CCNA ITIL Management Practices Questions

Utility is 'fit for purpose' (does the service meet the required function?), while warranty is 'fit for use' (is the service available, secure, and reliable?).

Service Request Management uses the service catalogue to offer standardized, pre-approved requests.

First Call Resolution (FCR) is a key metric for the Service Desk because it directly measures the percentage of incidents resolved during the first contact with the user, without the need for escalation or a callback. A high FCR indicates an efficient and knowledgeable Service Desk, reducing user downtime and operational costs. This metric is central to ITIL's focus on delivering value and minimizing disruption to business activities.

The Service Desk provides a single point of contact for users to report issues, ask questions, and request services.

Incident Management focuses on restoring service; Problem Management focuses on finding root causes. Problem Management may use workarounds from known errors.

The change order was approved based on the original scope, which did not include a reboot. The discovery that a reboot is required introduces a new risk (application outage) that was not assessed during the initial approval. The IT manager, as the change authority, must be informed and make a decision on whether to proceed with the change under the new circumstances, in line with the ITIL 4 'change enablement' practice of managing risk and ensuring authorized decisions.

Option A is correct because identifying and documenting configuration items (CIs) is a foundational activity of Service Configuration Management. It ensures that all components of the IT infrastructure, including hardware, software, and documentation, are uniquely identified and recorded in the configuration management database (CMDB) to support control and traceability.

The Service Desk practice is explicitly defined in ITIL 4 as the single point of contact (SPOC) between the service provider and all users. Its primary purpose is to capture, manage, and resolve service requests and incidents, ensuring users have a consistent entry point for all interactions with IT services.

The scenario describes moving incident resolution tasks from higher-level support tiers to the service desk, which is the essence of 'shift-left' in ITIL 4. By empowering the service desk with better tools, knowledge, and authority, incidents are resolved earlier in the support chain, improving first-level resolution rates and reducing escalation costs. This directly applies the shift-left principle, not just a general improvement or channel strategy.

Utility is 'fit for purpose' (does it do what it should?), while warranty is 'fit for use' (is it available, secure, etc.?).

First Call Resolution (FCR) is the most appropriate metric because it directly measures whether the analyst resolved the issue during the initial contact without escalation or follow-up. Following a script to resolve a user's issue on the first call demonstrates effective adherence to standardized procedures and minimizes customer effort, which is the core purpose of FCR in ITIL 4.

Standard changes are pre-authorized and follow a defined, low-risk procedure, such as applying a routine security patch or provisioning a new user account. They do not require additional approval because the risk is well-understood and the implementation steps are documented in a standard operating procedure (SOP). This aligns with ITIL 4's definition of a standard change as a change that is fully documented, low risk, and can be implemented without a formal change advisory board (CAB) meeting.

Option A is correct because the Supplier Management practice's primary purpose is to ensure that suppliers and the services they provide are managed appropriately to meet business needs. This includes overseeing supplier performance, contracts, and relationships to align with organizational objectives. The practice focuses on the overall governance and control of supplier engagements, not just specific activities like auditing or target setting.

Capacity and Performance Management ensures services meet demand. Option B is correct. Option A is about availability; Option C is about configuration; Option D is about assets.

The Service Desk practice is defined in ITIL 4 as the single point of contact (SPOC) between the service provider and users for all operational interactions. This ensures that users have a clear, consistent entry point for reporting incidents, submitting service requests, and seeking guidance. Omnichannel communication is also a key component because modern service desks must support multiple channels (phone, email, chat, portal) while maintaining a unified interaction history and consistent service quality.

Incidents are disruptions; problems are the underlying causes of one or more incidents.

Enhancing Information Security Management (ISM) directly improves an organization's ability to detect and respond to security incidents because ISM defines the policies, controls, and monitoring mechanisms (e.g., SIEM rules, intrusion detection signatures, and incident response playbooks) that enable proactive threat detection and structured response. While Incident Management handles the lifecycle of an incident once detected, ISM is the practice that establishes the security posture and detection capabilities in the first place.

