ITIL4F ITIL Management Practices Practice Test 28 — 15 Questions

Question 1

Which of the following scenarios BEST illustrates the difference between an incident and a service request?

Accepted Answer

A user requests a password reset (service request) and later reports that the email system is down (incident). A password reset is a routine, pre-approved service request fulfilled through the service catalogue, while an email system outage is an unplanned interruption of service and therefore an incident. Option B correctly pairs a service request with an incident, illustrating the distinction ITIL 4 draws between planned request fulfillment and incident resolution. This is the only option where both labels are applied correctly.

Answer

A user reports a system crash (service request) and requests a software upgrade (incident)

Answer

A user requests a new laptop (incident) and reports a printer jam (service request)

Answer

A user requests access to a database (incident) and reports a network outage (incident)

Question 2

Which TWO statements about Problem Management are correct?

Accepted Answer

It includes root cause analysis to identify the underlying cause of incidents. Option A is correct because Problem Management's core purpose is to perform root cause analysis (RCA) to determine the underlying cause of one or more incidents, preventing recurrence rather than just resolving symptoms. Option E is correct because Problem Management owns and maintains the Known Error Database (KEDB), which stores details of problems and their root causes along with documented workarounds, typically populated once a problem is diagnosed. Option B is not correct as stated because implementing permanent fixes is a change/implementation activity (Change Management/technical teams) that Problem Management triggers via an RFC, not something it directly performs. Option C is incorrect because recording and tracking individual incidents is the responsibility of Incident Management, not Problem Management. Option D is incorrect because restoring normal service operation as quickly as possible is the primary objective of Incident Management.

Answer

It is responsible for implementing permanent fixes for recurring incidents

Answer

It focuses on recording and tracking individual incidents

Answer

It is responsible for restoring normal service operation

Question 3

Which THREE are types of changes in Change Enablement?

Accepted Answer

Normal. In Change Enablement (ITIL 4), changes are classified into exactly three types: Standard, Normal, and Emergency. Option A (Normal) is correct because normal changes follow the full change control process, including assessment, authorization, and scheduling by the Change Authority. Option C (Emergency) is correct because emergency changes must be implemented as quickly as possible to resolve an incident or security issue, often with expedited or retrospective authorization. Option D (Standard) is correct because standard changes are pre-authorized, low-risk, routine changes with a documented procedure or work instruction. Option B (Urgent) is not a defined change type — urgency is an attribute that may trigger an emergency change, not a category itself. Option E (Minor) is not a change type either; minor refers to low impact/risk scope, which typically maps to a standard or normal change rather than a distinct classification.

Answer

Urgent

Answer

Minor

Question 4

Which TWO statements correctly describe the relationship between Service Level Management and other practices?

Accepted Answer

OLAs support the achievement of SLAs. Option D is correct because Operational Level Agreements (OLAs) are internal agreements between teams within the same organization that underpin and support the delivery of the customer-facing SLA targets. Option E is correct because SLAs establish measurable service targets (such as availability, response, and resolution times) that Incident Management uses to prioritize and resolve incidents in line with agreed commitments. Option A is not correct because supplier performance is managed through contracts and Underpinning Contracts (UCs), not SLAs, which are agreements with customers. Option B is not correct because agreements between internal IT teams are OLAs, not SLAs, which are customer-facing. Option C is not correct because the detailed steps of incident handling are defined in incident management procedures and work instructions, not in SLAs, which specify targets rather than process steps.

Answer

SLAs are used to manage supplier performance

Answer

SLAs are agreements between internal IT teams

Answer

SLAs define the detailed steps of the incident handling process

Question 5

Which THREE are key metrics for the Service Desk practice?

Accepted Answer

First Contact Resolution (FCR). First Contact Resolution (FCR) is a key Service Desk metric because it measures the percentage of user contacts resolved at the first point of contact without escalation, directly reflecting the desk's efficiency and autonomy. Average time to resolve an incident is also a core Service Desk metric, as it tracks the mean elapsed time from incident logging to resolution, indicating how quickly the desk restores service to users. Customer Satisfaction Score (CSAT) is a key Service Desk metric because it captures users' perception of the support experience, typically via post-interaction surveys, and is a primary indicator of service quality. The number of problems recorded is not a Service Desk metric but rather a Problem Management metric, since problems are the underlying causes of incidents handled by that separate practice. Mean Time Between Failures (MTBF) is a reliability metric for components or systems, typically used in availability and capacity management, not a Service Desk performance measure.

