ITIL 4 Foundation — All Questions

According to ITIL 4, what is the purpose of the incident management practice?

• a.To authorize and control changes to services
• b.To minimize the negative impact of incidents by restoring normal service operation as quickly as possible✓
• c.To handle predefined user service requests
• d.To reduce the likelihood and impact of incidents by identifying root causes

The purpose of incident management is to minimize the negative impact of incidents by restoring normal service operation as quickly as possible. An incident is an unplanned interruption to a service or a reduction in its quality. The focus is on rapid restoration, which may involve a workaround, rather than on finding the underlying cause.

A recurring set of incidents shares an unknown underlying cause. Which practice is responsible for investigating and managing that cause, and how is the underlying cause classified?

• a.Change enablement; the cause is called a change
• b.Service request management; the cause is called a request
• c.Incident management; the cause is called an incident record
• d.Problem management; the underlying cause is a problem, and a documented cause with a workaround is a known error✓

Problem management reduces the likelihood and impact of incidents by identifying actual and potential causes of incidents and managing workarounds and known errors. A problem is a cause, or potential cause, of one or more incidents. Once a problem has been analyzed and a workaround or resolution is documented but not yet permanently resolved, it is recorded as a known error.

What is the purpose of the change enablement practice in ITIL 4?

• a.To provide a single point of contact between the provider and users
• b.To ensure that services meet agreed and measurable targets
• c.To restore normal service operation as quickly as possible
• d.To maximize the number of successful service and product changes by ensuring risks are properly assessed, changes are authorized, and change schedules are managed✓

Change enablement aims to maximize the number of successful IT changes by ensuring that risks have been properly assessed, authorizing changes to proceed, and managing the change schedule. A change is the addition, modification, or removal of anything that could have a direct or indirect effect on services. Change enablement balances the need to make beneficial changes against the need to protect customers and users from disruption.

Which statement correctly describes the service desk practice in ITIL 4?

• a.It investigates the root causes of incidents to prevent recurrence
• b.It authorizes and schedules all changes to the live environment
• c.It is the single point of contact between the service provider and its users, capturing demand for incident resolution and service requests✓
• d.It sets, monitors, and reviews measurable service level targets with customers

The purpose of the service desk practice is to capture demand for incident resolution and service requests, acting as the single point of contact between the service provider and its users. It plays an important role in shaping the user experience and how the provider is perceived. A good service desk also provides a clear path for users to report issues and make requests, and coordinates their resolution.

What is the purpose of the service request management practice?

• a.To identify the root causes of incidents
• b.To restore service after an unplanned interruption
• c.To authorize and schedule changes to the live environment
• d.To support the agreed quality of a service by handling all predefined, user-initiated service requests effectively and in a user-friendly manner✓

Service request management supports the agreed quality of a service by handling all predefined, user-initiated service requests in an effective and user-friendly manner. A service request is a request from a user, or their authorized representative, that is a normal part of service delivery — for example, a request for information, access, or a standard provision. Because these requests are predefined, they can be handled through standardized, often automated, procedures.

Which statement about the service level management practice is correct?

• a.It is the single point of contact for all user requests
• b.It exists mainly to restore normal service as quickly as possible
• c.It sets, monitors, and reviews measurable business-based service targets, with SLAs ideally related to defined outcomes rather than isolated operational metrics✓
• d.Its SLAs should be based only on isolated operational metrics such as server uptime

Service level management sets clear, business-based targets for service performance so that delivery can be assessed, monitored, and managed against them. It requires ongoing engagement with customers to understand and document their needs. Service level agreements should relate to defined business outcomes, not just isolated technical metrics, because a service can meet several individual metrics yet still fail to meet the customer's real needs.

Which question is the first step of the ITIL continual improvement model?

• a.How do we keep the momentum going?
• b.Did we get there?
• c.Take action
• d.What is the vision?✓

The continual improvement model provides a structured, repeatable approach with seven steps. The first step is 'What is the vision?', which links the improvement to the organization's vision and objectives. The remaining steps are: where are we now, where do we want to be, how do we get there, take action, did we get there, and how do we keep the momentum going. Starting with the vision keeps improvement aligned with strategic goals.