Normal changes require assessment and authorization but are not pre-approved like standard changes.

A known error is documented when the root cause is identified and a workaround exists; it is part of Problem Management's error control phase.

Continual improvement uses the improvement register, follows the 7-step model, and aims to align services with business needs.

According to ITIL 4, when users cannot access a service like a CRM system, the first action is to log an incident and attempt to restore service as quickly as possible, typically using a known workaround. This aligns with the incident management practice, which prioritizes minimizing business impact over immediate root cause analysis. Option C correctly follows this by logging the incident and applying a workaround to restore access.

Option D is correct because Problem Management is the ITIL 4 practice specifically designed to manage the lifecycle of all problems. Its core activities are problem identification (detecting and logging problems), problem control (analyzing and documenting workarounds and root causes), and error control (managing known errors through the lifecycle until a permanent resolution is implemented).

Key Performance Indicators (KPIs) are metrics used to evaluate the success of an activity. First Call Resolution (FCR) and Customer Satisfaction Score (CSAT) are examples of KPIs, not metrics themselves.

Exception events indicate a failure or breach of threshold and require immediate action.

Standard changes are pre-approved and low risk, while normal changes require authorization through a change advisory board (CAB). Option A captures this distinction. Option B is incorrect because both can have defined procedures; Option C is incorrect because both may be scheduled; Option D is incorrect because both may affect services.

Option B is correct because detecting events is a core activity of Monitoring and Event Management, which involves identifying occurrences that are significant for the management of the IT infrastructure and services. This includes monitoring configuration items (CIs) and service components to generate events based on predefined thresholds or conditions.

In ITIL 4, Monitoring and Event Management defines three event types: Informational, Warning, and Exception. Informational events (option B) are routine notifications that indicate normal operations, such as a successful backup completion or a device powering on. They require no action but are logged for audit or trend analysis.

Emergency changes are for urgent situations that require immediate implementation to restore service. They have a separate, faster authorization process.

The primary purpose of Incident Management is to restore normal service operation as quickly as possible and minimise the adverse impact on business operations.

The service desk serves as the single point of contact (SPOC) for users to report issues and request services.

Standard changes are pre-approved with a defined procedure.

The Continual Improvement practice ensures that IT services remain aligned with evolving business needs by systematically identifying and implementing improvements. This is the core purpose defined in ITIL 4, focusing on ongoing enhancement of services, processes, and capabilities rather than maintaining a static state.

Problem Management has three phases: Problem Identification, Problem Control (root cause analysis), and Error Control (known errors and workarounds). Option B is correct.

In ITIL 4, change types are categorized as standard, normal, and emergency. A normal change (B) is a change that is not standard or emergency and must follow the full change management process, including assessment, authorization, and scheduling. This is a core definition in the ITIL 4 framework.

An output is a tangible deliverable, while an outcome is the result for the stakeholder. Option A is correct. Option B reverses the definitions; Option C is about utility vs warranty; Option D is incorrect.

In the Monitoring and Event Management practice, an event is any change of state that has significance for the management of a service or configuration item. Option C is correct because a server CPU utilization exceeding a threshold is a predefined condition that triggers an event, often an 'alert' or 'warning' event, which is automatically detected by monitoring tools (e.g., SNMP traps, Prometheus alerts) and requires attention or automated response.

Change Enablement involves a Change Authority (who approves changes) and a Change Manager (who oversees the process). The Service Desk Manager is not necessarily involved.

Availability Management is responsible for ensuring services are available as agreed in SLAs.

Standard changes are low-risk, pre-approved, and follow a defined procedure.

First Contact Resolution (FCR) is a key performance indicator for service desks, measuring how often issues are resolved during the initial contact without escalation.

Continual Improvement includes defining improvement initiatives, using the improvement register, and applying the ITIL continual improvement model. Options A, B, and D are correct. Option C is part of Service Level Management; Option E is part of Monitoring and Event Management.

