Quick Answer
The answer is to log an incident record and attempt to restore service. This is the correct first step in incident management because ITIL 4 prioritizes minimizing business impact by restoring normal service operation as quickly as possible; logging the incident ensures formal tracking and accountability, while the immediate attempt to restore service—such as restarting the CRM server or checking database connectivity—directly addresses the disruption. On the ITIL 4 Foundation exam, this question tests your understanding of the incident management practice’s core objective: speed of recovery over root-cause analysis. A common trap is choosing “identify the root cause” or “escalate to second-level support,” but remember that diagnosis and escalation come after the initial restoration attempt. Memory tip: think “Log and Launch”—first log the record, then launch a fix to get users back to work.
This ITIL4F practice question tests your understanding of itil service value system. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Start a problem investigation to find the root cause
Why wrong: Problem management comes after incident logging.
Submit a change request to fix the system
Why wrong: Change requests are for planned modifications.
Escalate to second-level support immediately
Why wrong: Escalation is not the first step; the incident must be logged.
Log an incident record and attempt to restore service
Incident management's first action is to log and restore.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Log an incident record and attempt to restore service
According to ITIL 4, the first priority when a service disruption is reported is to restore normal service operation as quickly as possible. Logging an incident record ensures the issue is formally tracked, and attempting to restore service (e.g., by restarting the CRM application server or checking database connectivity) aligns with the incident management practice's objective of minimizing business impact.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Start a problem investigation to find the root cause
Why it's wrong here
Problem management comes after incident logging.
Submit a change request to fix the system
Why it's wrong here
Change requests are for planned modifications.
Escalate to second-level support immediately
Why it's wrong here
Escalation is not the first step; the incident must be logged.
Log an incident record and attempt to restore service
Why this is correct
Incident management's first action is to log and restore.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
PeopleCert often tests the misconception that problem management (root cause analysis) should be initiated immediately upon a service outage, but ITIL 4 explicitly separates incident management (restore service) from problem management (prevent recurrence).
Detailed technical explanation
In ITIL 4, incident management is part of the Service Value System's 'engage' and 'obtain/build' value chain activities, where the service desk acts as the single point of contact. The first action involves capturing the incident details (e.g., user ID, timestamp, error message) and performing initial triage—such as pinging the CRM server or checking the application event log—before escalating. This aligns with the ITIL guiding principle of 'focus on value' by prioritizing business continuity over root cause analysis.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A practitioner preparing for the ITIL4F exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
ITIL Service Value System — study guide chapter
Learn the concepts, then practise the questions
ITIL Service Value System practice questions
Targeted practice on this topic area only
All ITIL4F questions
1,040 questions across all exam domains
ITIL 4 Foundation study guide
Full concept coverage aligned to exam objectives
ITIL4F practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise ITIL4F questions linked to The Four Dimensions of Service Management.
Practise ITIL4F questions linked to The ITIL Service Value System.
Practise ITIL4F questions linked to ITIL Service Value System.
Practise ITIL4F questions linked to ITIL Guiding Principles.
Practise ITIL4F questions linked to Four Dimensions of IT Service Management.
Practise ITIL4F questions linked to Key Concepts of ITIL 4.
Practise ITIL4F questions linked to ITIL Management Practices.
Practise ITIL4F questions linked to Key Concepts of IT Service Management.
Practise ITIL4F questions linked to ITIL4F fundamentals.
Practise ITIL4F questions linked to ITIL4F scenario.
Practise ITIL4F questions linked to ITIL4F troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
ITIL Service Value System — This question tests ITIL Service Value System — Read the scenario before looking for a memorised answer..
The correct answer is: Log an incident record and attempt to restore service — According to ITIL 4, the first priority when a service disruption is reported is to restore normal service operation as quickly as possible. Logging an incident record ensures the issue is formally tracked, and attempting to restore service (e.g., by restarting the CRM application server or checking database connectivity) aligns with the incident management practice's objective of minimizing business impact.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IT service desk analyst receives a call that users cannot access the CRM system. What should they do FIRST according to ITIL 4?
mediumWhy C: The first action when a service disruption is reported is to log an incident. This ensures the issue is captured and can be prioritized for restoration. Option B is correct because the immediate step is to record the incident. Option A (update the known error database) is premature; a known error is identified after problem investigation. Option C (initiate problem management) is a later step after incidents are managed. Option D (implement a workaround) may be done after diagnosis, not first.
Variation 2. An IT service desk analyst receives multiple calls that users cannot access the CRM system after a scheduled maintenance. According to ITIL 4, what should the analyst do FIRST?
mediumWhy A: The first step is to log an incident to restore service. Problem management comes later, and change requests are for planned modifications.
Variation 3. A service desk analyst receives multiple calls that users cannot print to network printers. After verifying that the print servers are online, the analyst checks if a recent change to printer drivers is the cause. What should the analyst do FIRST according to ITIL 4?
hardWhy D: According to ITIL 4, when users report service interruptions (inability to print), each affected user represents a separate incident that must be logged individually to track service impact, prioritize resolution, and maintain accurate metrics. The analyst has already verified print servers are online and suspects a driver change, but the immediate first step is to log incidents for each user to capture the scope of the outage before proceeding with investigation or remediation.
Last reviewed: Jun 30, 2026
This ITIL4F practice question is part of Courseiva's free PeopleCert certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4F exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.