Bonus Incident Management Quiz

Which of the following is a sign of a well-prepared incident response team?

• Blames are assigned quickly

• Roles are clearly defined and practiced

• Fixes are always manual

• All alerts are ignored unless escalated.

Answer explanation

A well-prepared incident response team has clearly defined and practiced roles, ensuring efficient coordination during incidents. This clarity helps in quick decision-making and effective response, unlike the other options which indicate poor practices.

Which activity is part of the Pre-Incident phase?

• Running a root cause analysis

• Sending a status update to users

• Setting up synthetic health checks

• Declaring incident resolution

Answer explanation

Setting up synthetic health checks is a proactive measure taken during the Pre-Incident phase to monitor system performance and detect issues before they escalate, unlike the other options which occur during or after an incident.

What’s the benefit of using synthetic monitoring (e.g., Apica)?

• It fixes bugs automatically

• It compresses logs for storage

• It simulates user journeys to detect issues early

• It runs backups of your database.

Answer explanation

Synthetic monitoring, like Apica, simulates user journeys to proactively identify and address issues before they impact real users, ensuring a smoother user experience.

What is the best reason to conduct a Post-Incident Review (PIR)?

• To identify who caused the issue

• To document learnings and prevent recurrence

• To report on team lunch delay

• To estimate future outages

Answer explanation

The best reason to conduct a Post-Incident Review (PIR) is to document learnings and prevent recurrence. This helps organizations improve processes and avoid similar issues in the future, rather than focusing on blame or unrelated matters.

You receive multiple alerts in different systems for the same issue. What’s the best first step?

• Start fixing the problem immediately.

• Correlate alerts and confirm the root cause.

• Mute all alerts.

• Ignore and wait for users to complain.

Answer explanation

The best first step is to correlate alerts and confirm the root cause. This ensures you understand the issue fully before taking action, preventing unnecessary fixes and potential complications.

Which one of these can help reduce both MTTD and MTTR?

• Regular security audits

• Team-building exercises

• Automated monitoring and alerting

• Quarterly reporting

Answer explanation

Automated monitoring and alerting can significantly reduce Mean Time to Detect (MTTD) and Mean Time to Recovery (MTTR) by providing real-time insights and alerts on system issues, enabling quicker responses and resolutions.

Which of the following is NOT typically part of the Incident phase?

• Root cause investigation

• Updating the knowledge base

• Communication with stakeholders

• Mitigation actions

Answer explanation

Updating the knowledge base is typically part of the post-incident phase, not the Incident phase. The Incident phase focuses on immediate actions like mitigation, communication, and investigation.

Why is clear communication during an incident just as important as technical resolution?

• It helps the marketing team promote the fix faster

• It keeps stakeholders informed, reduces confusion, and builds trust

• It increases the MTTR so more people can get involved

• It's only needed after the incident is resolved

Answer explanation

Clear communication during an incident is crucial as it keeps stakeholders informed, reduces confusion, and builds trust. This ensures everyone is aligned and aware of the situation, which is just as important as resolving the technical issues.

Which of the following is a critical activity that should happen after a post-incident review?

• Deleting old incident logs to free up space

• Disabling alerting to avoid future noise

• Re-opening the incident ticket to review it again

• Assigning owners to follow-up actions and tracking their completion

Answer explanation

After a post-incident review, it's crucial to assign owners to follow-up actions and track their completion. This ensures accountability and helps prevent similar incidents in the future.