A change that is low-risk and pre-authorized, following a documented and well-understood procedure, is classified as which type of change?

• a.A normal change
• b.A known error
• c.A standard change✓
• d.An emergency change

Change enablement recognizes three types of change. A standard change is low-risk and pre-authorized, following a documented, well-understood procedure; the authorization is effectively built into the procedure so each instance does not need separate approval. A normal change must be scheduled, assessed, and authorized through a defined process, while an emergency change must be implemented as soon as possible, often with an expedited assessment.

In problem management, what is a 'known error'?

• a.An unplanned interruption to a service
• b.A request from a user for information or access
• c.A pre-authorized low-risk change
• d.A problem that has been analyzed and has a documented cause and workaround but has not yet been permanently resolved✓

A known error is a problem that has been analyzed but has not been resolved. By that point its cause is understood and a workaround may be documented, allowing the impact of related incidents to be reduced even though a permanent fix is still outstanding. Distinguishing problems, known errors, and incidents is a common ITIL 4 Foundation exam point.

During a major incident, the team applies a temporary workaround to restore service quickly rather than immediately finding the underlying cause. Which practice's aim does this reflect, and why is the cause not the immediate focus?

• a.Incident management, whose aim is to restore normal service operation as quickly as possible; identifying the underlying cause is the role of problem management✓
• b.Service request management, because the user requested help
• c.Change enablement, because a workaround is a type of change
• d.Service level management, because it defines uptime targets

Incident management aims to minimize the negative impact of incidents by restoring normal service operation as quickly as possible, which may mean applying a workaround. Finding and removing the underlying cause is the responsibility of problem management, a separate but related practice. Keeping these aims distinct lets the organization restore service fast while still addressing root causes over time.

Users call one number to report issues and make requests, and that team coordinates resolution and keeps users informed of progress. Which practice is being described?

• a.Problem management
• b.Change enablement
• c.Service level management
• d.The service desk✓

The service desk practice is the single point of contact between the service provider and its users. It captures demand for incident resolution and service requests, coordinates their handling, and keeps users informed. Because it is where users experience the provider directly, the service desk strongly shapes user satisfaction and how the provider is perceived.

ITIL 4 groups its 34 management practices into which three categories?

• a.Incident, problem, and change practices
• b.Plan, build, and run practices
• c.General management practices, service management practices, and technical management practices✓
• d.Strategic, tactical, and operational practices

ITIL 4 describes 34 management practices grouped into three categories: general management practices (adopted from general business, e.g. continual improvement and supplier management), service management practices (developed in service management, e.g. incident and change enablement), and technical management practices (adapted from technology management, e.g. deployment management). A practice is a set of organizational resources designed for performing work or accomplishing an objective.

In the change enablement practice, who or what is responsible for authorizing a change?

• a.The service desk agent who logs the change
• b.A change authority — the person or group with the authority to approve the change; for standard changes the authorization is built into the procedure✓
• c.The user who raised the related incident
• d.The problem manager, in every case

In change enablement, authorization of a change is the responsibility of a change authority — the person or group empowered to approve it. The appropriate change authority depends on the type, size, and risk of the change, and should be assigned to enable fast, effective decisions. For standard changes the authorization is effectively pre-approved within the documented procedure, so no separate approval is needed each time.

Which of the following is an example of a 'general management practice' in ITIL 4?

• a.Incident management
• b.Service desk
• c.Continual improvement✓
• d.Change enablement

General management practices are those adopted and adapted for service management from general business management domains. Continual improvement is one such practice, alongside examples like relationship management, supplier management, and information security management. By contrast, incident management, service desk, and change enablement are service management practices, which were developed within service management itself.

What is the purpose of the continual improvement practice?

