CIM Major Incident Management Procedures 3 — Questions and Answers
Question 1: During a major incident, the technical lead insists the issue is almost resolved and requests that the Major Incident Manager not escalate. What should the Major Incident Manager do?
- Trust the technical lead and delay escalation
- Follow the escalation criteria defined in the major incident procedure regardless of opinion (Correct answer)
- Escalate only if the customer complains
- Defer the decision to the Service Desk
Correct answer: Follow the escalation criteria defined in the major incident procedure regardless of opinion
Escalation decisions must be based on defined criteria and timeframes, not on the subjective assessment of individuals involved in the fix.
Question 2: What is the role of a 'scribe' in a major incident response?
- To lead technical troubleshooting activities
- To maintain a real-time log of actions taken, decisions made, and timeline of events (Correct answer)
- To communicate with external customers and media
- To authorize emergency changes on behalf of the CAB
Correct answer: To maintain a real-time log of actions taken, decisions made, and timeline of events
A scribe documents the incident timeline, actions, and decisions in real time, ensuring an accurate record for the PIR and audit trail.
Question 3: Which of the following BEST describes a workaround in the context of major incident management?
- A permanent fix that resolves the root cause of an incident
- A temporary solution that restores service without resolving the underlying problem (Correct answer)
- A change request submitted to prevent future incidents
- A configuration rollback to a known-good state
Correct answer: A temporary solution that restores service without resolving the underlying problem
A workaround restores service temporarily while the root cause is investigated, and is distinct from a permanent solution.
Question 4: Which ITIL process is MOST closely associated with identifying the root cause of a major incident after service is restored?
- Change Management
- Problem Management (Correct answer)
- Event Management
- Configuration Management
Correct answer: Problem Management
Problem Management is responsible for investigating root causes of incidents and initiating actions to prevent recurrence.
Question 5: A P1 incident is downgraded to P2 during the response. What action is required?
- Close the major incident process immediately
- Notify all stakeholders of the priority change and adjust response resources accordingly (Correct answer)
- Maintain P1 resources and communications to be safe
- Re-open the incident as a new ticket at P2
Correct answer: Notify all stakeholders of the priority change and adjust response resources accordingly
A priority change must be communicated to stakeholders and response resources adjusted to match the revised impact and urgency assessment.
Question 6: What is 'impact assessment' in the context of declaring a major incident?
- Calculating financial penalties owed to customers
- Evaluating the breadth and severity of service disruption to determine incident priority (Correct answer)
- Assessing the workload on the incident response team
- Reviewing past incidents to predict future failures
Correct answer: Evaluating the breadth and severity of service disruption to determine incident priority
Impact assessment evaluates how many users, services, and business functions are affected to determine whether a major incident declaration is warranted.
Question 7: During a major incident bridge call, multiple team leads begin debating the root cause rather than working on restoration. What should the Major Incident Manager do?
- Let the debate continue as it may surface useful information
- Redirect the team to focus on restoration actions and defer root cause analysis to the PIR (Correct answer)
- End the bridge call and ask teams to work independently
- Assign the debate to a separate working group immediately
Correct answer: Redirect the team to focus on restoration actions and defer root cause analysis to the PIR
During active incidents, the Major Incident Manager must keep the team focused on service restoration; root cause analysis belongs in the PIR.
CIM Major Incident Management Procedures 3
During a major incident, the technical lead insists the issue is almost resolved and requests that the Major Incident Manager not escalate.
What should the Major Incident Manager do?