ITIL4F Hard Questions — 25 Difficult Questions

Question 1

A service desk agent fulfills a password reset request for a user. According to ITIL 4, which practice does this activity belong to?

Accepted Answer

Service Request Management. A password reset is a standard, low-risk, pre-approved request that follows a defined procedure, which aligns with the Service Request Management practice. ITIL 4 defines a service request as a formal request from a user for something to be provided – such as information, advice, or access to a service – and password resets are a classic example. This practice focuses on fulfilling predefined, standardized requests efficiently, not on handling failures or changes.

Answer

Change Enablement

Answer

Incident Management

Answer

Problem Management

Question 2

An organization implements a new security patch as an emergency change. After deployment, they run tests to ensure no negative impact. Which service value chain activity are they performing?

Accepted Answer

Deliver and Support. Deliver and Support is the correct activity because it focuses on making services available for use and ensuring they continue to meet agreed performance levels. After deploying the emergency security patch, running tests to verify no negative impact is a direct part of the 'support' aspect, confirming the service remains stable and operational. This aligns with the ITIL 4 guidance that Deliver and Support includes service validation and testing post-deployment.

Answer

Obtain/Build

Answer

Improve

Answer

Design and Transition

Question 3

An IT department has a CMDB. Which practice is primarily responsible for ensuring that configuration data is accurate and up to date?

Accepted Answer

Service Configuration Management. Service Configuration Management (C) is the practice responsible for maintaining accurate and up-to-date configuration data in the CMDB. It ensures that all Configuration Items (CIs) are identified, controlled, and their attributes and relationships are recorded and verified through regular audits and reconciliation processes, directly supporting the integrity of the CMDB.

Answer

Monitoring and Event Management

Answer

IT Asset Management

Answer

Service Desk

Question 4

An organisation is selecting a new cloud provider. The IT team evaluates two options: Provider A offers low cost but no disaster recovery; Provider B offers higher cost with guaranteed recovery time. According to ITIL 4, which statements about value are correct?

Accepted Answer

Provider B offers better value if the organisation prioritises risk reduction over cost. ITIL 4 defines value as the perceived benefits, utility, and warranty of a service. If the organisation prioritises risk reduction (warranty) over cost, Provider B's guaranteed recovery time delivers higher value by ensuring business continuity, even at a higher price. Value is not purely cost-based; it depends on stakeholder needs and outcomes.

Answer

Provider A offers better value because cost is lower

Answer

Value cannot be compared because it is always subjective

Answer

Both providers offer the same value because they both provide cloud services

Question 5

An IT service provider is implementing a new monitoring tool. According to the ITIL 4 guiding principle 'Focus on value', what should the provider do FIRST?

Accepted Answer

Identify the stakeholders and understand what value means to them. According to the ITIL 4 guiding principle 'Focus on value', the first step is to identify stakeholders and understand what value means to them. For a monitoring tool, this means engaging with service owners, operations teams, and customers to define what success looks like (e.g., reduced MTTR, improved availability) before selecting or configuring any technology. Without this value definition, the tool risks being implemented with irrelevant metrics or features that do not align with business outcomes.

Answer

Identify existing monitoring tools and use them if possible

Answer

Define the required metrics and reports from the tool

Answer

Select the tool with the most features to ensure maximum functionality

Question 6

A cloud service provider wants to introduce a new self-service portal for customers to manage their virtual machines. The project team proposes building a custom solution from scratch. Which ITIL guiding principle should the team apply first?

Accepted Answer

Start where you are. The 'Start where you are' principle is the correct first step because building a custom self-service portal from scratch without assessing existing capabilities, such as current VM management tools, APIs, or automation scripts, risks reinventing the wheel and wasting resources. The team should first evaluate what already exists (e.g., existing cloud orchestration platforms, monitoring systems, or customer-facing interfaces) to leverage or improve upon them, aligning with ITIL's guidance to avoid unnecessary duplication of effort.

Answer

Keep it simple and practical

Answer

Focus on value

Answer

Progress iteratively with feedback

Question 7

An organization is designing a new service. The service owner wants to ensure that the service can be operated within agreed service levels. Which ITIL management practice should be applied to define the acceptable performance levels?

Accepted Answer

Service Level Management. Service Level Management (SLM) is the ITIL practice responsible for negotiating, agreeing, and documenting measurable service level targets (SLTs) with customers, and then monitoring and reporting on achievement against those targets. In this scenario, defining 'acceptable performance levels' directly corresponds to establishing SLTs within a Service Level Agreement (SLA), which is the core function of SLM.

