Scenario practice questions

An IT governance committee is designing a risk management training program for software engineers. Which THREE practices align with ITIL 4 guiding principles? (Choose three.)

Trap 1: Forcing engineers to memorize a 500-page regulatory compliance…

Rote memorisation of a 500-page statute wastes effort and blocks delivery, conflicting with ITIL 4's progress-iteratively and start-where-you-are principles. It is tempting where regulatory audits demand documented competence, and would be correct only for a short, role-specific summary of the clauses engineers actually implement.

Trap 2: Making the training mandatory only for executives while completely…

Excluding engineers from security awareness leaves the people writing the code unaware of risk, contradicting ITIL 4's collaborate and think-holistically principles. It is tempting when budget limits training to leadership, and would fit only where engineers genuinely have no access to production systems or customer data.

A
Forcing engineers to memorize a 500-page regulatory compliance statute word-for-word before writing any code.
Why it fails: Rote memorisation of a 500-page statute wastes effort and blocks delivery, conflicting with ITIL 4's progress-iteratively and start-where-you-are principles. It is tempting where regulatory audits demand documented competence, and would be correct only for a short, role-specific summary of the clauses engineers actually implement.
B
Focusing the training on how risk management enables secure, continuous software delivery ('Focus on value').
Framing risk management training around secure, continuous delivery directly applies 'focus on value', tying every risk activity to the outcome engineers actually deliver. This satisfies the committee's need for practices aligned to ITIL 4 guiding principles rather than abstract compliance.
C
Making the training mandatory only for executives while completely excluding engineers from security awareness.
Why it fails: Excluding engineers from security awareness leaves the people writing the code unaware of risk, contradicting ITIL 4's collaborate and think-holistically principles. It is tempting when budget limits training to leadership, and would fit only where engineers genuinely have no access to production systems or customer data.
D
Designing short, practical, scenario-based training modules embedded directly into the developer onboarding workflow ('Keep it simple and practical').
Short, scenario-based modules embedded in onboarding embody 'keep it simple and practical', removing unnecessary complexity and fitting training into existing workflow rather than adding separate overhead. This satisfies the stem's requirement for a practice aligned with ITIL 4 guiding principles.
E
Co-creating the training content with both security experts and software engineers ('Collaborate and promote visibility').
Co-creating content with security experts and software engineers directly enacts 'Collaborate and promote visibility' by breaking silos between disciplines. Cross-functional input surfaces real risks engineers face, improving relevance and adoption. This satisfies the stem's requirement for practices aligned with ITIL 4 guiding principles, specifically the collaboration principle.

Question 2mediummulti select

An IT strategist is using ServiceNow Continual Improvement Management to govern improvement initiatives across the enterprise. Which TWO of the following capabilities are standard features of ServiceNow CIM that support tracking and reporting? (Choose two)

Trap 1: Automated physical badge reader integration for facilities…

CIM tracks improvement initiatives, their metrics and outcomes; badge reader integration belongs to facilities or workplace service management. It is tempting because CIM governs enterprise-wide improvement, and physical access data could feed a facilities initiative, but no standard CIM capability ingests badge hardware for tracking and reporting.

Trap 2: Automatic bare-metal operating system provisioning and server…

CIM records and reports on improvement initiatives; bare-metal provisioning and racking are infrastructure automation tasks outside its scope. It is tempting because CIM can govern an initiative that delivers provisioning improvements, but the platform itself provides no automated OS deployment or physical racking capability for tracking and reporting.

Trap 3: Direct cryptographic packet sniffing for network intrusion…

ServiceNow CIM tracks improvement initiatives through records, dashboards and reports; it performs no packet capture, so cryptographic sniffing falls outside its scope. Packet sniffing belongs to network intrusion detection systems such as Suricata or Zeek, which would be the right tool when raw traffic inspection is the actual requirement.

