continues; a permanent fix eliminates the root cause
Workarounds restore acceptable service levels quickly without solving the underlying cause, allowing problem management to pursue permanent resolution separately.
Question 5: An IRP review reveals that resolver teams consistently bypass the designated Incident Manager role and self-coordinate during incidents. What is the PRIMARY organizational risk?
- The Incident Manager role becomes redundant and can be eliminated
- Uncoordinated self-management leads to conflicting changes, missed communications, and slower resolution (Correct answer)
- SLA timers will not start correctly without the Incident Manager involved
- The service desk will not be able to open tickets properly
Correct answer: Uncoordinated self-management leads to conflicting changes, missed communications, and slower resolution
Without a coordinating authority, teams may implement conflicting fixes, fail to notify key stakeholders, and lose situational awareness, all of which extend incident duration.
Question 6: Which of the following BEST describes the purpose of predefined communication templates in an IRP?
- To replace the need for an Incident Manager during low-severity incidents
- To ensure consistent, timely, and accurate messaging to stakeholders without requiring composition under pressure (Correct answer)
- To comply with data privacy regulations during incident disclosure
- To automate ticket creation in the ITSM tool
Correct answer: To ensure consistent, timely, and accurate messaging to stakeholders without requiring composition under pressure
Pre-written templates reduce cognitive load during high-stress situations and ensure all required information is communicated consistently and promptly.
Question 7: A lessons-learned session reveals that during the last major incident, no one had authority to approve an emergency change needed for restoration. Which IRP section should be updated?
- Severity classification criteria
- Emergency change authority and pre-authorized change provisions (Correct answer)
- Business impact assessment template
- Incident closure checklist
Correct answer: Emergency change authority and pre-authorized change provisions
Pre-authorized emergency change provisions or delegated change authority definitions ensure resolvers can implement necessary fixes without waiting for standard approval cycles.
CIM Incident Response Planning & Coordination 4
An Incident Manager is coordinating a response across three geographic time zones.
Which planning element is MOST critical to address in the IRP?