Answer

Number of problems recorded

Answer

Mean Time Between Failures (MTBF)

Question 6

Which TWO activities are part of the problem identification phase of Problem Management?

Accepted Answer

Trend analysis of incident records. Problem identification involves proactively identifying potential problems. The correct activities are trend analysis of incident records (option B) and analyzing incident data for patterns (option D). These help detect recurring issues. Option A (organizing workarounds into known-error records) is part of error control, not identification. Option C (root cause analysis) is part of problem control. Option E (implementing a known error) is also error control.

Answer

Organizing workarounds into known-error records

Answer

Root cause analysis

Answer

Implementing a known error

Question 7

Which TWO are components of the ITIL 4 Continual Improvement Model?

Accepted Answer

Where are we now?. The ITIL 4 Continual Improvement Model consists of seven steps: What is the vision?, Where are we now?, Where do we want to be?, How do we get there?, Take action, Did we get there?, and How do we keep the momentum going? The two correct components from the options are B ("Where are we now?") and E ("How do we get there?"). Options A, C, and D are not steps in the model.

Answer

Define improvement objectives

Answer

How do we keep momentum?

Answer

Plan the improvement

Question 8

Which TWO statements about the relationship between IT Asset Management and Service Configuration Management are correct?

Accepted Answer

Configuration management provides information about relationships between assets. Option C is correct because Service Configuration Management maintains the CMDB and its relationship records, so it can show how assets/CIs depend on or connect to one another (e.g., an application running on a server, or a server hosted on a hypervisor). Option D is correct because the CMDB is the configuration management repository that holds CI attributes and can include detailed information about IT assets, linking asset data to configuration data. Option A is not correct because configuration management, not asset management, establishes and maintains the configuration baseline. Option B is not correct because the relationship is not universally bidirectional: assets are not always managed as CIs, and CIs are not always financial/physical assets. Option E is not correct because asset management focuses on the asset lifecycle (procurement, deployment, maintenance, disposal), while configuration management focuses on CIs and their relationships.

Answer

Asset management maintains the configuration baseline

Answer

All assets are considered CIs, and all CIs are assets

Answer

Asset management focuses on the lifecycle of CIs

Question 9

Which THREE actions are part of Supplier Management?

Accepted Answer

Managing supplier contracts. Supplier Management in ITIL/IT service management covers the activities needed to manage the suppliers that deliver products and services to the organization. Option C is correct because managing supplier contracts — including negotiation, maintenance, renewal, and compliance with agreed terms — is a core supplier management activity. Option D is correct because monitoring supplier performance against agreed SLAs, KPIs, and service levels ensures suppliers meet their contractual obligations and supports continual improvement. Option E is correct because evaluating and selecting suppliers is part of the sourcing and supplier strategy process, ensuring the right suppliers are chosen before contracts are established. Option A is not part of supplier management because setting SLA targets for internal teams concerns internal service level management, not external suppliers. Option B is not a standard supplier management action; while training may occasionally be arranged, providing training to supplier staff is the supplier's own responsibility and is not one of the core supplier management processes.

Answer

Setting SLA targets for internal teams

Answer

Providing training to supplier staff

Question 10

Which TWO are key activities of Capacity and Performance Management?

Accepted Answer

Forecasting future demand for services. Option C (Forecasting future demand for services) is correct because Capacity and Performance Management must anticipate future workload and resource requirements so that services continue to meet agreed performance targets as demand grows. Option E (Monitoring current service performance) is correct because it provides the baseline data on utilization, throughput, and response times needed to compare actual performance against targets and to feed accurate forecasting. Together, these activities form the core iterative cycle of measuring present performance and predicting future capacity needs. Option A (Defining service level targets) belongs primarily to Service Level Management, which negotiates and agrees SLAs rather than performing capacity analysis. Option B (Managing the IT service desk staffing levels) is a workforce/resource management activity, not a capacity management activity for IT services. Option D (Managing service availability) is the domain of Availability Management, which focuses on uptime and reliability rather than capacity and performance.

