What Should You Do First When Users Cannot Access a System?
An IT service desk analyst receives a call that users cannot access the CRM system. What should the analyst do FIRST according to ITIL 4?
Quick Answer
The correct first step is to log an incident record to restore service as quickly as possible. In ITIL 4, an incident is defined as any unplanned interruption or reduction in quality of an IT service, and the primary goal of incident management is to restore normal service operation with minimal business impact. When users cannot access a system, the service desk analyst must immediately capture the details by logging an incident, which triggers the restoration process. On the ITIL 4 Foundation exam, this question tests your understanding of the incident management practice versus problem management, change management, or service requests—a common trap is confusing incident logging with problem investigation, which happens only after incidents are resolved. Remember the memory tip: “When access breaks, log it for service’s sake.”
⚠ Common exam trap
Test-takers frequently confuse incident management with problem management, mistakenly thinking that finding the root cause is the first step, when ITIL 4 explicitly mandates restoring service first before investigating underlying causes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log an incident record to restore service as quickly as possible
According to ITIL 4, the primary goal of incident management is to restore normal service operation as quickly as possible and minimize the adverse impact on business operations. When users cannot access the CRM system, the analyst's first action must be to log an incident record, capturing details such as the number of affected users, error messages, and timestamps, to initiate the restoration process. This aligns with the ITIL 4 guiding principle of 'Focus on Value' by prioritizing service recovery over root cause analysis or configuration changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Request a change to the CRM system configuration
Why it's wrong here
A change request might be needed later, but the immediate action is to log an incident.
- ✓
Log an incident record to restore service as quickly as possible
Why this is correct
Incidents are logged to restore normal service operation.
- ✗
Investigate the root cause of the CRM failure
Why it's wrong here
Investigating the root cause of the CRM failure is a problem-management activity, whereas the first action for a service desk analyst must be to restore the service by applying a workaround or escalating the incident. This option is tempting because root-cause analysis is essential for preventing recurrence, and it would be correct if the question asked what the analyst should do after the incident has been resolved and the service restored.
- ✗
Submit a service request to grant access
Why it's wrong here
This is an unplanned disruption, not a pre-approved service request.
Go deeper
Related to this question
About these practice questions
This ITIL4F question is part of Courseiva's 531-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ITIL4F
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IT service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
medium- A.Escalate the call to the vendor immediately.
- B.Analyze the root cause of the problem.
- C.Submit a change request to modify the CRM system.
- ✓ D.Log an incident record and attempt to restore service.
Why D: According to ITIL 4, the first priority when a service is unavailable is to restore normal service operation as quickly as possible. Logging an incident record ensures the issue is formally tracked, and attempting to restore service aligns with the 'incident management' practice's primary goal of minimizing business impact. This is the correct first step before any root cause analysis or escalation.
Variation 2. An IT service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
medium- ✓ A.Log an incident record and attempt to restore service
- B.Escalate the call to the problem management team
- C.Submit a change request to modify the CRM system
- D.Investigate the root cause of the issue
Why A: According to ITIL 4, the first action when a service disruption is reported is to log an incident record and attempt to restore service as quickly as possible. This aligns with the incident management practice, which prioritizes minimizing business impact over root cause analysis. The analyst should immediately create an incident ticket and apply a workaround or fix to restore CRM access.
Variation 3. A service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
medium- A.Raise a problem record to investigate the root cause
- ✓ B.Log an incident and attempt to restore service
- C.Submit a change request to modify the CRM system
- D.Inform the line manager of the issue
Why B: According to ITIL 4, the first priority when a service is unavailable is to restore normal service operation as quickly as possible. The service desk analyst must log an incident (a record of an unplanned interruption) and attempt to restore the CRM system access, which aligns with the incident management practice. This immediate action minimizes business impact, whereas root cause analysis or changes come later.
Variation 4. An IT service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
medium- ✓ A.Log an incident and attempt to restore service
- B.Submit a change request to modify the system
- C.Create a problem record to investigate the root cause
- D.Escalate to the vendor as a service request
Why A: The first step is to log an incident to restore service as quickly as possible.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.