CIM Post-Incident Analysis & Reporting 5

Question 1

A post-incident report is classified as 'Confidential — Internal Only.' What does this classification most protect?

Accepted Answer

Sensitive operational details, security vulnerabilities, and staff privacy from external disclosure

Answer

Confidential classification protects sensitive operational and security information from competitors, attackers, and unauthorized parties.

Question 2

In the context of post-incident reporting, what is 'detection bias' and why is it a concern?

Accepted Answer

Preferring certain root cause categories over others during analysis

Answer

Detection bias occurs when analysts unconsciously favor familiar root cause categories (e.g., human error) over others, skewing findings and corrective actions.

Question 3

When a post-incident report identifies a 'single point of failure' (SPOF), what type of corrective action is most appropriate?

Accepted Answer

Introducing redundancy, failover, or load balancing to eliminate the SPOF

Answer

SPOFs require architectural remediation—redundancy, failover, or load balancing—to prevent a single component failure from causing a full outage.

Question 4

What is the purpose of tracking 'action item aging' in post-incident management?

Accepted Answer

To identify corrective actions that are overdue and escalate them before risks recur

Answer

Tracking action item aging ensures overdue corrective actions are escalated and not lost, preventing the same vulnerabilities from persisting indefinitely.

Question 5

A post-incident analysis reveals the incident was caused by a change deployed without proper testing. Which process improvement would most directly prevent recurrence?

Accepted Answer

Strengthening the change management process with mandatory pre-deployment testing gates

Answer

Mandatory pre-deployment testing gates in the change management process directly address the failure to validate changes before they reach production.

(CIM) Certified Incident Manager Practice Test

(CIM) Certified Incident Manager Practice Test

CIM Post-Incident Analysis & Reporting 5