ITIL 4 Foundation (ITIL4F) — Questions 376–450

The scenario describes moving incident resolution tasks from higher-level support tiers to the service desk, which is the essence of 'shift-left' in ITIL 4. By empowering the service desk with better tools, knowledge, and authority, incidents are resolved earlier in the support chain, improving first-level resolution rates and reducing escalation costs. This directly applies the shift-left principle, not just a general improvement or channel strategy.

Utility is what the service does (calculate salaries, generate payslips); warranty is how it is delivered (on schedule, compliant).

Known errors are documented in the Known Error Database (KEDB) and are a key output of problem management. Problem management is responsible for identifying the root cause of incidents and documenting workarounds or permanent fixes as known errors, making option D correct.

Option C is correct because the guiding principle 'Optimise and automate' directly applies to using technology to streamline repetitive, manual tasks. Automating password resets reduces human intervention, minimizes errors, and frees up service desk resources, which is a core application of this principle in ITIL 4.

In ITIL 4, value is defined as the perceived benefits, usefulness, and importance of something. It is not simply a financial concept, nor is it exclusively defined by the provider.

The team delivered an output (the new portal) but did not achieve the desired outcome (improved user satisfaction). Outcome is the result for stakeholders.

Utility is 'fit for purpose' (does it do what it should?), while warranty is 'fit for use' (is it available, secure, etc.?).

First Call Resolution (FCR) is the most appropriate metric because it directly measures whether the analyst resolved the issue during the initial contact without escalation or follow-up. Following a script to resolve a user's issue on the first call demonstrates effective adherence to standardized procedures and minimizes customer effort, which is the core purpose of FCR in ITIL 4.

Standard changes are pre-authorized and follow a defined, low-risk procedure, such as applying a routine security patch or provisioning a new user account. They do not require additional approval because the risk is well-understood and the implementation steps are documented in a standard operating procedure (SOP). This aligns with ITIL 4's definition of a standard change as a change that is fully documented, low risk, and can be implemented without a formal change advisory board (CAB) meeting.

Option A is correct because the Supplier Management practice's primary purpose is to ensure that suppliers and the services they provide are managed appropriately to meet business needs. This includes overseeing supplier performance, contracts, and relationships to align with organizational objectives. The practice focuses on the overall governance and control of supplier engagements, not just specific activities like auditing or target setting.

Capacity and Performance Management ensures services meet demand. Option B is correct. Option A is about availability; Option C is about configuration; Option D is about assets.

Progress iteratively with feedback is about using timeboxed iterations and feedback loops, avoiding big bang releases. This approach allows for continuous improvement based on user input.

The Service Desk practice is defined in ITIL 4 as the single point of contact (SPOC) between the service provider and users for all operational interactions. This ensures that users have a clear, consistent entry point for reporting incidents, submitting service requests, and seeking guidance. Omnichannel communication is also a key component because modern service desks must support multiple channels (phone, email, chat, portal) while maintaining a unified interaction history and consistent service quality.

Incidents are disruptions; problems are the underlying causes of one or more incidents.

Enhancing Information Security Management (ISM) directly improves an organization's ability to detect and respond to security incidents because ISM defines the policies, controls, and monitoring mechanisms (e.g., SIEM rules, intrusion detection signatures, and incident response playbooks) that enable proactive threat detection and structured response. While Incident Management handles the lifecycle of an incident once detected, ISM is the practice that establishes the security posture and detection capabilities in the first place.

Governance is the key component of the Service Value System (SVS) that ensures all activities are aligned with the organization's strategic objectives. It provides the framework for decision-making, accountability, and oversight, directing how the SVS operates to meet stakeholder needs. Without governance, the service value chain activities, continual improvement, and guiding principles may operate in isolation from strategic goals.

Option B (Improve) is correct because the ITIL 4 service value chain defines six core activities: Plan, Improve, Engage, Design & Transition, Obtain/Build, and Deliver & Support. 'Improve' is explicitly one of these activities, representing the continuous improvement of services, practices, and products across the value chain. It is not a generic term but a specific value chain activity that ensures ongoing alignment with business needs.

Option D, 'Collaborate and promote visibility,' is correct because customer value is co-created through active collaboration between the service provider and the customer, ensuring that requirements, constraints, and expectations are transparent. Option E, 'Focus on value,' is directly tied to customer value as it mandates that every activity, decision, and metric must be aligned with delivering measurable outcomes that matter to the customer, not just internal operational targets.

