ITIL4F Hard Questions — 25 Difficult Questions

Question 1

An organization implements a new security patch as an emergency change. After deployment, they run tests to ensure no negative impact. Which service value chain activity are they performing?

Accepted Answer

Deliver and Support. Deliver and Support is the correct activity because it focuses on making services available for use and ensuring they continue to meet agreed performance levels. After deploying the emergency security patch, running tests to verify no negative impact is a direct part of the 'support' aspect, confirming the service remains stable and operational. This aligns with the ITIL 4 guidance that Deliver and Support includes service validation and testing post-deployment.

Answer

Obtain/Build

Answer

Improve

Answer

Design and Transition

Question 2

An IT department has a CMDB. Which practice is primarily responsible for ensuring that configuration data is accurate and up to date?

Accepted Answer

Service Configuration Management. Service Configuration Management (C) is the practice responsible for maintaining accurate and up-to-date configuration data in the CMDB. It ensures that all Configuration Items (CIs) are identified, controlled, and their attributes and relationships are recorded and verified through regular audits and reconciliation processes, directly supporting the integrity of the CMDB.

Answer

Monitoring and Event Management

Answer

IT Asset Management

Answer

Service Desk

Question 3

An organization is designing a new service. The service owner wants to ensure that the service can be operated within agreed service levels. Which ITIL management practice should be applied to define the acceptable performance levels?

Accepted Answer

Service Level Management. Service Level Management (SLM) is the ITIL practice responsible for negotiating, agreeing, and documenting measurable service level targets (SLTs) with customers, and then monitoring and reporting on achievement against those targets. In this scenario, defining 'acceptable performance levels' directly corresponds to establishing SLTs within a Service Level Agreement (SLA), which is the core function of SLM.

Answer

Service Continuity Management

Answer

Capacity and Performance Management

Answer

Service Catalog Management

Question 4

A monitoring tool detects that the CPU usage on a server has exceeded 90% for 10 minutes. According to ITIL 4, how should this event be classified?

Accepted Answer

Exception event. In ITIL 4, an exception event indicates that a service or component is operating outside its normal threshold and requires immediate attention. CPU usage exceeding 90% for 10 minutes is a clear deviation from the expected baseline, triggering an exception event that may lead to incident creation if it impacts service availability.

Answer

Incident

Answer

Informational event

Answer

Warning event

Question 5

An IT team is implementing a new monitoring tool. They choose to integrate it with the existing ticketing system rather than building a new one from scratch. Which principle is applied, and which principle might be overlooked if they don’t consider the impact on other tools?

Accepted Answer

Start where you are is applied; Think and work holistically might be overlooked. The team is reusing the existing ticketing system rather than building a new one, which directly applies the 'Start where you are' principle by leveraging current investments and processes. However, if they fail to assess how the new monitoring tool will interact with other tools (e.g., CMDB, notification services, or reporting dashboards), they overlook 'Think and work holistically,' risking integration failures, data silos, or performance degradation across the service value chain.

Answer

Keep it simple is applied; Focus on value might be overlooked

Answer

Collaborate is applied; Start where you are might be overlooked

Answer

Progress iteratively is applied; Optimise and automate might be overlooked

Question 6

A large enterprise is implementing ITIL 4 and wants to ensure that its service management practices are integrated and support end-to-end service delivery. The CIO is concerned that different teams are working in silos. Which component of the Service Value System should the organization focus on to break down silos?

Accepted Answer

Service value chain. The Service Value Chain is the core component of the ITIL Service Value System that defines the key activities required to respond to demand and facilitate value creation through the creation, delivery, and improvement of services. By focusing on the value chain, the organization can map and integrate the workflows of different teams (e.g., incident management, change enablement, service desk) into a single end-to-end delivery model, directly breaking down silos by forcing cross-functional handoffs and shared accountability for outcomes.

Answer

Guiding principles

Answer

Four dimensions of service management

Answer

Governance

Question 7

An organization has a centralized IT department that handles all technology decisions, but business units are unhappy with the level of service. Which ITIL 4 concept is being neglected?

