CIM Post-Incident Analysis & Reporting 3

Question 1

What is the recommended tone for a post-incident report to promote psychological safety and honest reporting?

Accepted Answer

Blameless, focusing on systemic issues rather than individual fault

Answer

A blameless culture encourages honest disclosure of errors by focusing on process and system failures rather than punishing individuals.

Question 2

Which metric in a post-incident report specifically measures how long the incident remained undetected after it began?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

MTTD measures the elapsed time between when an incident starts and when it is first detected by responders or monitoring systems.

Question 3

When multiple teams are involved in an incident response, what section of the post-incident report documents who did what and when?

Accepted Answer

Chronological action log / incident timeline

Answer

The chronological action log documents each team's actions with timestamps, providing accountability and enabling analysis of coordination effectiveness.

Question 4

Which of the following best describes a 'systemic root cause' found in a post-incident analysis?

Accepted Answer

An underlying organizational, cultural, or process weakness that enabled the failure

Answer

Systemic root causes are organizational or process-level weaknesses that create conditions for multiple potential failure modes.

Question 5

A post-incident report notes the incident 'escaped detection for 4 hours due to alert fatigue.' What type of finding is this?

Accepted Answer

Process and tooling finding related to monitoring effectiveness

Answer

Alert fatigue is a process/tooling problem where excessive or low-signal alerts cause responders to miss or ignore critical notifications.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Post-Incident Analysis & Reporting 3