ITIL 4 Foundation (ITIL4F) — Questions 901–975

The technician is reacting to an unplanned interruption of service (users cannot access a critical application) and quickly restoring service by rebooting the server. This aligns directly with the Incident Management practice, which aims to minimize the negative impact of incidents by restoring normal service operation as quickly as possible. The immediate reboot is a workaround to restore functionality, not a permanent fix, which is characteristic of incident handling.

The Service Desk practice is the correct answer because it serves as the single point of contact for users, providing guidance and support for application usage. By offering immediate assistance and training on new features, the service desk directly addresses the root cause of the incidents—user unfamiliarity—rather than just reacting to the symptoms. This proactive approach reduces the volume of incidents by improving user competence and confidence.

A service request is a pre-defined, routine request, while an incident is an unplanned service interruption.

According to ITIL 4, an incident is any unplanned interruption or reduction in quality of an IT service. The analyst's first action must be to log an incident record to capture the details of the service outage, initiate the incident management process, and ensure timely restoration of the CRM service. This aligns with the ITIL 4 guiding principle of 'Focus on Value' by immediately addressing the user's inability to work.

The app was launched and meets all technical specifications (output), but users find it difficult to navigate and adoption is low, meaning the desired business result (outcome) was not achieved. In ITIL 4, an output is a tangible deliverable (the app), while an outcome is the result for stakeholders (e.g., increased user engagement or productivity). This scenario directly illustrates that an output was produced but the desired outcome was not achieved, making option C correct.

The 'Focus on value' guiding principle is correct because it explicitly states that every activity, process, or service should deliver measurable value to stakeholders, including customers and users. In ITIL 4, this principle ensures that all improvements and operations are aligned with business outcomes, preventing wasteful efforts that do not contribute to perceived or actual value.

Incident Management aims to restore normal service as quickly as possible, minimizing impact on business operations.

The Partners and Suppliers dimension covers the relationships and dependencies with external organizations, including cloud providers. When migrating to a public cloud, the IT team's concern about data security and control directly involves the provider's security standards, SLAs, and contractual obligations, making this dimension the most relevant.

An outcome is a result for a stakeholder. The 30% time reduction is a measurable result achieved by the service. Output would be the email system itself; utility is the functionality; warranty is the availability.

Value is subjective and perceived by the consumer. It is not solely financial and is not determined by the provider.

The issue is that users are not using the tool because it is difficult, indicating a neglect of the Organizations and People dimension, which includes skills and user adoption. The technology works, but people are not able or willing to use it.

Cloud computing is a core technology component of the Information and Technology dimension, which covers the tools, systems, and infrastructure used to deliver and manage IT services. This dimension includes hardware, software, networks, and cloud platforms that enable service delivery, making cloud computing a direct fit.

Problem Management (D) is correct because its primary purpose is to analyze the root cause of incidents and prevent recurrence. After a major incident, the team performs root cause analysis (RCA) to identify underlying issues and implement permanent fixes, which is a core activity of Problem Management, not Incident Management.

Option C is correct because the primary purpose of Incident Management is to restore normal service operation as quickly as possible and minimize adverse impact on business operations. This aligns with the ITIL 4 definition, which prioritizes speed of recovery over root cause analysis, ensuring business continuity is maintained. The practice focuses on managing the lifecycle of all incidents, from detection through resolution, with a clear goal of minimizing downtime.

Warranty assures that a service will meet agreed conditions like availability, capacity, continuity, and security. Uptime guarantee is a warranty aspect.

This interaction is recorded as an incident because the executive experienced an unplanned interruption to the printing service (failure to print), which directly aligns with the ITIL 4 definition of an incident: any unplanned reduction in service quality. Restarting the print spooler is a restoration action that returns the service to normal operation, not a permanent fix or a request for something new.

Monitoring and Event Management practice is responsible for detecting events, classifying them (informational, warning, exception), and responding appropriately.

Partners and Suppliers dimension covers sourcing strategy, contracts, and supply chain. The other dimensions are not directly about sourcing.

Option B is correct because the 'Start where you are' guiding principle emphasizes assessing the current state of services, processes, and technologies before making improvements. This ensures that existing investments, capabilities, and data are understood, avoiding unnecessary rework and leveraging what already works.

IT Asset Management manages the lifecycle of assets, including financial tracking.

The Partners and Suppliers dimension covers third-party relationships, contracts, and sourcing. The other dimensions are less relevant for managing the external provider relationship.

The primary purpose of Incident Management is to restore normal service operation as quickly as possible and minimize the adverse impact on business operations. This ensures that service availability and quality are maintained, aligning with the ITIL 4 guiding principle of 'Focus on Value' by prioritizing rapid recovery over root cause analysis.

The 'Deliver and Support' activity includes managing changes and ensuring services are delivered with the required availability and security. Testing after deployment is part of delivering and supporting the service.

The Service Value System includes the Guiding Principles, Governance, Service Value Chain, Practices, and Continual Improvement. Option A (Guiding Principles) and Option D (Service Value Chain) are correct. Option B is part of the Four Dimensions, not SVS; Option C is a practice; Option E is a generic concept.

Supplier Management handles supplier performance, contracts, and relationships.

In ITIL 4, an output is a tangible or intangible deliverable produced by a service or process, while an outcome is the result or benefit achieved for stakeholders. Here, the new feature is the direct output of the release, and the 15% improvement in customer satisfaction is the outcome—the value realized from using that feature. Option C correctly maps the feature to output and the satisfaction improvement to outcome.