Accepted Answer

Organizational silos. The scenario describes a centralized IT department making all technology decisions without input from business units, leading to dissatisfaction. This is a classic symptom of organizational silos, where the IT department operates in isolation from the rest of the business, failing to align services with actual needs. ITIL 4 emphasizes breaking down silos to enable collaboration and co-creation of value.

Answer

The service value chain

Answer

Continual improvement

Answer

The guiding principles

Question 8

A global financial services firm is expanding its online trading platform to handle increased market volatility. The platform currently uses a monolithic architecture hosted in a private cloud. The IT team has noticed that during peak trading hours, the system experiences latency spikes and occasional timeouts. The business requires 99.99% uptime and rapid scaling to handle sudden volume surges. The team has been asked to propose improvements within the 'Information and Technology' dimension. They are evaluating several options. Which course of action best addresses the symptoms while aligning with the four dimensions?

Accepted Answer

Migrate to a microservices architecture using container orchestration and implement auto-scaling policies to handle demand spikes.. Directly addresses the root cause (monolithic architecture unable to scale dynamically) by migrating to microservices with container orchestration (e.g., Kubernetes) and auto-scaling policies. This aligns with the 'Information and Technology' dimension by redesigning the technology architecture to handle sudden volume surges, achieving 99.99% uptime through horizontal scaling and fault isolation, rather than vertical scaling or reactive processes.

Answer

Increase the capacity of existing servers by adding more CPU and RAM to handle peak loads.

Answer

Implement a new incident management process to reduce response times during outages.

Answer

Outsource the platform management to a third-party provider with proven uptime guarantees.

Question 9

Which THREE of the following are consequences of neglecting the Partners and Suppliers dimension?

Accepted Answer

Contractual disputes. Neglecting the Partners and Suppliers dimension means failing to manage relationships, agreements, and expectations with external parties, which directly leads to contractual disputes (B) because unclear or unmanaged terms, service levels, and obligations create conflict and rework with vendors. It also causes supply chain disruptions (C), since poor coordination, communication, and risk management with suppliers make the flow of goods and services fragile and prone to interruption. Additionally, it results in a lack of innovation from external partners (E), because innovation typically flows through strong, collaborative relationships and shared roadmaps, which atrophy when the dimension is ignored. Options A and D are not consequences of neglect: improved vendor relationships and enhanced internal communication are positive outcomes that would result from good management, not from neglecting this dimension, and internal communication is not the primary focus of the Partners and Suppliers dimension anyway.

Answer

Improved vendor relationships

Answer

Enhanced internal communication

Question 10

Which FOUR of the following are key concepts of ITIL 4 that help define and communicate value?

Accepted Answer

Cost. The provided explanation is incorrect. ITIL 4 Foundation guidance explicitly lists 'Value', 'Outcomes', 'Costs', and 'Risks' as the four key concepts of value. Therefore, 'Risk' (E) is an equally important key concept of value alongside 'Value', 'Outcome', and 'Cost', not a 'separate but related factor' as stated. The formula 'Value = (Perceived Benefits + Outcomes) / (Cost + Risk)' is also not an official ITIL 4 mathematical definition.

Answer

Output

Question 11

A large e-commerce company is experiencing slow response times on its website during peak shopping hours. The IT team has identified that the database server is under high CPU load. They have tried scaling up the server resources, but the issue persists. The team suspects that inefficient database queries are the cause. The service owner wants to implement a solution that aligns with the ITIL guiding principles. The company has a limited budget for this initiative. Which course of action should the team take to address the problem most effectively?

Accepted Answer

Analyze and optimize the slow database queries identified by the database administrator.. The root cause is inefficient database queries, not insufficient hardware. Optimizing queries directly addresses the high CPU load by reducing the processing required per query, aligning with the ITIL guiding principle of 'Focus on Value' by solving the actual problem without unnecessary expenditure. This approach also respects the limited budget, as query optimization typically requires only DBA time rather than costly infrastructure upgrades.

