Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
ITIL4F The Four Dimensions of Service Management Practice Question
Drag and drop the steps of the incident management process into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification & Logging, then Categorization & Prioritization, then Investigation, then Resolution, then Closure.
Incident management begins with identification and logging, followed by categorization and prioritization, investigation, resolution, and closure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification & Logging, then Categorization & Prioritization, then Investigation, then Resolution, then Closure.
Why this is correct
This is the correct order because incident management starts with logging the incident, then categorizing and prioritizing it, followed by investigation to find a workaround or root cause, implementing a resolution, and finally closing the incident.
- ✗
Identification & Logging, then Investigation, then Categorization & Prioritization, then Resolution, then Closure.
Why it's wrong here
Placing investigation before categorization and prioritization is inefficient and potentially risky in incident management. Without first assessing the incident's impact and urgency, critical issues might not receive the immediate attention they warrant, while minor issues could consume disproportionate resources. Categorization and prioritization are essential for directing investigative efforts effectively and aligning them with business needs and service level agreements.
- ✗
Categorization & Prioritization, then Identification & Logging, then Investigation, then Resolution, then Closure.
Why it's wrong here
This sequence is fundamentally flawed because an incident must first be formally identified and logged into the system before any subsequent actions, such as categorization or prioritization, can occur. Logging creates the official record and unique identifier, which is a prerequisite for all further management activities. Without a logged incident, there is no recognized event to categorize or prioritize, making the process unmanageable.
- ✗
Identification & Logging, then Categorization & Prioritization, then Resolution, then Investigation, then Closure.
Why it's wrong here
Attempting resolution before investigation is premature and often ineffective in incident management. Investigation is crucial for understanding the incident's nature, identifying its root cause or a viable workaround, and determining the most appropriate course of action. Resolving an incident without proper investigation risks applying incorrect fixes, leading to recurrence or further service disruption, thereby prolonging the impact on users.
Go deeper
Related to this question
About these practice questions
One of 531 original ITIL4F practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.