Incident Response and Emergency Operations Flashcards
6 cards from real DRI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Incident Response and Emergency Operations flashcards as text
What is the PRIMARY purpose of an Incident Response Plan (IRP)?
Answer: To provide a structured framework for detecting, responding to, and recovering from incidents in a controlled and coordinated manner
An Incident Response Plan provides the structured framework for detecting, containing, investigating, and recovering from incidents—its primary purpose is enabling effective, coordinated response that minimizes impact and restores normal operations.
In the Incident Command System (ICS), what is the role of the 'Incident Commander (IC)'?
Answer: To have overall authority and responsibility for managing the incident response
The Incident Commander holds overall authority and responsibility for managing the incident response, including strategic objectives, resource allocation, and approval of the Incident Action Plan—all response functions ultimately report to the IC.
What is an 'Emergency Operations Center (EOC)' and how is it activated?
Answer: A designated command and coordination hub activated when an incident exceeds routine management capabilities and requires coordinated multi-functional response
An EOC is activated when an incident exceeds the capacity of normal operations to manage—when multiple functions must coordinate, when significant resources must be allocated, or when strategic decisions must be made—providing centralized command and coordination.
During an incident, what is the purpose of maintaining an 'incident log'?
Answer: To document all significant actions, decisions, communications, and resource deployments throughout the incident for accountability and after-action analysis
The incident log provides a timestamped record of all significant actions, decisions, communications, and resource deployments—it is essential for situational awareness during the incident and for post-incident analysis, legal defensibility, and insurance claims.
What is the 'span of control' principle in the Incident Command System?
Answer: The principle that one supervisor should manage no more than 3-7 subordinates for effective coordination
Span of control refers to the number of subordinates a single supervisor can effectively manage—ICS recommends 3-7 people per supervisor (optimally 5), ensuring each supervisor has an appropriate, manageable number of people to coordinate without losing control.
Which phase of incident response focuses on returning business operations to normal while preserving evidence for investigation?
Answer: Recovery phase
The Recovery phase focuses on restoring systems and operations to normal while maintaining the careful balance between operational restoration and evidence preservation for ongoing investigation—security forensics may require maintaining certain system states even during restoration.