A
Automated physical badge reader integration for facilities management.
Why it fails: CIM tracks improvement initiatives, their metrics and outcomes; badge reader integration belongs to facilities or workplace service management. It is tempting because CIM governs enterprise-wide improvement, and physical access data could feed a facilities initiative, but no standard CIM capability ingests badge hardware for tracking and reporting.
B
Continual Improvement Initiative records with structured lifecycle phases and task tracking.
Continual Improvement Initiative records provide the structured lifecycle phases and associated task tracking that ServiceNow CIM uses to move an initiative from identification through execution, satisfying the stem's requirement for standard tracking capability across enterprise improvement governance.
C
Automatic bare-metal operating system provisioning and server racking.
Why it fails: CIM records and reports on improvement initiatives; bare-metal provisioning and racking are infrastructure automation tasks outside its scope. It is tempting because CIM can govern an initiative that delivers provisioning improvements, but the platform itself provides no automated OS deployment or physical racking capability for tracking and reporting.
D
Direct cryptographic packet sniffing for network intrusion detection.
Why it fails: ServiceNow CIM tracks improvement initiatives through records, dashboards and reports; it performs no packet capture, so cryptographic sniffing falls outside its scope. Packet sniffing belongs to network intrusion detection systems such as Suricata or Zeek, which would be the right tool when raw traffic inspection is the actual requirement.
E
Out-of-the-box reporting and dashboards displaying ROI, cost savings, and phase distribution.
ServiceNow CIM ships with out-of-the-box reports and dashboards surfacing ROI, cost savings and phase distribution, giving the strategist the reporting visibility the stem demands without custom development. These metrics directly support governance and prioritisation of improvement initiatives.

Review the full routing breakdown →

Question 3hardmultiple choice

An IT strategist is designing an automated workflow in ServiceNow where continual improvement initiatives are evaluated against strategic portfolio constraints. If an initiative requires capital expenditure exceeding $50,000, the workflow must automatically route it to the Enterprise Architecture board for governance review. Which ServiceNow mechanism should be used to enforce this routing rule?

Trap 1: Service Level Agreement (SLA) breach escalation actions.

SLA breach escalation actions fire when a task exceeds a defined duration target, not when a dollar threshold is met, so a $50,000 capital expenditure would never trigger routing. It is tempting because SLAs automate escalation, and would be correct if the governance trigger were elapsed time rather than cost.

Trap 2: Access Control Lists (ACLs) restricting write permissions.

ACLs govern record read, write, create, and delete permissions by user or role; they cannot evaluate a capital expenditure value and trigger routing. It is tempting because ACLs enforce governance boundaries, and would be correct if the requirement were restricting who may edit initiative records rather than conditional approval routing.

Trap 3: Data Archiving retention policies.

Data archiving retention policies govern how long inactive records are stored before deletion or transfer, so they cannot evaluate expenditure thresholds or trigger routing. They are tempting because both archiving and workflow rules are configured on tables, yet archiving addresses storage lifecycle compliance, not conditional governance routing.

A
Service Level Agreement (SLA) breach escalation actions.
Why it fails: SLA breach escalation actions fire when a task exceeds a defined duration target, not when a dollar threshold is met, so a $50,000 capital expenditure would never trigger routing. It is tempting because SLAs automate escalation, and would be correct if the governance trigger were elapsed time rather than cost.
B
Access Control Lists (ACLs) restricting write permissions.
Why it fails: ACLs govern record read, write, create, and delete permissions by user or role; they cannot evaluate a capital expenditure value and trigger routing. It is tempting because ACLs enforce governance boundaries, and would be correct if the requirement were restricting who may edit initiative records rather than conditional approval routing.
C
Data Archiving retention policies.
Why it fails: Data archiving retention policies govern how long inactive records are stored before deletion or transfer, so they cannot evaluate expenditure thresholds or trigger routing. They are tempting because both archiving and workflow rules are configured on tables, yet archiving addresses storage lifecycle compliance, not conditional governance routing.
D
ServiceNow Decision Tables evaluating initiative cost attributes to route workflow paths.
Decision Tables evaluate multiple input attributes against defined conditions and return a matching result row, so an initiative's capital expenditure can be tested against the $50,000 threshold and the Enterprise Architecture board route returned automatically. This enforces the governance routing rule declaratively within the workflow, without scripting, satisfying the stem's cost-based constraint.

