CIM Major Incident Management Procedures 2

Question 1

During a major incident, who is responsible for authorizing emergency changes to production systems?

Accepted Answer

The Emergency Change Advisory Board (ECAB)

Answer

The ECAB is convened to rapidly assess and authorize emergency changes during major incidents without requiring a full CAB meeting.

Question 2

What is the primary purpose of a Post-Incident Review (PIR) following a major incident?

Accepted Answer

To identify root causes and prevent recurrence

Answer

The PIR focuses on identifying root causes, contributing factors, and improvement actions to prevent the incident from recurring.

Question 3

Which communication approach is most appropriate when notifying senior stakeholders during an active major incident?

Accepted Answer

Deliver concise status updates focused on business impact and ETR

Answer

Senior stakeholders need concise, business-impact-focused updates with estimated time to restore (ETR) rather than technical details.

Question 4

A major incident is declared at 2:00 AM. The on-call engineer cannot resolve the issue within 30 minutes. What should happen next?

Accepted Answer

Escalate to the next support tier and invoke the major incident process

Answer

Time-based escalation triggers ensure the major incident process is activated and additional resources are engaged regardless of time of day.

Question 5

In the context of major incident management, what does 'war room' refer to?

Accepted Answer

A centralized physical or virtual space where the response team coordinates

Answer

A war room brings key responders together in a single location (physical or virtual) to improve coordination and speed of resolution.

(CIM) Certified Incident Manager Practice Test