ITIL4F ITIL Management Practices Practice Question
An IT service desk analyst receives a call that users cannot access the CRM system. According to ITIL 4, what should the analyst do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log an incident record with the details provided by the user
The first action in ITIL 4 Incident Management is to log the incident. The analyst must record the details of the disruption to initiate the process. Therefore, Option A is correct. Option B (assign to problem management) is premature; Option C (send a service request) is incorrect because this is an incident, not a service request; Option D (search known error database) occurs after logging during investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Log an incident record with the details provided by the user
Why this is correct
Logging an incident record is the foundational first step in the ITIL 4 Incident Management practice. This action formally documents the disruption, captures essential details directly from the user, and creates a traceable record for all subsequent activities, including prioritization, diagnosis, and resolution. Without proper logging, effective tracking, communication, and management of the service disruption would be impossible, hindering timely restoration.
- ✗
Assign the issue to Problem Management for root cause analysis
Why it's wrong here
Assigning an issue directly to Problem Management is premature and bypasses critical initial steps in incident resolution. Problem Management focuses on identifying the root cause of recurring incidents or potential incidents, and typically begins after an incident has been logged, initially investigated, and potentially resolved, or when a trend of incidents indicates an underlying problem. The immediate priority for a live service disruption is incident logging and restoration, not necessarily root cause analysis.
- ✗
Send a service request to the infrastructure team
Why it's wrong here
Sending a service request is an inappropriate response to a service disruption where users "cannot" perform their work, as this clearly describes an incident, not a service request. Service requests are pre-defined, routine requests for information, advice, or access to a service, whereas an incident signifies an unplanned interruption or reduction in the quality of a service. Misclassifying an incident as a service request would lead to incorrect prioritization, inappropriate workflows, and delayed resolution.
- ✗
Search the known error database for a workaround
Why it's wrong here
While searching for a workaround in the known error database is a valuable step in incident resolution, it typically occurs during the diagnosis and investigation phase, after the incident has been formally logged. The immediate priority upon receiving a user call about a service disruption is to capture the details and create an official incident record. Attempting to find a solution before logging could lead to unrecorded work and a lack of proper incident tracking.
Go deeper
Related to this question
About these practice questions
One of 531 original ITIL4F practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.