DRI Incident Response and Emergency Operations 2

Question 1

In incident response, what is 'triage' and why is it the first analytical step?

Accepted Answer

The initial assessment to determine incident severity, scope, and required response level, enabling appropriate resource allocation

Answer

Triage is the initial assessment of an incident's severity, scope, and impact to determine the appropriate response level and resource allocation—ensuring that limited response resources are deployed proportionately to the actual incident severity.

Question 2

What is the significance of 'chain of custody' in incident response?

Accepted Answer

The documented record tracking who had access to evidence, when, and what was done with it, preserving evidentiary integrity for legal proceedings

Answer

Chain of custody is the documented record of who collected, handled, transferred, and analyzed evidence—maintaining evidentiary integrity ensures that evidence is admissible in legal proceedings and that its integrity has not been compromised.

Question 3

What is meant by 'incident scope' in the context of emergency operations?

Accepted Answer

The geographic, functional, and temporal boundaries of the incident—what is affected, where, and for how long

Answer

Incident scope defines the boundaries of the incident—which locations, systems, business functions, and stakeholders are affected, and the expected or actual duration—essential for proportionate resource deployment and recovery planning.

Question 4

What role does 'situational awareness' play in emergency operations center management?

Accepted Answer

It provides the current, accurate, and shared understanding of incident status needed for effective coordination and decision-making

Answer

Situational awareness—a current, accurate, shared understanding of the incident situation—is the foundation of effective EOC operations, enabling all decision-makers to base their actions on the same reality rather than fragmented, potentially contradictory information.

Question 5

Which document is used to formally declare the end of an incident response and transition to normal operations?

Accepted Answer

A formal incident demobilization plan or stand-down order

Answer

A formal incident demobilization plan or stand-down order formally closes the incident response, transitions activities back to normal operations, releases response resources, and establishes accountability for remaining actions.

(DRI) Disaster Recovery Institute International Certification Practice Test

(DRI) Disaster Recovery Institute International Certification Practice Test

DRI Incident Response and Emergency Operations 2