CIM Major Incident Management Procedures 4 — Questions and Answers
Question 1: A major incident involves a third-party vendor whose fix requires a 4-hour maintenance window. The SLA requires service restoration within 2 hours. What is the BEST course of action?
- Accept the vendor timeline and update the SLA retroactively
- Explore alternative workarounds and escalate within the vendor organization while communicating the SLA breach risk to stakeholders (Correct answer)
- Close the incident and reopen it after the vendor fix
- Wait for the vendor without notifying stakeholders
Correct answer: Explore alternative workarounds and escalate within the vendor organization while communicating the SLA breach risk to stakeholders
The Major Incident Manager must pursue parallel tracks — pushing the vendor for expedited resolution while pursuing workarounds and keeping stakeholders informed of SLA breach risk.
Question 2: Which element MUST be included in every major incident declaration?
- Assigned root cause
- Named Incident Commander or Major Incident Manager (Correct answer)
- Approved emergency change
- Vendor escalation ticket number
Correct answer: Named Incident Commander or Major Incident Manager
A named Incident Commander or Major Incident Manager must be assigned immediately upon major incident declaration to ensure clear ownership and coordination.
Question 3: What is the purpose of establishing a 'bridge' or 'command call' during a major incident?
- To replace the ticketing system with a verbal record
- To bring all key responders onto a single real-time communication channel for coordinated response (Correct answer)
- To inform customers of the incident status directly
- To conduct the Post-Incident Review in real time
Correct answer: To bring all key responders onto a single real-time communication channel for coordinated response
A bridge call creates a shared communication channel that eliminates information silos and enables rapid coordinated decision-making during response.
Question 4: An organization experiences the same type of major incident for the third time in six months. What does this MOST likely indicate?
- The incident management process is working correctly
- Problem Management actions from prior PIRs were not effectively implemented (Correct answer)
- The SLA thresholds are set too low
- The service desk needs additional training
Correct answer: Problem Management actions from prior PIRs were not effectively implemented
Recurring major incidents indicate that root causes were not eliminated, pointing to a failure in implementing PIR action items through Problem Management.
Question 5: During a major incident, a junior team member proposes a high-risk fix that could either resolve the issue or cause additional outages. What should the Major Incident Manager do?
- Approve it immediately to speed up restoration
- Assess the risk with senior technical staff and the change process before authorizing (Correct answer)
- Reject it outright to avoid additional risk
- Escalate the decision to the CEO
Correct answer: Assess the risk with senior technical staff and the change process before authorizing
High-risk changes during incidents must go through rapid risk assessment with qualified personnel before authorization, even under time pressure.
Question 6: What is the key difference between an 'incident' and a 'major incident'?
- Major incidents always involve hardware failures, while incidents involve software issues
- Major incidents exceed defined impact, urgency, or SLA thresholds requiring elevated response (Correct answer)
- Major incidents are only declared during business hours
- Incidents are handled by vendors, while major incidents are handled internally
Correct answer: Major incidents exceed defined impact, urgency, or SLA thresholds requiring elevated response
A major incident is defined by exceeding organizational thresholds for impact, urgency, or SLA risk, triggering a specialized escalated response process.
Question 7: Which technique is commonly used to structure the timeline reconstruction during a major incident Post-Incident Review?
- SWOT Analysis
- 5 Whys and timeline walkthrough (Correct answer)
- RACI matrix review
- Balanced Scorecard assessment
Correct answer: 5 Whys and timeline walkthrough
The 5 Whys technique combined with a timeline walkthrough helps identify the chain of events and causal factors that led to and prolonged the incident.
CIM Major Incident Management Procedures 4
A major incident involves a third-party vendor whose fix requires a 4-hour maintenance window.
The SLA requires service restoration within 2 hours.
What is the BEST course of action?