Normal changes require assessment and authorization but are not pre-approved like standard changes.

A known error is documented when the root cause is identified and a workaround exists; it is part of Problem Management's error control phase.

Start where you are emphasizes understanding the current state before making changes. The team reviews the existing configuration and usage patterns, which is a direct application of this principle.

Continual improvement uses the improvement register, follows the 7-step model, and aims to align services with business needs.

According to ITIL 4, the first priority when users cannot access a system is to restore normal service operation as quickly as possible. Logging an incident and attempting to restore service (Option D) aligns with the incident management practice, which focuses on minimizing impact and returning to normal. The analyst should not jump to root cause analysis or change management until the immediate outage is addressed.

The ITIL continual improvement model consists of seven steps. Step 5 is 'Take action', and step 6 is 'Did we get there?', which involves evaluating whether the implemented improvements achieved the desired outcomes. Since the team has completed step 5 and is now assessing outcomes, they should proceed to step 6, 'Did we get there?', making option A correct.

Warranty includes availability, capacity, continuity, and security. Performance relates to capacity – the service must have sufficient capacity to meet agreed levels.

According to ITIL 4, the first priority when a service disruption is reported is to restore normal service operation as quickly as possible. Logging an incident record ensures the issue is formally tracked, and attempting to restore service (e.g., by restarting the CRM application server or checking database connectivity) aligns with the incident management practice's objective of minimizing business impact.

The Value Streams and Processes dimension is neglected because implementing a new automation tool without updating the corresponding process workflows breaks the alignment between technology and the defined activities, triggers, and handoffs. Automation must be integrated into the existing value streams to ensure that the tool supports, rather than disrupts, the end-to-end service delivery. Without updating workflows, the automation may bypass critical steps, introduce errors, or fail to meet service level agreements.

According to ITIL 4, when users cannot access a service like a CRM system, the first action is to log an incident and attempt to restore service as quickly as possible, typically using a known workaround. This aligns with the incident management practice, which prioritizes minimizing business impact over immediate root cause analysis. Option C correctly follows this by logging the incident and applying a workaround to restore access.

Option D is correct because Problem Management is the ITIL 4 practice specifically designed to manage the lifecycle of all problems. Its core activities are problem identification (detecting and logging problems), problem control (analyzing and documenting workarounds and root causes), and error control (managing known errors through the lifecycle until a permanent resolution is implemented).

Change enablement begins with creation, then assessment and authorization, planning, implementation, and review.

The ITIL guiding principle 'Collaborate and promote visibility' directly addresses breaking down organizational silos and ensuring that information, progress, and obstacles are visible to all relevant stakeholders. This principle emphasizes cross-team cooperation and transparency, which are essential for effective service management and continuous improvement.

The weekly meetings where service desk team members share common issues and solutions directly embody the 'Collaborate and promote visibility' guiding principle. This principle emphasizes that work should be made visible to all stakeholders and that collaboration across teams leads to better outcomes. By openly discussing recurring problems and their resolutions, the team increases transparency and collective knowledge, which reduces silos and improves overall service quality.

Key Performance Indicators (KPIs) are metrics used to evaluate the success of an activity. First Call Resolution (FCR) and Customer Satisfaction Score (CSAT) are examples of KPIs, not metrics themselves.

Partners and Suppliers dimension covers relationships with external providers, contracts, and sourcing strategies. Option C is correct.

Think and work holistically is the guiding principle that emphasizes understanding the overall system and its interactions.

The service configuration management practice is directly responsible for maintaining accurate configuration information, including the CMDB. An accurate CMDB provides the single source of truth for configuration items (CIs) and their relationships, which is the core purpose of this practice. Without a reliable CMDB, the practice cannot fulfill its objective of supporting other ITIL practices with trustworthy data.

Option B (Cost) is correct because in ITIL 4, cost is a key concept that directly influences value creation. Value is defined as the perceived benefits, usefulness, and importance of a service, and cost (both the cost of service provision and the cost of consumption) is a core component of the value equation: Value = (Perceived Benefits + Outcomes) / (Cost + Risk). Understanding cost helps organizations and customers assess whether the service delivers sufficient value relative to the financial investment.

Warranty is the assurance that a service will meet agreed requirements (availability, capacity, continuity, security). The uptime guarantee is a warranty aspect. Utility addresses functionality.

Exception events indicate a failure or breach of threshold and require immediate action.

