5-question quiz on the key roles in an incident command structure. Advanced
0 / 5 completed
1 / 5
During a SEV-1 outage, someone on the bridge announces: "Sarah is IC for this incident." What is the Incident Commander's primary role?
Correct: B. The Incident Commander (IC) does not need to be the best technical person in the room — the IC's job is command and coordination. They maintain situational awareness, make calls when responders are blocked or disagree, control the pace, and ensure nothing falls through the cracks. Freeing the IC from technical work is intentional: it keeps their attention on the bigger picture.
The IC says: "Marcus, you're Operations Lead." What does the Operations Lead own during an incident?
Correct: B. The Operations Lead (Ops Lead) is the IC's technical proxy on the bridge. While the IC manages communication, pace, and decisions, the Ops Lead manages the engineers doing the work: assigns tasks, tracks who is investigating what, consolidates findings, and surfaces blockers to the IC. The role prevents the IC from becoming a technical bottleneck.
Overall response, decisions, roles, communication cadence
3 / 5
During a major incident, the IC assigns one person as "Comms Lead." What is the Communications Lead's function?
Correct: B. The Comms Lead (Communications Lead) is the bridge between the incident response room and the outside world. Without a dedicated Comms Lead, the IC gets inundated with update requests from stakeholders, which breaks focus on resolution. The Comms Lead owns the cadence, content, and channels of all outbound messaging.
Comms Lead owns
Does not own
Internal stakeholder updates, status page, exec briefing
An incident bridge has a designated Scribe. A team member asks: "Why do we need a Scribe if all the discussion is already in Slack?" What is the Scribe's function?
Correct: B. Slack threads during an incident are noisy, unstructured, and hard to reconstruct after the fact. The Scribe maintains a separate, timestamped incident log — recording when key decisions were made, what was tried, and what was found. This becomes the factual backbone of the post-mortem and helps people joining mid-incident get up to speed instantly.
Scribe captures
Example entry
Key finding
14:23 — DB connection pool exhaustion confirmed on replica-1
Decision
14:31 — IC decided to restart replica-1 as immediate mitigation
5 / 5
The IC says: "We need an SME for the payments service on the bridge immediately." Who is typically paged as a Subject Matter Expert (SME) during an incident?
Correct: B. An SME is called in when the incident involves a component that requires specialist knowledge the current bridge team doesn't have. The SME provides expertise on their specific domain — answering "what could cause this behaviour in payments?" — but does not take command. The IC continues to direct the response; the SME is a targeted technical resource.
IC role: Commands
SME role: Advises
Directs the overall response; makes decisions
Provides deep domain knowledge; answers technical questions