CIM Major Incident Management Procedures 5 — Questions and Answers
Question 1: When should the Major Incident Manager formally close a major incident?
- As soon as the technical fix is deployed
- After service is confirmed restored, stakeholders are notified, and the PIR is scheduled (Correct answer)
- When the vendor closes their support ticket
- After the root cause is fully identified and eliminated
Correct answer: After service is confirmed restored, stakeholders are notified, and the PIR is scheduled
Formal closure requires confirmed service restoration, stakeholder notification of resolution, and scheduling of the PIR — not just a technical fix.
Question 2: A major incident impacts a service covered by an external SLA with financial penalties. Who should be informed FIRST beyond the technical team?
- The regulatory authority
- The account manager or customer success manager for the affected customer (Correct answer)
- The vendor's support team
- The company's legal department
Correct answer: The account manager or customer success manager for the affected customer
The account manager or customer success manager must be informed immediately so they can manage the customer relationship and SLA breach implications.
Question 3: What does 'service restoration' mean in the context of major incident management?
- The underlying root cause has been permanently eliminated
- Normal or agreed service operation has been resumed, even if via a workaround (Correct answer)
- All system components have been returned to their original state
- The incident ticket has been closed in the ITSM tool
Correct answer: Normal or agreed service operation has been resumed, even if via a workaround
Service restoration means users can access the service at agreed levels again, which may be achieved through a workaround before the permanent fix.
Question 4: Which factor MOST commonly contributes to a major incident taking longer to resolve than necessary?
- Too many people assigned to the response team
- Poor communication and unclear ownership during the response (Correct answer)
- Excessive documentation during the incident
- Over-communication with stakeholders
Correct answer: Poor communication and unclear ownership during the response
Studies consistently show that unclear ownership and communication breakdowns are the leading contributors to extended major incident resolution times.
Question 5: An organization has a 'no-blame' culture for post-incident reviews. What is the primary benefit of this approach?
- It eliminates accountability for future incidents
- It encourages honest reporting and sharing of information, leading to better root cause identification (Correct answer)
- It reduces the need for formal PIR documentation
- It ensures that vendors are held responsible instead of internal staff
Correct answer: It encourages honest reporting and sharing of information, leading to better root cause identification
A no-blame culture removes the fear of punishment, encouraging open and honest discussion that surfaces the true chain of events and systemic issues.
Question 6: What is a 'known error' in ITIL-aligned incident and problem management?
- An incident that has been incorrectly classified
- A problem for which the root cause and a workaround or fix have been identified (Correct answer)
- An error in the CMDB configuration data
- A recurring incident without an assigned owner
Correct answer: A problem for which the root cause and a workaround or fix have been identified
A known error is a problem that has been analyzed to the point where the root cause is understood and a workaround or fix is documented in the Known Error Database (KEDB).
Question 7: During a major incident, the Major Incident Manager is informed that a fix requires taking a secondary data center offline. What process should govern this decision?
- The incident can proceed without any formal approval given the urgency
- The Emergency Change process, with rapid ECAB authorization (Correct answer)
- Standard change process with full CAB review
- Problem Management review prior to any action
Correct answer: The Emergency Change process, with rapid ECAB authorization
Even during major incidents, significant infrastructure changes require Emergency Change authorization through the ECAB to assess and control risk.
CIM Major Incident Management Procedures 5
When should the Major Incident Manager formally close a major incident?