Answer

Upgrade to a more powerful database server with more CPUs.

Answer

Implement a caching layer to reduce database load.

Answer

Hire a database consultant to review the entire database architecture.

Question 12

Refer to the exhibit. A change order to patch a security vulnerability on WebServer01 has been approved. The IT manager is the change authority. During implementation, it is discovered that the patch requires a reboot, which will cause an outage for the OrderApp application. What is the MOST appropriate action?

Accepted Answer

Inform the IT manager and ask for a decision on whether to proceed.. The change order was approved based on the original scope, which did not include a reboot. The discovery that a reboot is required introduces a new risk (application outage) that was not assessed during the initial approval. The IT manager, as the change authority, must be informed and make a decision on whether to proceed with the change under the new circumstances, in line with the ITIL 4 'change enablement' practice of managing risk and ensuring authorized decisions.

Answer

Escalate to the change advisory board (CAB) for a new approval.

Answer

Proceed with the change as planned, since the change is already approved.

Answer

Cancel the change and request a new one with updated information.

Question 13

A company implements a new monitoring system that sends alerts when server CPU usage exceeds 90%. Which ITIL 4 practice is primarily involved?

Accepted Answer

Monitoring and Event Management. The monitoring system that sends alerts when CPU usage exceeds 90% directly involves detecting and responding to operational events. This is the core function of the Monitoring and Event Management practice, which defines how events (such as threshold breaches) are captured, analyzed, and acted upon. The alert itself is an 'event' in ITIL 4 terms, making this practice primarily responsible.

Answer

Service Desk

Answer

Incident Management

Answer

Capacity and Performance Management

Question 14

Which ITIL 4 guiding principle is most closely associated with the Service Value Chain activity 'Improve'?

Accepted Answer

Progress iteratively with feedback. The 'Improve' activity in the Service Value Chain is focused on continual improvement of services and practices. The guiding principle 'Progress iteratively with feedback' is most closely associated because it emphasizes making incremental improvements and using feedback loops to refine processes, which directly aligns with the iterative nature of improvement activities.

Answer

Focus on value

Answer

Collaborate and promote visibility

Answer

Think and work holistically

Question 15

An organization implements a new service quickly by reusing existing components and minimizing customization. Which ITIL 4 guiding principle is being applied?

Accepted Answer

Keep it simple and practical. The 'Keep it simple and practical' guiding principle emphasizes reusing existing components and minimizing customization to achieve a quick implementation. By avoiding unnecessary complexity and leveraging what already works, the organization delivers the new service efficiently without over-engineering the solution.

Answer

Optimize and automate

Answer

Focus on value

Answer

Collaborate and promote visibility

Question 16

You are the IT service manager for a medium-sized e-commerce company that processes online orders. The company uses a three-tier application architecture: a web server, an application server, and a database server. Recently, the company has been experiencing intermittent service degradation during peak hours (12:00-14:00 and 18:00-20:00), causing slow page loads and occasional timeouts. The monitoring system shows that CPU utilization on the application server spikes to 95% during these periods, while the web server and database server remain below 60%. The incident management team has been opening multiple tickets for the same issue, but each ticket is resolved by restarting the application server, which temporarily restores performance. The problem management team has been assigned to investigate the root cause. They have discovered that a recent software update to the application introduced a memory leak that gradually consumes resources until the server becomes overloaded. The development team has identified a fix but needs two weeks to fully test and deploy it. Meanwhile, the business is losing revenue due to poor performance. Which of the following actions should the problem management team take FIRST?

Accepted Answer

Implement a workaround, such as scheduling a restart of the application server every hour during peak times.. The problem management team should first implement a workaround to restore service and minimize business impact while the permanent fix is being developed. Restarting the application server every hour during peak times directly addresses the memory leak symptom by freeing accumulated memory, preventing CPU saturation at 95% and avoiding timeouts. This aligns with ITIL 4's guidance to apply a workaround as an interim measure when a known error exists and a fix is pending.