Question 4easymulti select

Which TWO of the following scenarios demonstrate a failure to apply 'Progress iteratively with feedback'? (Choose two.)

Trap 1: A project manager breaks down a large ISO certification project…

This scenario actually demonstrates the practice correctly: milestones with stakeholder reviews embody iterative progress and feedback loops. It is tempting because large certification projects feel like they demand rigid waterfall planning, but the reviews are precisely the feedback mechanism the practice requires, so it cannot illustrate a failure.

Trap 2: A development team releases minor compliance updates to production…

Weekly releases adjusted from user feedback directly enact iterative progress with feedback, so this is a correct application, not a failure. It tempts because frequent production changes can look risky or uncontrolled, but the feedback-driven adjustment is exactly what the practice prescribes. Failures instead deliver once, with no review cycle.

Trap 3: An IT director conducts regular monthly retrospectives with the…

Monthly retrospectives with the compliance team are a textbook feedback loop, so this scenario exemplifies the practice rather than failing it. It tempts because retrospectives can appear ceremonial, yet they still close the loop by refining workflows. A genuine failure would show no review points at all between iterations.

A
A project manager breaks down a large ISO certification project into monthly milestones with stakeholder reviews.
Why it fails: This scenario actually demonstrates the practice correctly: milestones with stakeholder reviews embody iterative progress and feedback loops. It is tempting because large certification projects feel like they demand rigid waterfall planning, but the reviews are precisely the feedback mechanism the practice requires, so it cannot illustrate a failure.
B
A bank attempts to migrate all 100 legacy core banking systems to a new cloud GRC platform in a single weekend.
A single-weekend cutover of 100 systems is a big-bang release with no incremental delivery or feedback loop. Iterative progress requires phased migration, pilot validation and course correction between waves; compressing everything into one change window eliminates the feedback that would surface integration failures early.
C
A development team releases minor compliance updates to production every week and adjusts rules based on user feedback.
Why it fails: Weekly releases adjusted from user feedback directly enact iterative progress with feedback, so this is a correct application, not a failure. It tempts because frequent production changes can look risky or uncontrolled, but the feedback-driven adjustment is exactly what the practice prescribes. Failures instead deliver once, with no review cycle.
D
An enterprise spends 24 months writing a massive 800-page cybersecurity policy before testing any controls in practice.
Twenty-four months of policy authoring before any control testing is pure waterfall planning with zero feedback. Iterative progress demands small, testable increments; producing an 800-page document first means assumptions remain unvalidated until deployment, so defects and impractical controls surface only after enormous sunk effort.
E
An IT director conducts regular monthly retrospectives with the compliance team to refine approval workflows.
Why it fails: Monthly retrospectives with the compliance team are a textbook feedback loop, so this scenario exemplifies the practice rather than failing it. It tempts because retrospectives can appear ceremonial, yet they still close the loop by refining workflows. A genuine failure would show no review points at all between iterations.

Question 5mediummultiple choice

A financial institution uses Archer GRC for regulatory compliance tracking. The compliance team operates in a strict silo from the software development teams using Jira. Which guiding principle is most directly being violated by this organizational structure?

Trap 1: Start where you are

Starting where you are means reusing existing assets and data rather than rebuilding from scratch; it says nothing about integrating separate teams, so it does not address the silo. It would be correct when an organisation already owns tooling it should leverage instead of procuring replacements, not when two functions must be joined.

Trap 2: Focus on value

Focus on value concerns prioritising work that delivers measurable business outcomes, not the structural separation between compliance and development. It would be the right principle when selecting which initiatives to fund or sequence, whereas the stem's issue is that two interdependent teams share no collaboration or data flow.

Trap 3: Keep it simple and practical

Siloed compliance and development teams duplicate data entry and manual reconciliation, violating the simplicity and practicality principle. That principle is tempting because it sounds like a general efficiency slogan, and it would be the correct answer when a design adds unnecessary complexity rather than breaking integration.