Capacity and Performance Management is the correct practice because it specifically focuses on ensuring that services achieve agreed and expected performance levels, including during peak demand periods. This practice involves monitoring current usage, forecasting future demand, and planning capacity to meet service level targets, making it directly responsible for performance under load.

First-call resolution (FCR) is the ITIL 4 metric that directly measures the percentage of incidents resolved during the initial contact with the service desk, without escalation or callbacks. Improving FCR reduces operational costs and enhances user satisfaction by eliminating the need for follow-up interactions, which aligns precisely with the company's goal of improving its service desk's first-call resolution rate.

The first step is to log the incident, which captures details and initiates the incident management process.

Problem Management is responsible for managing the lifecycle of all problems, including updating the Known Error Database (KEDB) with workarounds. After a major incident is resolved, the workaround is documented in the KEDB by Problem Management to prevent future incidents and enable faster resolution. This aligns with ITIL 4's definition of Problem Management as the practice that identifies, analyzes, and documents known errors and workarounds.

The SVS includes guiding principles, governance, service value chain, practices, and continual improvement.

Monitoring and Event Management detects events, classifies them (informational, warning, exception), and responds appropriately.

Informational, warning, and exception are the three event types recognized in ITIL 4.

IT Asset Management (ITAM) is the correct practice because it is specifically defined in ITIL 4 to manage the lifecycle of all IT assets, including their financial aspects such as procurement, depreciation, and disposal. This practice ensures that assets are accounted for, controlled, and optimized from acquisition to retirement, directly covering financial management of hardware, software, and licenses.

Error control, part of Problem Management, manages known errors through their lifecycle.

The 'Start where you are' guiding principle in ITIL 4 directs organizations to leverage existing services, processes, and data rather than building from scratch. It avoids unnecessary complexity by assessing current capabilities and making incremental improvements, which aligns with minimizing waste and rework.

Change Enablement defines three change types: standard, normal, and emergency.

Shift-left in the service desk involves empowering front-line staff with better tools, knowledge, and automation to resolve issues at the first point of contact. This directly increases first contact resolution (FCR) rates because technicians can handle more incidents without escalating. Higher FCR reduces the number of incidents that need to be passed to higher-level support, which is the second correct benefit.

Service requests are predefined, pre-approved, and follow a standard process, unlike incidents which are unplanned.

The monitoring system that sends alerts when CPU usage exceeds 90% directly involves detecting and responding to operational events. This is the core function of the Monitoring and Event Management practice, which defines how events (such as threshold breaches) are captured, analyzed, and acted upon. The alert itself is an 'event' in ITIL 4 terms, making this practice primarily responsible.

Password resets are pre-approved, routine requests, so they are service requests.

Change Enablement is the ITIL 4 practice that provides the formal, controlled process for assessing, approving, and scheduling changes to IT services. It ensures that all changes are evaluated for risk, and that the change schedule is maintained, which directly addresses the change manager's requirements.

Service Configuration Management is responsible for managing CIs and the CMDB, including configuration baselines.

The Service Level Management practice is specifically defined in ITIL 4 to negotiate, agree, and monitor service level agreements (SLAs). It ensures that service targets are documented, measured, and reviewed, aligning service delivery with business expectations. This practice directly manages the lifecycle of SLAs, including their creation, ongoing monitoring, and periodic review.

The first step is to log and categorize the incident to initiate the incident management process and begin restoration of service.

Problem Management includes problem identification, root cause analysis, and known error management. Options A, B, and C are correct. Option D is Incident Management; Option E is Change Enablement.

A new laptop request is a predefined, pre-approved service request if it follows standard procedures. Option D is correct. It is not an incident (unplanned interruption), a problem (root cause), or an emergency change.

Change Enablement includes assessing, authorizing, and scheduling changes (A) and ensuring changes are reviewed after implementation (E). Options B and D relate to Incident Management. Option C relates to Service Level Management.

A Known Error is created during error control after root cause analysis is completed and a workaround is identified.

An OLA supports the SLA by defining internal targets that help meet the SLA.