ITIL4F ITIL Management Practices Practice Question
An IT service desk analyst receives a call that users cannot access the CRM system. The analyst verifies the issue and suspects it may be related to a recent change. What should the analyst do FIRST according to ITIL 4?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log an incident record and begin initial diagnosis
The first step is to log the disruption as an incident to initiate restoration of service, even if the cause is suspected to be a change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately reverse the recent change
Why it's wrong here
Immediately reversing a recent change without proper assessment or authorization bypasses the established Change Enablement practice. Such an action could introduce new risks, fail to resolve the actual incident, or even exacerbate the situation by creating further unplanned disruptions. ITIL 4 advocates for controlled changes, even for emergency reversals, which should still follow a streamlined, but documented, process.
- ✗
Create a service request to restore access
Why it's wrong here
Creating a service request is inappropriate because service requests are specifically for fulfilling pre-defined, standard user requests for services or information, such as requesting a new software license or a password reset. An unplanned interruption to service, like users being unable to access a system, constitutes an incident, which requires a distinct process focused on restoring service operation quickly.
- ✓
Log an incident record and begin initial diagnosis
Why this is correct
Logging an incident record and initiating initial diagnosis is the correct first step because ITIL 4 defines an incident as an unplanned interruption to a service or a reduction in the quality of a service. The primary objective of Incident Management is to restore normal service operation as quickly as possible, and logging the incident ensures it is tracked, prioritized, and managed effectively from the outset. Initial diagnosis is crucial for understanding the immediate impact and potential resolution.
- ✗
Log a problem record to investigate the root cause
Why it's wrong here
Logging a problem record prematurely is incorrect because Problem Management focuses on identifying the root causes of incidents to prevent recurrence, rather than immediately restoring service. While a problem might exist, the immediate priority for an unplanned service interruption is to manage it as an incident to restore service functionality. Problem investigation typically commences after an incident is resolved or when a trend of recurring incidents is identified.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ITIL4F question from scratch — 531 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.