CIM Incident Response Planning & Coordination 5

Question 1

An Incident Manager is asked to evaluate whether an incident response plan is 'fit for purpose.' Which test BEST validates this?

Accepted Answer

Conducting a full-scale simulation exercise that mirrors likely real-world scenarios

Answer

Simulation exercises expose gaps in procedures, tools, and human response that document reviews alone cannot reveal.

Question 2

During incident coordination, the Incident Manager learns that a resolver group lacks access to a critical system needed for diagnosis. What should the Incident Manager do?

Accepted Answer

Invoke the emergency access provisioning procedure defined in the IRP to grant temporary access

Answer

IRPs should include emergency access provisioning procedures that override standard request workflows to avoid resolution delays during critical incidents.

Question 3

What is the MAIN difference between an Incident Response Plan and a Business Continuity Plan (BCP)?

Accepted Answer

An IRP targets restoring normal IT service operations, while a BCP ensures business functions continue during prolonged disruptions

Answer

IRPs address rapid service restoration within IT operations, while BCPs provide broader organizational continuity strategies for extended disruptions beyond IT's scope.

Question 4

A Certified Incident Manager is onboarding a new responder to the major incident team. Which competency is MOST important to develop first?

Accepted Answer

Understanding of the IRP structure, escalation paths, and their specific role responsibilities

Answer

Role clarity and plan familiarity ensure the new responder can act correctly within the coordinated response structure before developing specialized technical skills.

Question 5

An organization has separate incident response plans for each IT domain (network, application, database). What is the PRIMARY coordination risk of this approach?

Accepted Answer

Cross-domain incidents may fall into gaps where no single plan owns overall coordination

Answer

Domain-siloed plans lack a master coordination layer, so multi-domain incidents — the most complex and common major incidents — have no clear overall owner or unified process.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Incident Response Planning & Coordination 5