A
Start where you are
Why it fails: Starting where you are means reusing existing assets and data rather than rebuilding from scratch; it says nothing about integrating separate teams, so it does not address the silo. It would be correct when an organisation already owns tooling it should leverage instead of procuring replacements, not when two functions must be joined.
B
Collaborate and promote visibility
Siloing Archer GRC compliance work from Jira development teams blocks information flow and shared understanding across groups. The collaborate and promote visibility principle requires breaking down silos, involving stakeholders, and sharing knowledge so compliance and delivery teams align on regulatory obligations and risks.
C
Focus on value
Why it fails: Focus on value concerns prioritising work that delivers measurable business outcomes, not the structural separation between compliance and development. It would be the right principle when selecting which initiatives to fund or sequence, whereas the stem's issue is that two interdependent teams share no collaboration or data flow.
D
Keep it simple and practical
Why it fails: Siloed compliance and development teams duplicate data entry and manual reconciliation, violating the simplicity and practicality principle. That principle is tempting because it sounds like a general efficiency slogan, and it would be the correct answer when a design adds unnecessary complexity rather than breaking integration.

Question 6hardmultiple choice

An enterprise organization is establishing a Value Realization Office (VRO). The office is tasked with reporting on the long-term value delivered by digital investments. During metric design, the strategist emphasizes measuring 'outcomes' rather than 'outputs.' Which scenario illustrates an 'outcome' metric?

Trap 1: Number of change advisory board (CAB) meetings held per month.

Counting CAB meetings measures governance activity performed, an output, not the value that governance enables. It is tempting because meeting frequency is simple to tally, but an outcome metric would capture the resulting effect, such as reduced change-related incidents or faster change throughput.

Trap 2: Number of virtual servers provisioned in Microsoft Azure.

Provisioned server count measures activity or output, not the business value that activity produces. It is tempting because infrastructure metrics are easy to collect and track, but an outcome metric would capture the resulting business result, such as reduced processing cost or improved service availability.

Trap 3: Total number of hours spent by developers writing code in Visual…

Developer coding hours quantify effort expended, an output, not the value realised from that effort. It is tempting because time-tracking data is readily available and looks quantitative, but an outcome metric would measure the delivered business result, such as reduced defect rates or faster release cycles.

A
Number of change advisory board (CAB) meetings held per month.
Why it fails: Counting CAB meetings measures governance activity performed, an output, not the value that governance enables. It is tempting because meeting frequency is simple to tally, but an outcome metric would capture the resulting effect, such as reduced change-related incidents or faster change throughput.
B
Number of virtual servers provisioned in Microsoft Azure.
Why it fails: Provisioned server count measures activity or output, not the business value that activity produces. It is tempting because infrastructure metrics are easy to collect and track, but an outcome metric would capture the resulting business result, such as reduced processing cost or improved service availability.
C
Percentage increase in customer retention and transaction speed achieved after application release.
Customer retention and transaction speed measure value realised after release, not delivery activity. Outputs count releases or features shipped; outcomes capture business results. This satisfies the stem's requirement by demonstrating measurable benefit achieved, aligning with DPI's outcome-focused value realisation.
D
Total number of hours spent by developers writing code in Visual Studio.
Why it fails: Developer coding hours quantify effort expended, an output, not the value realised from that effort. It is tempting because time-tracking data is readily available and looks quantitative, but an outcome metric would measure the delivered business result, such as reduced defect rates or faster release cycles.

Question 7mediummultiple choice

A multinational corporation is consolidating its regional GRC tools into a single global instance of ServiceNow GRC. The project team attempts to migrate all 5,000 legacy control procedures simultaneously on a single weekend, resulting in massive data corruption and audit failures. Which guiding principle was violated?

Trap 1: Focus on value

Focus on value concerns prioritising work that delivers the greatest business benefit; it does not prescribe incremental migration or validation of data. It is tempting because consolidating regional tools aims at value, and would be correct if the team had wasted effort on low-value controls instead of corrupting a mass migration.