Answer

Service Continuity Management

Answer

Capacity and Performance Management

Answer

Service Catalog Management

Question 8

A monitoring tool detects that the CPU usage on a server has exceeded 90% for 10 minutes. According to ITIL 4, how should this event be classified?

Accepted Answer

Exception event. In ITIL 4, an exception event indicates that a service or component is operating outside its normal threshold and requires immediate attention. CPU usage exceeding 90% for 10 minutes is a clear deviation from the expected baseline, triggering an exception event that may lead to incident creation if it impacts service availability.

Answer

Incident

Answer

Informational event

Answer

Warning event

Question 9

An IT team is implementing a new monitoring tool. They choose to integrate it with the existing ticketing system rather than building a new one from scratch. Which principle is applied, and which principle might be overlooked if they don’t consider the impact on other tools?

Accepted Answer

Start where you are is applied; Think and work holistically might be overlooked. The team is reusing the existing ticketing system rather than building a new one, which directly applies the 'Start where you are' principle by leveraging current investments and processes. However, if they fail to assess how the new monitoring tool will interact with other tools (e.g., CMDB, notification services, or reporting dashboards), they overlook 'Think and work holistically,' risking integration failures, data silos, or performance degradation across the service value chain.

Answer

Keep it simple is applied; Focus on value might be overlooked

Answer

Collaborate is applied; Start where you are might be overlooked

Answer

Progress iteratively is applied; Optimise and automate might be overlooked

Question 10

An organisation implements a new human resources (HR) system. The project team delivers the system on time and within budget. However, HR staff find the system difficult to use and employee satisfaction with HR services does not improve. According to ITIL 4, which statement describes this situation?

Accepted Answer

The output (system delivery) was successful, but the outcome (improved satisfaction) was not achieved. In ITIL 4, an output is a tangible deliverable (e.g., the HR system delivered on time and within budget), while an outcome is the result for stakeholders (e.g., improved employee satisfaction). The scenario shows the output was successful, but the outcome was not achieved because the system was difficult to use and satisfaction did not improve. Option C correctly identifies this mismatch.

Answer

The output and outcome are the same in this context

Answer

The outcome (employee satisfaction) was achieved, but the output (delivery) failed

Answer

The output and outcome were both achieved

Question 11

A large enterprise is implementing ITIL 4 and wants to ensure that its service management practices are integrated and support end-to-end service delivery. The CIO is concerned that different teams are working in silos. Which component of the Service Value System should the organization focus on to break down silos?

Accepted Answer

Service value chain. The Service Value Chain is the core component of the ITIL Service Value System that defines the key activities required to respond to demand and facilitate value creation through the creation, delivery, and improvement of services. By focusing on the value chain, the organization can map and integrate the workflows of different teams (e.g., incident management, change enablement, service desk) into a single end-to-end delivery model, directly breaking down silos by forcing cross-functional handoffs and shared accountability for outcomes.

Answer

Guiding principles

Answer

Four dimensions of service management

Answer

Governance

Question 12

An organization has a centralized IT department that handles all technology decisions, but business units are unhappy with the level of service. Which ITIL 4 concept is being neglected?

Accepted Answer

Organizational silos. The scenario describes a centralized IT department making all technology decisions without input from business units, leading to dissatisfaction. This is a classic symptom of organizational silos, where the IT department operates in isolation from the rest of the business, failing to align services with actual needs. ITIL 4 emphasizes breaking down silos to enable collaboration and co-creation of value.

Answer

The service value chain

Answer

Continual improvement

Answer

The guiding principles

Question 13

An e-commerce company uses a payment gateway service. The service provider ensures transaction processing (utility) and guarantees 99.99% uptime (warranty). However, the company incurs a cost per transaction and bears reputational risk if the gateway fails. According to ITIL 4, what is the service consumer's perspective on costs and risks?

Accepted Answer

The consumer incurs costs and retains some risks, while the provider removes other risks. ITIL 4 defines that in a service relationship, the consumer always incurs some costs (e.g., per-transaction fees) and retains certain risks (e.g., reputational damage if the payment gateway fails), while the provider removes other risks (e.g., infrastructure downtime) through the warranty of 99.99% uptime. The utility ensures the service meets the consumer's need for transaction processing, but the consumer cannot fully transfer all risks or costs to the provider.

Answer

The consumer only bears the cost; all risks are transferred to the provider

Answer

The consumer only bears the risks; the provider absorbs all costs

Answer

The consumer has no costs or risks because the service provider handles everything

Question 14

A major incident occurs that affects all users. The service desk logs the incident. After restoring service, the team wants to prevent recurrence. Which practice should lead the investigation?