Answer

Conduct a root cause analysis to fully understand the memory leak.

Answer

Increase the application server's CPU capacity to handle the load.

Answer

Escalate the incident to the service desk for faster resolution.

Question 17

You are the IT service manager for a multinational corporation that provides financial services. The company recently acquired a smaller fintech startup. The startup has its own IT infrastructure and processes, which are very different from the parent company's. The parent company uses a centralized IT service management system based on ITIL, while the startup uses a lightweight, DevOps-oriented approach. The CEO wants to integrate the startup's IT operations into the parent company's ITSM tool as quickly as possible to gain visibility and control. The startup's team is resistant, arguing that the parent company's processes are too bureaucratic and will slow them down. The parent company's IT team is frustrated because the startup is not following the established incident and change management processes. You have been asked to propose a course of action that aligns with ITIL guiding principles. Which option should you choose?

Accepted Answer

Establish a joint team to map the startup's current processes to ITIL best practices, then create a lightweight, integrated process that satisfies both parties, and roll it out incrementally with feedback loops.. It directly applies the ITIL guiding principles of 'Start where you are' (by mapping the startup's existing DevOps processes), 'Collaborate and promote visibility' (via a joint team), and 'Progress iteratively with feedback' (incremental rollout with feedback loops). This approach avoids the resistance and disruption of forced adoption while creating a lightweight integrated process that satisfies both the need for visibility and the startup's agility requirements.

Answer

Allow the startup to keep their own processes but require them to report incidents and changes via email to a central coordinator.

Answer

Create a separate ITSM instance for the startup with full autonomy, and do not integrate until the startup grows.

Answer

Require the startup to adopt the parent company's processes immediately, with a one-month transition period and training.

Question 18

A change with a low risk and pre-approved process that follows a defined procedure is classified as which type of change?

Accepted Answer

Standard change. A standard change is defined in ITIL 4 as a change that is low risk, pre-authorized, and follows a defined procedure or work instruction. This classification allows for faster, repeatable changes without requiring additional approval each time, as the risk and process are already understood and documented.

Answer

Service request

Answer

Emergency change

Answer

Normal change

Question 19

A multinational retail company has recently migrated its e-commerce platform to a new cloud infrastructure. The IT operations team consists of 15 members distributed across three regions (Americas, EMEA, APAC). They use a centralized service desk tool that logs all incidents and service requests. Over the past month, the number of incidents has increased by 30%, primarily related to authentication failures and slow page load times. The service desk has been creating workarounds for each incident but has not yet identified any root causes. The IT manager wants to reduce the incident volume and improve service stability. The team is also under pressure to keep costs low. Which course of action should the IT manager take first?

Accepted Answer

Implement a problem management practice to analyze recurring incidents and find root causes. The IT manager should first implement a problem management practice to systematically analyze the recurring authentication failures and slow page load times. This aligns with ITIL 4's guiding principle of 'focus on value' by addressing root causes rather than symptoms, reducing incident volume long-term without additional cost. The 30% incident increase and lack of root cause identification indicate a reactive approach, and problem management directly targets this gap to improve service stability.

Answer

Hire additional service desk agents to handle the increased incident volume

Answer

Conduct a training session for all IT staff on incident management best practices

Answer

Upgrade the service desk tool to automate incident resolution

Question 20

A service provider delivers a new online banking app that meets all technical specifications but users find it difficult to navigate, leading to low adoption. According to ITIL 4, this is a failure of:

Accepted Answer

Warranty. In ITIL 4, utility refers to the functionality offered by a service—'what the service does'—and the online banking app meets all technical specifications, so utility is satisfied. However, warranty is about 'how the service performs,' including aspects like availability, capacity, continuity, and security, but also usability and user experience, which directly affect adoption. The app's difficult navigation indicates a failure in warranty because the service is not fit for use, even though it is fit for purpose.

Answer

Utility

Answer

Outcome

Answer

Value streams