Monitoring and event management practice deals with detecting events and alerts related to IT services.

The 'Start where you are' guiding principle emphasizes leveraging existing services, processes, tools, and procedures before building new ones. By checking for reusable tools or procedures, the team avoids reinventing the wheel and reduces waste, directly aligning with this principle's focus on measuring and building upon current capabilities.

The ITIL Continual Improvement Model consists of 7 steps: What is the vision?, Where are we now?, Where do we want to be?, How do we get there?, Take action, Did we get there?, and How do we keep the momentum going? Option A is the correct order. Options B, C, and D have incorrect sequences.

The service owner is prioritizing a custom solution for control, ignoring that the off-the-shelf product delivers 90% of requirements at half the cost and faster deployment. This violates the 'Focus on value' principle, which requires all decisions to maximize value for stakeholders, not technical preferences. The custom approach introduces unnecessary cost, delay, and complexity without proportional benefit, directly contradicting value-driven outcomes.

Neglecting the Organisations and People dimension can lead to confusion about who does what.

By using the cloud service, the consumer transfers the risk of data loss due to hardware failure to the provider (who ensures data redundancy).

The user is the person who uses the service. The customer is the person who defines requirements and pays for the service. The sponsor authorises budget.

The resolution code indicates a 'Workaround' was applied, meaning the incident was resolved temporarily but the root cause remains unknown. According to ITIL 4, when a workaround is used, the service desk should create a problem record to investigate the underlying cause and prevent recurrence. Simply closing the incident would leave the root cause unaddressed, risking future incidents.

A is correct because Governance is one of the five core components of the ITIL Service Value System (SVS). The SVS defines how all components and activities of an organization work together as a system to enable value creation, and governance ensures that the organization's activities are aligned with its objectives and stakeholder needs.

Standard changes are pre-approved and have a defined procedure; normal changes require assessment and approval by a change authority.

Option A is correct because in ITIL 4, 'Exception' is one of the three defined event types in Monitoring and Event Management. Exception events indicate that something has deviated from normal operation, such as a configuration drift or a threshold breach, and they require immediate attention or escalation.

The Service Desk is the SPOC for incidents (Option A). Incident Management aims to restore service with workarounds (Option D). Option B is false because Incident Management applies workarounds; Option C is false because the Service Desk does not perform root cause analysis; Option E is false because service requests are handled by Service Request Management, not necessarily the Service Desk.

Problem Management aims to prevent incidents from recurring by identifying and eliminating their root causes. Identifying the root cause of incidents is a core activity of Problem Management, as it enables the creation of known errors and the implementation of permanent solutions. This distinguishes it from Incident Management, which focuses on restoring service quickly.

Customer Satisfaction Score (CSAT) is a key measure for the Service Desk practice because it directly reflects the end-user's perception of the service quality and support experience. It is typically gathered through post-interaction surveys and provides immediate feedback on how well the service desk meets user expectations, aligning with the ITIL guiding principle of 'Focus on Value'.

An output is a tangible or intangible deliverable produced by an activity; an outcome is the result for a stakeholder.

Problem Management is the ITIL 4 practice responsible for managing known errors and ensuring workarounds are documented. It identifies the root causes of incidents, creates known error records in the Known Error Database (KEDB), and documents workarounds to reduce the impact of recurring issues, aligning with the ITIL 4 'Problem Management' practice definition.

IT Asset Management manages the lifecycle of IT assets, including financial and contractual aspects.

The first action should be to log the incident to record the details and begin service restoration.

Error Control is the phase where known errors are documented and managed, after root cause analysis in Problem Control.

Service level management begins with defining requirements, then negotiating targets, documenting the SLA, monitoring, and reviewing.

A service consumer is a generic role that includes customers, users, and sponsors. A user is a type of service consumer.

A password reset is a pre-approved, routine request – a service request, not an incident.

Value is subjective and depends on stakeholder needs. If recovery is critical, Provider B may offer higher value despite higher cost.

The 'Start where you are' principle is the correct first step because building a custom self-service portal from scratch without assessing existing capabilities, such as current VM management tools, APIs, or automation scripts, risks reinventing the wheel and wasting resources. The team should first evaluate what already exists (e.g., existing cloud orchestration platforms, monitoring systems, or customer-facing interfaces) to leverage or improve upon them, aligning with ITIL's guidance to avoid unnecessary duplication of effort.

Neglecting the Value Streams and Processes and Organisations and People dimensions can cause customer dissatisfaction and resistance.

The SVS describes how all components and activities of the organisation work together to facilitate value creation through IT-enabled services.

The guiding principle 'Focus on value' ensures everything the organization does is aligned to creating value for stakeholders. 'Think and work holistically' is about understanding the end-to-end service and system interconnections. 'Progress iteratively with feedback' is about iteration and feedback. 'Collaborate and promote visibility' is about teamwork and transparency. The correct answer is 'Think and work holistically'.

The confusion among staff due to unclear role definitions directly points to the 'Organizations and People' dimension, which covers roles, responsibilities, culture, and competencies. While the new incident management process improved MTRS (a process outcome), neglecting to define who does what undermines adoption and effectiveness, as people are the ones executing the process.

The service consumer is a generic role that includes customers, users, and sponsors who receive the service.