5-question quiz on declaring SEV-1, severity matrices, executive escalation, and blast radius vocabulary. Advanced
0 / 15 completed
1 / 15
An IC announces on the bridge: "I am declaring this a SEV-1." What is the significance of this formal declaration?
Correct: B. Declaring a SEV-1 is not just a label — it is an activation trigger. Most incident response frameworks define specific actions that fire automatically when SEV-1 is declared: executive bridges are opened, on-call escalation chains are paged, update cadences are tightened to 10–15 minutes, and resources are cleared. The formal declaration ensures the response scales proportionately to the severity.
SEV-1 typically activates
SEV-2 typically activates
Executive bridge; tightest update cadence; full escalation chain
A team lead asks: "How do we decide if this is a SEV-2 or SEV-3?" The IC refers to the severity matrix. What is a severity matrix?
Correct: B. Without a severity matrix, severity classification becomes subjective and inconsistent — the same incident is called SEV-1 by one IC and SEV-3 by another. The matrix defines explicit thresholds: e.g., "SEV-1 = complete checkout unavailability affecting all customers." Pre-defined criteria remove debate during the incident itself, when time is critical.
Typical severity criterion
Example threshold for SEV-1
Customer impact
Core product unavailable for all or majority of customers
The IC says: "This SEV-1 has crossed the threshold for executive notification. Comms Lead, please brief the CTO." What typically triggers executive notification in an incident response framework?
Correct: B. Executive notification criteria are defined in advance for the same reason as the severity matrix: to prevent subjective, pressure-driven decisions during the incident. Waiting for root cause before notifying executives is a common mistake — by that time the outage may have lasted an hour and leadership found out from a customer. Earlier, factual notification with clear impact framing is better than late notification with full explanation.
Trigger example
Why it warrants executive notification
Revenue stream fully blocked for >15 min
Financial impact; leadership may need to brief board or investors
Potential data breach detected
Regulatory / legal obligations; CISO and legal counsel must be looped in
4 / 15
A responder says: "We've been investigating for 45 minutes with no mitigation path. Should we page the escalation chain?" What does paging the escalation chain involve?
Correct: B. An escalation chain is the pre-defined sequence of people to page when the current response team is stuck. It is tiered: primary on-call → secondary on-call → domain expert → engineering manager → VP of Engineering. Paging the chain is a recognition that more expertise or decision-making authority is needed — not a failure, but a correct use of the incident process.
Escalation chain tier
When paged
Primary on-call
Alert fires; initial response
Secondary on-call / SME
Primary stuck or needs domain expertise
Engineering manager / VP
Extended outage; executive visibility required
5 / 15
An IC says: "The blast radius is widening — we're now seeing impact on the recommendations service, not just checkout." What does "widening blast radius" communicate?
Correct: B. "Blast radius" is borrowed from the security and systems reliability lexicons. In incident command, a widening blast radius is a critical signal: the incident is no longer contained to the originally identified system. Each new service affected potentially means more customers impacted, more teams needed, and a higher severity classification. The IC must re-evaluate whether the current response scale and resource allocation is still appropriate.
Review Comment: 'This PR introduces a potential race condition. I've marked it as 'Critical' and requested immediate attention. The logs show intermittent failures during peak load.' Which of the following best describes the impact of this comment in the context of escalation & severity?
The reviewer's use of 'Critical' and request for immediate attention demonstrates they perceive a significant risk. 'Race condition' inherently implies the potential for data corruption or system instability—a core element of SEV-1/SEV-2 incidents. The comment isn't merely about optimization; it highlights a potentially catastrophic failure state, necessitating urgent action.
7 / 15
Slack Message: '@john.doe - Urgent! Production service api.example.com/v1/users is returning 503 errors intermittently. Monitoring shows a spike in request latency and increased CPU usage on the application servers. We're investigating.' What does the phrase 'monitoring shows a spike' suggest regarding potential severity?
'Monitoring shows a spike' immediately flags an anomaly. A sudden increase in request latency or CPU usage during a service outage strongly suggests resource exhaustion or a cascading failure—indicators of potentially SEV-1 or SEV-2 incidents. Simply observing the error itself doesn't convey the urgency; it's the accompanying metrics that highlight the severity.