Answer

Defining service level targets

Answer

Managing the IT service desk staffing levels

Answer

Managing service availability

Question 11

Which THREE are examples of unplanned downtime that Availability Management seeks to minimize?

Accepted Answer

Hardware failure. Availability Management aims to minimize unplanned downtime, which is any outage not scheduled or agreed in advance. Option B (Hardware failure) is correct because a sudden disk, PSU, or NIC failure is an unexpected event that directly reduces service availability and must be mitigated through redundancy, monitoring, and fast recovery. Option C (Cyberattack causing service disruption) is correct because a DDoS, ransomware, or intrusion-induced outage is unplanned and Availability Management addresses it via security controls, resilience, and incident response. Option E (Software bug causing service outage) is correct because an unexpected defect that crashes a service or corrupts data is unplanned downtime requiring patching, testing, and rollback strategies. Options A (Scheduled maintenance) and D (Planned upgrade of a server) are not unplanned downtime; they are planned, pre-agreed activities typically handled by Change Management and excluded from the unplanned downtime that Availability Management seeks to minimize.

Answer

Scheduled maintenance

Answer

Planned upgrade of a server

Question 12

Which ITIL 4 practice has the PRIMARY purpose of restoring normal service operation as quickly as possible and minimizing the adverse impact on business operations?

Accepted Answer

Incident Management. Incident Management's primary purpose in ITIL 4 is to restore normal service operation as quickly as possible and minimize the adverse impact on business operations, making it the correct answer. It focuses on the 'here and now' — diagnosing and resolving the immediate disruption rather than investigating underlying causes. This urgency-driven practice is distinct from Problem Management, which seeks root causes.

Answer

Problem Management

Answer

Service Request Management

Answer

Change Enablement

Question 13

An organization wants to improve the user experience for password reset requests. Currently, users call the service desk for each password reset, resulting in high call volume. According to ITIL 4, which practice should be applied to streamline this process?

Accepted Answer

Service Request Management, by offering a self-service password reset option through the service catalogue. A password reset is a routine, pre-approved request from a user, which ITIL 4 classifies as a service request handled by the Service Request Management practice. Publishing a self-service password reset option in the service catalogue lets users resolve the need without contacting the service desk, directly reducing call volume. This aligns with ITIL 4's emphasis on value co-creation and shifting work to self-service where appropriate.

Answer

Incident Management, because password reset is a disruption

Answer

Problem Management, to find the root cause of forgotten passwords

Answer

Change Enablement, because resetting a password changes the user account

Question 14

Which THREE of the following are purposes or activities of the Problem Management practice?

Accepted Answer

Identify the root cause of incidents. Problem Management is the ITIL practice whose core purpose is to reduce the likelihood and impact of incidents by identifying their actual and potential causes, so option A ('Identify the root cause of incidents') is correct because root cause analysis is the central investigative activity of the practice. Option B ('Document known errors and workarounds') is correct because once a root cause is understood and a permanent fix is not yet in place, Problem Management records the known error in the known error database and documents workarounds that can be used by Incident Management. Option C ('Proactively prevent incidents from occurring') is correct because Problem Management includes proactive problem management, which analyzes trends and identifies potential failures to eliminate or mitigate them before they cause incidents. Option D is incorrect because assessing and authorizing changes belongs to the Change Enablement practice, even when the change resolves a known error. Option E is incorrect because restoring normal service operation as quickly as possible is the purpose of the Incident Management practice, not Problem Management.

Answer

Assess and authorize changes to resolve known errors

Answer

Restore normal service operation as quickly as possible

Question 15

Which TWO of the following are types of events in the Monitoring and Event Management practice?

Accepted Answer

Warning event. In the Monitoring and Event Management practice, events are classified by their significance and required response, and two recognized event types are the warning event (C) and the informational event (E). A warning event (C) is correct because it signals that a component or service is approaching a threshold or condition that may require attention before it becomes a breach, such as high CPU or low disk space. An informational event (E) is correct because it simply records a normal, expected occurrence—like a device coming online or a job completing—that requires no action. The other options do not belong: a known error (A) is a problem record whose root cause is documented, a standard change (B) is a pre-authorized low-risk change, and a service request (D) is a user-initiated request handled by the Service Request Management practice—none of these are event types in Monitoring and Event Management.

Answer

Known error

Answer

Standard change

Answer

Service request