5-question quiz on the precise vocabulary used to close an incident and transition to post-mortem. Advanced
0 / 10 completed
1 / 10
An IC announces on the bridge: "The incident is mitigated. We have not yet resolved it." What is the precise distinction between mitigated and resolved?
Correct: B. The mitigated/resolved distinction is operationally important. Mitigation might mean restarting a service, enabling a feature flag bypass, or redirecting traffic — the customer experience improves but the underlying bug persists. Resolution requires identifying and fixing the root cause. Many incidents remain in a "mitigated" state for days while the permanent fix is engineered, tested, and deployed.
State
Meaning
Example
Mitigated
Customer impact stopped; root cause not yet fixed
Traffic rerouted; broken service still exists
Resolved
Root cause fixed; system stable
Bug patched and deployed; normal operations confirmed
2 / 10
The IC sends a final bridge message: "The incident is resolved and we are standing down." What does standing down mean in incident command?
Correct: B. "Standing down" is a deliberate, formal close of the active incident response. Without it, responders remain uncertain whether they are still needed, bridges stay open unnecessarily, and the cognitive burden of the incident lingers. The phrase signals: the emergency is over, the team can return to normal operations. It mirrors military and emergency services language where "stand down" ends an alert or emergency posture.
Action at stand-down
What it closes
Bridge disbanded
Responders released; war room ends
Incident ticket updated
Status set to "Resolved"; post-mortem scheduled
3 / 10
A status update reads: "Issue is resolved. We are monitoring for recurrence over the next 24 hours." Why is an explicit post-resolution monitoring period important?
Correct: B. "Monitoring for recurrence" reflects operational realism. A database connection pool exhaustion may deplete again under load. A cache warm-up may expose the same bug within minutes of the apparent fix. Committing to a monitoring window — and communicating it — tells stakeholders the team is being thorough rather than optimistic, and ensures the response team stays alert for recurrence rather than fully context-switching immediately.
Incident type
Recurrence risk
Connection pool exhaustion
High — can re-exhaust under traffic after restart
Cascading failure from downstream dependency
High — dependency may degrade again before fix deployed
One-off memory leak fixed by restart
Medium — leak will return; patch still needed
4 / 10
A post-mortem assigns: "Add PagerDuty alert for connection pool exhaustion — Owner: Kenji — Due: 2 weeks." What makes post-mortem action items effective?
Correct: B. Vague post-mortem actions ("improve monitoring," "add more tests") reliably sit unactioned. Effective actions are SMART: specific about what to build or change, assigned to one named person (not a team), given a concrete due date, and tracked in whatever system the team uses for work. The post-mortem is only as valuable as the follow-through on its action items.
Ineffective action item
Effective action item
"Team to improve observability"
"Add connection pool utilisation alert at 80 % — Kenji — 2 weeks"
"Better testing needed"
"Add load test for pool exhaustion scenario to CI suite — Aiko — 3 weeks"
5 / 10
The IC sends a final message to all channels: "All-clear: the incident is fully resolved. Thank you all for your response." What is the purpose of a formal all-clear declaration?
Correct: B. The all-clear is the formal, final signal that the incident is completely over. Without it, stakeholders remain uncertain ("is it really fixed?"), responders stay in a state of partial alert, and the psychological burden of the incident lingers. The phrase also serves a human purpose: acknowledging the team's effort. In some frameworks the all-clear also officially starts the post-mortem clock — the window for scheduling the review.
Incident closure step
What it communicates
"Mitigated"
Customer impact stopped; root cause work ongoing
"Resolved"
Root cause fixed; service stable
"All-clear"
Response formally ended; team stands down; post-mortem next
6 / 10
A developer, Sarah, sends a Slack message to the incident response team: "We've identified the root cause – a misconfigured DNS record. We're rolling back the changes now.". What is Sarah primarily communicating about?
Sarah is detailing the actions being undertaken to fix the problem. Options A and C represent unrelated concerns, while option D is inappropriate given the context. Option B accurately describes her communication about the resolution process.
7 / 10
During a standup update, John says: "We're currently investigating an outage affecting users in Europe. We've identified increased latency and are working on identifying the source.". What is John primarily reporting?
John is describing the observable effects of the incident – increased latency. Options A and C are premature statements about numbers and plans, while option D represents an undefined future outcome. Accurate reporting of symptoms is crucial for initial triage.
8 / 10
A code review comment reads: "This PR introduces a potential race condition in the database interaction logic. We should add proper locking to prevent concurrent access.". What is the primary concern highlighted in this comment?
The comment directly addresses a race condition – where multiple processes access and modify shared data simultaneously, leading to unpredictable results. Options A, B, and C represent other valid but distinct concerns that were not the primary focus of this review.
9 / 10
"The API is returning a 503 Service Unavailable error with the message: 'Gateway timeout'. What does this typically indicate?
A 'Gateway timeout' error usually signifies that the server responsible for handling the request couldn't reach the destination within a specified timeframe. This frequently points to network issues or high server load—the server is waiting for something it doesn't receive. Options B, C and D are less likely causes.
10 / 10
A PR description states: "Fixing a bug where users were intermittently losing their shopping carts due to session timeout issues. Implemented a more robust session management system with increased timeout values.". What is the purpose of this PR?
The description clearly states that this PR resolves a bug where users were losing their carts. The implementation details (robust session management) are secondary to the primary goal of fixing the identified problem. Options A, C and D represent unrelated changes.
What will I practise in "Incident Resolution Language — Exercises"?
Practice English vocabulary for incident resolution: mitigated vs resolved, standing down, monitoring for recurrence, post-mortem action items, and all-clear declarations in professional incident response.
How many exercises are in this module?
This module has 10 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Incident Command Language exercises?
Browse the full Incident Command Language hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.