You are writing the incident timeline for a post-mortem. Which entry is written in the correct blameless style?
Option B is written in the blameless style: it describes what happened without naming who did it or using judgement words like "accidentally" or "incorrectly".
The blameless approach: focus on the system, process, or environment — not the individual. This is not about protecting anyone from accountability; it's about identifying systemic failures that allowed the mistake to happen. If "John ran it against prod", the real question is: why was production connectable from a dev machine? Why wasn't staging validation required? These are systemic failures.
Option A is blaming by name. Option C uses "accidentally" which implies human error. Option D uses "incorrectly" which implies poor performance. All three shift focus away from the systemic analysis.
2 / 13
Order these timeline entries in correct chronological format: "_____ UTC — Alert fired: payment error rate exceeded 5% threshold.
_____ UTC — Root cause identified: config change at 14:28 dropped DB index.
_____ UTC — Rollback initiated.
_____ UTC — Error rate returned to baseline."
Incident timelines always run chronologically — earliest to latest. This mirrors how the incident unfolded and makes the causal chain legible: event A → consequence B → response C → resolution D.
A well-formed timeline entry contains: timestamp (UTC) → what happened (system event, action taken, or observation). Example:
"14:32 UTC — Payment service error rate exceeded 5% threshold, alert fired." "14:35 UTC — On-call engineer acknowledged alert." "14:47 UTC — Root cause identified: DB connection pool exhausted." "14:51 UTC — Config rollback initiated." "15:03 UTC — Error rate returned to baseline."
Use UTC always — incident responders are in different time zones.
3 / 13
Which phrase correctly uses past tense to describe a completed incident event in a timeline?
Option C uses the correct past tense for incident timeline writing: passive constructions with simple past ("was completed", "returned") are standard. They describe what happened factually without attributing action to a person.
Common timeline verb patterns: • "The alert fired at…" • "The rollback was initiated at…" • "The deployment was reverted." • "Error rates returned to baseline." • "Service was restored at…" • "The root cause was identified as…"
Option A is present tense (ongoing). Option B is future. Option D is a gerund phrase without a proper verb — unclear timeline.
4 / 13
Alex from the OnCall team sent this Slack message during the recent database outage: 'Seriously? Another downtime?! This is unacceptable! Fix it now!'
Which of the following best describes the tone and appropriateness of Alex's message for documenting an incident timeline?
While it's important to acknowledge urgency during an incident, Alex's message is too accusatory and lacks specific details. Incident timelines require objective observations and action steps, not emotional judgments. The goal is to create a clear record for learning and future prevention, not to assign blame or escalate the situation further in the moment.
5 / 13
During a post-mortem review of a service degradation event, Ben is drafting the PR description for the incident timeline. He writes: 'We deployed version 2.1.0 which caused a massive spike in latency. We rolled it back immediately.'
Which of these phrases would be the MOST effective addition to complete this sentence and accurately represent the technical details?
Ben's initial phrasing lacks specific information. To improve clarity, he needs to quantify the 'massive spike in latency' (e.g., by percentage or duration) and state the rollback action precisely. A good PR description focuses on concrete details that can be verified and used for root cause analysis.
6 / 13
You're reviewing a timeline entry generated by an automated monitoring system: '2024-10-27 14:35 UTC – Alert triggered: High CPU utilization on Web Server A.'
Which of the following is the MOST important piece of information to add to this entry to make it more useful for troubleshooting?
The initial entry provides a timestamp and alert type, but it's incomplete. Adding information like the affected server (Web Server A), the CPU utilization percentage at that moment, and any related metrics would significantly improve its usefulness for investigation. The timeline should record enough data to quickly pinpoint the source of the issue.
7 / 13
Chloe is updating her standup report about an ongoing incident and writes: 'We're still fighting with this weird error. It keeps popping up randomly.'
What best describes the appropriate level of detail for this statement in a formal incident timeline?
'We're still fighting with this weird error…' is too vague and subjective. Incident timelines require precise descriptions of problems, their impact (if any), and the actions being taken to resolve them. Using terms like 'weird' introduces ambiguity and hinders accurate tracking and reporting.
8 / 13
You're documenting a successful incident resolution in an API response format for the timeline: {'timestamp': '2024-10-27T15:00:00Z', 'action': 'Rollback completed successfully'}. Which of the following would be MOST beneficial to add to this response to provide additional context and ensure traceability?
While the timestamp and action are essential, adding details like the rollback target (e.g., 'Rollback completed successfully to version 2.0.5') or any relevant metrics (e.g., 'Latency returned to baseline within 5 minutes') would significantly enhance the response's value for auditing and future analysis. Complete documentation is key to understanding *why* a resolution was successful.
9 / 13
Alex from the OnCall team sent this Slack message during the recent database outage: 'Seriously? Another downtime?! This is unacceptable! Fix it now!'
Which of the following best describes the tone and appropriateness of Alex's message for documenting an incident timeline?
While it's important to acknowledge urgency during an incident, Alex's message is too accusatory and lacks specific details. Incident timelines require objective observations and action steps, not emotional judgments. The goal is to create a clear record for learning and future prevention, not to assign blame or escalate the situation further in the moment.
10 / 13
During a post-mortem review of a service degradation event, Ben is drafting the PR description for the incident timeline. He writes: 'We deployed version 2.1.0 which caused a massive spike in latency. We rolled it back immediately.'
Which of these phrases would be the MOST effective addition to complete this sentence and accurately represent the technical details?
Ben's initial phrasing lacks specific information. To improve clarity, he needs to quantify the 'massive spike in latency' (e.g., by percentage or duration) and state the rollback action precisely. A good PR description focuses on concrete details that can be verified and used for root cause analysis.
11 / 13
You're reviewing a timeline entry generated by an automated monitoring system: '2024-10-27 14:35 UTC – Alert triggered: High CPU utilization on Web Server A.'
Which of the following is the MOST important piece of information to add to this entry to make it more useful for troubleshooting?
The initial entry provides a timestamp and alert type, but it's incomplete. Adding information like the affected server (Web Server A), the CPU utilization percentage at that moment, and any related metrics would significantly improve its usefulness for investigation. The timeline should record enough data to quickly pinpoint the source of the issue.
12 / 13
Chloe is updating her standup report about an ongoing incident and writes: 'We're still fighting with this weird error. It keeps popping up randomly.'
What best describes the appropriate level of detail for this statement in a formal incident timeline?
'We're still fighting with this weird error…' is too vague and subjective. Incident timelines require precise descriptions of problems, their impact (if any), and the actions being taken to resolve them. Using terms like 'weird' introduces ambiguity and hinders accurate tracking and reporting.
13 / 13
You're documenting a successful incident resolution in an API response format for the timeline: {'timestamp': '2024-10-27T15:00:00Z', 'action': 'Rollback completed successfully'}. Which of the following would be MOST beneficial to add to this response to provide additional context and ensure traceability?
While the timestamp and action are essential, adding details like the rollback target (e.g., 'Rollback completed successfully to version 2.0.5') or any relevant metrics (e.g., 'Latency returned to baseline within 5 minutes') would significantly enhance the response's value for auditing and future analysis. Complete documentation is key to understanding *why* a resolution was successful.
What will I practise in "Building the Incident Timeline — Incident Response English Exercise"?
Practice writing blameless, chronological incident timelines in past tense. 3 exercises for SRE, DevOps, and backend engineers writing post-mortems.
How many exercises are in this module?
This module has 13 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Incident Response exercises?
Browse the full Incident Response hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.