8 / 15
PR Description: 'Implemented a new feature to improve user onboarding. This change should resolve some reported UI issues and enhance the overall user experience.' How might this PR description *influence* escalation decisions?
While the description focuses on functionality improvements, it's crucial to recognize that new code introduces potential for bugs. 'UI issues' could translate into data corruption or service disruptions—the foundation of an SEV-1. The PR's impact *must* be assessed in relation to its potential to cause harm, regardless of the intended benefits.
9 / 15
Standup Update: 'We're still seeing high latency for database queries impacting user logins. We've attempted basic scaling but haven't seen a significant improvement. The root cause is proving elusive.' What does the phrase 'root cause proving elusive' most strongly indicate in terms of escalation?
'Root cause proving elusive' signals that the investigation has stalled. This indicates a potentially significant technical challenge—likely requiring specialized expertise or advanced diagnostics. Prolonged uncertainty in complex incidents often escalates to SEV-1 or higher levels due to the potential for wider impact and prolonged downtime.
10 / 15
API Response: The service returned an error code of 500 (Internal Server Error) with a message: 'Database connection timeout.' The monitoring system shows a sudden surge in database load coinciding with the error. What does this API response *suggest* regarding potential severity?
A 500 Internal Server Error coupled with a database connection timeout immediately suggests a serious problem. Database failures are often the root cause of major service disruptions—a hallmark of SEV-1 incidents. The surge in database load confirms this urgency, indicating potential cascading effects if left unaddressed.
11 / 15
Review Comment: 'This PR introduces a potential race condition. I've marked it as 'Critical' and requested immediate attention. The logs show intermittent failures during peak load.' Which of the following best describes the impact of this comment in the context of escalation & severity?
The reviewer's use of 'Critical' and request for immediate attention demonstrates they perceive a significant risk. 'Race condition' inherently implies the potential for data corruption or system instability—a core element of SEV-1/SEV-2 incidents. The comment isn't merely about optimization; it highlights a potentially catastrophic failure state, necessitating urgent action.
12 / 15
Slack Message: '@john.doe - Urgent! Production service api.example.com/v1/users is returning 503 errors intermittently. Monitoring shows a spike in request latency and increased CPU usage on the application servers. We're investigating.' What does the phrase 'monitoring shows a spike' suggest regarding potential severity?
'Monitoring shows a spike' immediately flags an anomaly. A sudden increase in request latency or CPU usage during a service outage strongly suggests resource exhaustion or a cascading failure—indicators of potentially SEV-1 or SEV-2 incidents. Simply observing the error itself doesn't convey the urgency; it's the accompanying metrics that highlight the severity.
13 / 15
PR Description: 'Implemented a new feature to improve user onboarding. This change should resolve some reported UI issues and enhance the overall user experience.' How might this PR description *influence* escalation decisions?
While the description focuses on functionality improvements, it's crucial to recognize that new code introduces potential for bugs. 'UI issues' could translate into data corruption or service disruptions—the foundation of an SEV-1. The PR's impact *must* be assessed in relation to its potential to cause harm, regardless of the intended benefits.
14 / 15
Standup Update: 'We're still seeing high latency for database queries impacting user logins. We've attempted basic scaling but haven't seen a significant improvement. The root cause is proving elusive.' What does the phrase 'root cause proving elusive' most strongly indicate in terms of escalation?
'Root cause proving elusive' signals that the investigation has stalled. This indicates a potentially significant technical challenge—likely requiring specialized expertise or advanced diagnostics. Prolonged uncertainty in complex incidents often escalates to SEV-1 or higher levels due to the potential for wider impact and prolonged downtime.
15 / 15
API Response: The service returned an error code of 500 (Internal Server Error) with a message: 'Database connection timeout.' The monitoring system shows a sudden surge in database load coinciding with the error. What does this API response *suggest* regarding potential severity?
A 500 Internal Server Error coupled with a database connection timeout immediately suggests a serious problem. Database failures are often the root cause of major service disruptions—a hallmark of SEV-1 incidents. The surge in database load confirms this urgency, indicating potential cascading effects if left unaddressed.
What will I practise in "Escalation & Severity Language — Incident Response Exercises"?
Practice English vocabulary for incident escalation: declaring SEV-1, severity matrices, executive notification, paging the escalation chain, and blast radius language in professional incident response.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Incident Command Language exercises?
Browse the full Incident Command Language hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.