Trap 2: Keep it simple and practical

The failure stemmed from attempting an all-at-once migration without incremental delivery or validation, which is a sequencing and risk-management concern rather than a simplicity issue. Keep it simple and practical addresses reducing unnecessary complexity in solutions, and would apply if the team had over-engineered the migration process itself.

Trap 3: Collaborate and promote visibility

Collaboration and visibility concerns sharing information and working across teams transparently; it does not govern how migration batches are sized or validated. It is tempting because a global consolidation spans regions, and would be correct if the failure were siloed teams or hidden progress rather than a single uncontrolled cutover.

A
Focus on value
Why it fails: Focus on value concerns prioritising work that delivers the greatest business benefit; it does not prescribe incremental migration or validation of data. It is tempting because consolidating regional tools aims at value, and would be correct if the team had wasted effort on low-value controls instead of corrupting a mass migration.
B
Keep it simple and practical
Why it fails: The failure stemmed from attempting an all-at-once migration without incremental delivery or validation, which is a sequencing and risk-management concern rather than a simplicity issue. Keep it simple and practical addresses reducing unnecessary complexity in solutions, and would apply if the team had over-engineered the migration process itself.
C
Progress iteratively with feedback
Migrating all 5,000 controls in one weekend ignores incremental delivery and validation. Progress iteratively with feedback requires small batches, testing, and learning between iterations, which would have surfaced corruption early instead of causing mass audit failure.
D
Collaborate and promote visibility
Why it fails: Collaboration and visibility concerns sharing information and working across teams transparently; it does not govern how migration batches are sized or validated. It is tempting because a global consolidation spans regions, and would be correct if the failure were siloed teams or hidden progress rather than a single uncontrolled cutover.

Question 8mediummulti select

An organization is applying the ITIL Continual Improvement model. Which TWO of the following questions from the model focus specifically on measuring results and sustaining progress? (Choose two)

Trap 1: Where are we now?

"Where are we now?" establishes the current baseline position, so it belongs to the model's first phase rather than measuring results or sustaining progress. It is tempting because baseline assessment genuinely underpins improvement planning, and it would be the right question when starting a new improvement initiative or re-baselining after major change.

Trap 2: How do we get there?

"How do we get there?" addresses planning the improvement approach, not measuring results or sustaining progress. It is tempting because it is a core step in the model, but the questions focused on measurement and momentum are "How do we know we have achieved it?" and "How do we keep the momentum going?".

Trap 3: What is the vision?

"What is the vision?" belongs to the first dimension, establishing direction and desired outcomes, not measuring results or sustaining progress. It is tempting because a clear vision underpins improvement, but the measuring and sustaining questions are "How do we know we have achieved it?" and "How do we keep the momentum going?".

A
How do we keep the momentum going?
"How do we keep the momentum going?" addresses sustaining progress, probing how to embed gains and maintain engagement after the initial improvement. It sits alongside the question on measuring results, together covering evaluation and persistence within the continual improvement model.
B
Did we get there?
"Did we get there?" verifies that the improvement delivered the intended value, confirming the measured outcome against the original baseline. This satisfies the stem's focus on measuring results, since the question demands evidence that the change actually achieved its goal before progress can be sustained.
C
Where are we now?
Why it fails: "Where are we now?" establishes the current baseline position, so it belongs to the model's first phase rather than measuring results or sustaining progress. It is tempting because baseline assessment genuinely underpins improvement planning, and it would be the right question when starting a new improvement initiative or re-baselining after major change.
D
How do we get there?
Why it fails: "How do we get there?" addresses planning the improvement approach, not measuring results or sustaining progress. It is tempting because it is a core step in the model, but the questions focused on measurement and momentum are "How do we know we have achieved it?" and "How do we keep the momentum going?".
E
What is the vision?
Why it fails: "What is the vision?" belongs to the first dimension, establishing direction and desired outcomes, not measuring results or sustaining progress. It is tempting because a clear vision underpins improvement, but the measuring and sustaining questions are "How do we know we have achieved it?" and "How do we keep the momentum going?".