Warranty is the assurance that a service is 'fit for use' regarding availability, capacity, continuity, and security.

Standard changes are pre-approved and low risk, while normal changes require authorization through a change advisory board (CAB). Option A captures this distinction. Option B is incorrect because both can have defined procedures; Option C is incorrect because both may be scheduled; Option D is incorrect because both may affect services.

In ITIL 4, utility is defined as the functionality offered by a product or service to meet a specific need—often summarized as 'fit for purpose.' Warranty, on the other hand, ensures that the service will be available, with sufficient capacity, continuity, and security—summarized as 'fit for use.' Option D correctly captures this distinction, which is foundational to the ITIL Service Value System.

Option B is correct because detecting events is a core activity of Monitoring and Event Management, which involves identifying occurrences that are significant for the management of the IT infrastructure and services. This includes monitoring configuration items (CIs) and service components to generate events based on predefined thresholds or conditions.

The Organizations and People dimension of ITIL 4 specifically addresses the roles, responsibilities, culture, and competencies required to support the service value system. This dimension ensures that staff are properly structured, skilled, and empowered to execute processes and deliver services effectively.

The Information and Technology dimension is primarily responsible for the systems, data, and technology that handle personal data. Compliance with data protection regulations like GDPR or CCPA requires ensuring that data storage, encryption, access controls, and audit logging meet legal standards. This dimension directly governs the technical safeguards, such as encryption at rest (AES-256) and in transit (TLS 1.3), data masking, and retention policies, which are the core mechanisms for regulatory adherence.

In ITIL 4, Monitoring and Event Management defines three event types: Informational, Warning, and Exception. Informational events (option B) are routine notifications that indicate normal operations, such as a successful backup completion or a device powering on. They require no action but are logged for audit or trend analysis.

Emergency changes are for urgent situations that require immediate implementation to restore service. They have a separate, faster authorization process.

Outcome is the result for stakeholders; improved customer satisfaction is an outcome. Utility and warranty are attributes that contribute to the outcome.

These terms are essential for incident and problem management.

Engage is a core activity in the ITIL 4 service value chain because it represents the entry point for demand and stakeholder involvement. It ensures that the service provider understands the needs of customers and users, and manages relationships with all stakeholders to co-create value. Without Engage, there is no mechanism to capture requirements or feedback, making it essential for the value chain's operation.

Option C is correct because selecting and managing a cloud provider falls under Partners and Suppliers, focusing on contracts and security requirements.

The primary purpose of Incident Management is to restore normal service operation as quickly as possible and minimise the adverse impact on business operations.

The guiding principle 'Start where you are' emphasizes leveraging existing services, processes, and assets rather than building new ones from scratch.

Option A is correct because the Organisations and People dimension covers roles, responsibilities, culture, and communication.

The service desk serves as the single point of contact (SPOC) for users to report issues and request services.

Standard changes are pre-approved with a defined procedure.

The Continual Improvement practice ensures that IT services remain aligned with evolving business needs by systematically identifying and implementing improvements. This is the core purpose defined in ITIL 4, focusing on ongoing enhancement of services, processes, and capabilities rather than maintaining a static state.

Incident management begins with identification and logging, followed by categorization and prioritization, investigation, resolution, and closure.

Problem Management has three phases: Problem Identification, Problem Control (root cause analysis), and Error Control (known errors and workarounds). Option B is correct.

Keep it simple and practical advocates eliminating steps that do not add value. By removing non-value-adding approvals, the process is simplified.

Password resets are typically pre-approved, routine service requests, not incidents.

Neglecting the Partners and Suppliers dimension directly exposes the organization to supply chain disruptions because dependencies on external vendors for critical components or services are not managed. Without proper governance and contracts, a supplier's failure to deliver can halt IT operations, as seen in scenarios where a single-source provider for cloud infrastructure or hardware experiences an outage.

Option B is correct because sharing incident data between the service desk and the development team directly embodies 'Collaborate and promote visibility' by breaking down silos and making information visible across functions. This collaboration enables the development team to identify root causes and improve the product, which is a core application of the principle in ITIL 4.

Utility is the functionality offered by a product or service to meet a particular need. Warranty ensures the service will be available when needed. Output is a tangible deliverable; outcome is the result for a stakeholder.

Outputs enable outcomes; outcomes are the results for stakeholders. Option A describes the opposite. Option D is incorrect because different outputs can lead to the same outcome.