ITIL4F Key Concepts of ITIL 4 Practice Question
A company's IT service desk receives multiple calls that users cannot access the CRM system. What should the service desk do FIRST according to ITIL 4?
⚠ Common exam trap
It's easy for candidates to confuse incident management with problem management, thinking that finding the root cause (Option C) should come first, but ITIL 4 mandates restoring service before investigating causes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log an incident and work to restore service.
According to ITIL 4, the primary goal of the service desk is to restore normal service operation as quickly as possible when an incident occurs. Multiple users losing access to the CRM system is a clear incident (an unplanned interruption or reduction in quality of an IT service), so the first action is to log the incident and work to restore service, typically by applying a known workaround or fix. This aligns with the 'incident management' practice, which prioritizes speed of restoration over root cause analysis or permanent changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Raise a service request to grant user access.
Why it's wrong here
Raising a service request is inappropriate here because service requests are for pre-defined, standard actions like requesting new software or a password reset, not for unexpected service interruptions. Multiple calls about an issue indicate an unplanned disruption or reduction in service quality, which ITIL 4 defines as an incident. The immediate focus should be on restoring normal service, not fulfilling a standard request.
- ✗
Submit a change request to modify the CRM system.
Why it's wrong here
Submitting a change request is premature and incorrect as a first response to multiple user calls about an issue. Change management is concerned with adding, modifying, or removing anything that could have a direct or indirect effect on services, requiring planning, assessment, and authorization. The immediate priority is to address the current service disruption, not to initiate a potentially complex system modification without understanding the root cause.
- ✗
Initiate a problem investigation to find the root cause.
Why it's wrong here
Initiating a problem investigation is not the immediate first step when multiple users report an issue. Problem management focuses on identifying and resolving the root causes of incidents to prevent recurrence, which typically begins after incidents have been logged and initial service restoration efforts are underway. The primary goal in this scenario is to first restore service operation as quickly as possible.
- ✓
Log an incident and work to restore service.
Why this is correct
Logging an incident and working to restore service is the correct initial action. An incident is defined as an unplanned interruption to a service or a reduction in the quality of a service, which perfectly describes multiple user calls about an issue. Incident management's primary objective is to restore normal service operation as quickly as possible, minimizing business impact, making it the most appropriate immediate response.
Go deeper
Related to this question
About these practice questions
This ITIL4F question is part of Courseiva's 805-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.