Accepted Answer

Problem Management. Problem Management is the correct practice because its primary purpose is to identify the root cause of incidents and prevent recurrence. After service restoration, Problem Management conducts a structured investigation (e.g., using techniques like 5 Whys or Kepner-Tregoe) to find the underlying cause and initiate a permanent fix, such as a known error record or a change request.

Answer

Service Level Management

Answer

Change Enablement

Answer

Incident Management

Question 15

An organization has implemented a new customer relationship management (CRM) system. Users are now able to access customer data 50% faster, leading to increased sales. Which of the following describes the output vs. outcome in this scenario?

Accepted Answer

Output: the CRM system; Outcome: faster data access and increased sales. In ITIL 4, an output is a tangible deliverable (the CRM system), while an outcome is the result achieved for stakeholders (faster data access and increased sales). The question explicitly states that users access data 50% faster and sales increased, which are the outcomes enabled by the CRM system output.

Answer

Output: faster data access; Outcome: the CRM system

Answer

Output: the CRM system; Outcome: revenue from the project

Answer

Output: increased sales; Outcome: the CRM system

Question 16

A user calls the service desk to request a new laptop because their current one is slow and outdated. However, the user's manager wants the request handled as an incident because the laptop is affecting productivity. According to ITIL 4, how should this request be classified?

Accepted Answer

Service request, because it is a request for a new asset. This request is a service request because the user is asking for a new laptop as a pre-defined, standard item, not reporting a disruption to an existing service. ITIL 4 defines a service request as a formal request for something to be provided, such as access to a new asset. The user's inability to work effectively does not change the classification; the underlying issue is a need for a new asset, not an unplanned interruption.

Answer

Change request, because it involves replacing hardware

Answer

Incident, because the user cannot work effectively

Answer

Problem, because the root cause of slowness needs investigation

Question 17

A global financial services firm is expanding its online trading platform to handle increased market volatility. The platform currently uses a monolithic architecture hosted in a private cloud. The IT team has noticed that during peak trading hours, the system experiences latency spikes and occasional timeouts. The business requires 99.99% uptime and rapid scaling to handle sudden volume surges. The team has been asked to propose improvements within the 'Information and Technology' dimension. They are evaluating several options. Which course of action best addresses the symptoms while aligning with the four dimensions?

Accepted Answer

Migrate to a microservices architecture using container orchestration and implement auto-scaling policies to handle demand spikes.. Directly addresses the root cause (monolithic architecture unable to scale dynamically) by migrating to microservices with container orchestration (e.g., Kubernetes) and auto-scaling policies. This aligns with the 'Information and Technology' dimension by redesigning the technology architecture to handle sudden volume surges, achieving 99.99% uptime through horizontal scaling and fault isolation, rather than vertical scaling or reactive processes.

Answer

Increase the capacity of existing servers by adding more CPU and RAM to handle peak loads.

Answer

Implement a new incident management process to reduce response times during outages.

Answer

Outsource the platform management to a third-party provider with proven uptime guarantees.

Question 18

An organization has a legacy system that is critical for operations. The team wants to replace it with a modern solution. According to the guiding principles, what should they do FIRST?

Accepted Answer

Conduct a thorough assessment of the existing legacy system. According to the ITIL 4 guiding principle 'Start where you are', the first step should be to conduct a thorough assessment of the existing legacy system. This ensures that the team understands the current system's functionality, dependencies, and data structures before designing a replacement, reducing the risk of missing critical requirements or introducing integration failures.

Answer

Immediately begin building the new system to avoid delays

Answer

Design the new system from scratch based on best practices

Answer

Automate the legacy system to improve performance

Question 19

A project team is developing a new mobile banking app. They decide to reuse an existing authentication module and focus on adding new features. Which ITIL 4 guiding principle is being applied?

Accepted Answer

Start where you are. The team is reusing an existing authentication module rather than building a new one from scratch. This directly applies the 'Start where you are' guiding principle, which recommends leveraging existing services, processes, and capabilities to avoid unnecessary rework and reduce risk. By starting with what already works, the team can focus effort on new features, maximizing efficiency.

Answer

Collaborate and promote visibility

Answer

Progress iteratively with feedback

Answer

Focus on value

Question 20

Which FOUR of the following are key concepts of ITIL 4 that help define and communicate value?

Accepted Answer

Cost. The provided explanation is incorrect. ITIL 4 Foundation guidance explicitly lists 'Value', 'Outcomes', 'Costs', and 'Risks' as the four key concepts of value. Therefore, 'Risk' (E) is an equally important key concept of value alongside 'Value', 'Outcome', and 'Cost', not a 'separate but related factor' as stated. The formula 'Value = (Perceived Benefits + Outcomes) / (Cost + Risk)' is also not an official ITIL 4 mathematical definition.

Answer

Output