• a.To align the organization's practices and services with changing business needs through ongoing improvement✓
• b.To be the single point of contact between the service provider and its users for incidents and requests
• c.To ensure that risks are assessed, changes are authorized, and change schedules are managed effectively
• d.To restore normal service operation as quickly as possible after an unplanned interruption to a service

The continual improvement practice aims to align the organization's practices and services with changing business needs through the ongoing identification and improvement of services, service components, practices, and any element involved in the management of products and services. It supports the improve value chain activity and uses the continual improvement model.

What is the purpose of the information security management practice?

• a.To capture demand for incident resolution and service requests as the single point of contact for users
• b.To protect the information needed by the organization to conduct its business✓
• c.To minimize the negative impact of incidents by restoring normal service operation as quickly as is possible
• d.To ensure the organization's suppliers and their performance are managed appropriately to support services

Information security management protects the information the organization needs to conduct its business. This includes understanding and managing risks to the confidentiality, integrity, and availability of information, as well as authentication and non-repudiation, so that information is appropriately safeguarded.

Confidentiality, integrity, and availability are central to which ITIL practice?

• a.Change enablement, which maximizes successful changes by assessing risk and authorizing changes appropriately
• b.Information security management✓
• c.Service request management, which handles predefined, user-initiated requests in an effective and user-friendly way
• d.Incident management, which is focused on restoring normal service operation as quickly as possible after an interruption

Information security management is concerned with protecting information, and confidentiality, integrity, and availability are its core goals, often extended to include authentication and non-repudiation. Managing risks to these properties is how the practice keeps the organization's information appropriately secure.

What is the purpose of the relationship management practice?

• a.To ensure that service components are available when and where needed and that they meet agreed specifications
• b.To restore normal service operation as quickly as possible whenever an unplanned interruption to a service occurs
• c.To establish and nurture links between the organization and its stakeholders at strategic and tactical levels✓
• d.To protect the information the organization needs, safeguarding its confidentiality, integrity, and availability

Relationship management establishes and nurtures the links between the organization and its stakeholders at strategic and tactical levels. It identifies, analyzes, monitors, and continually improves relationships with and between stakeholders, helping to balance conflicting needs and support the organization's objectives.

What is the purpose of the supplier management practice?

• a.To set clear, business-based targets for service performance so delivery can be assessed and managed against them
• b.To ensure the organization's suppliers and their performance are managed appropriately to support seamless service✓
• c.To reduce the likelihood and impact of incidents by identifying actual and potential causes of incidents
• d.To provide a single point of contact between the service provider and its users for incidents and requests

Supplier management ensures that the organization's suppliers and their performance are managed appropriately to support the seamless provision of quality products and services. It includes creating closer, collaborative relationships with key suppliers, managing contracts, and evaluating supplier performance.

Which practice is responsible for handling requests such as a user asking for access to an application or for information?

• a.Change enablement, which maximizes successful changes by ensuring risks are assessed and changes are authorized
• b.Incident management, whose focus is restoring normal service operation as quickly as possible after any interruption
• c.Service request management✓
• d.Problem management, which reduces the likelihood and impact of incidents by identifying their underlying causes

Service request management handles all predefined, user-initiated service requests — such as requests for information, access, or a standard provision — in an effective and user-friendly manner. Because these requests are a normal part of service delivery and are predefined, they can be handled through standardized procedures.

How does ITIL 4 define an 'incident'?

• a.The addition, modification, or removal of anything that could have a direct or indirect effect on services
• b.An unplanned interruption to a service, or a reduction in the quality of a service✓
• c.A request from a user that is a normal part of service delivery, such as a request for information or access
• d.A cause, or potential cause, of one or more interruptions to the organization's products and services

An incident is an unplanned interruption to a service or a reduction in the quality of a service. Incident management aims to minimize the negative impact of incidents by restoring normal operation as quickly as possible. Note the contrast with a problem (a cause of incidents) and a change (an addition, modification, or removal).

How does ITIL 4 define a 'problem'?

• a.A result for a stakeholder that is enabled by one or more of the outputs produced by an activity or a service
• b.A cause, or potential cause, of one or more incidents✓
• c.A request from a user, or their authorized representative, that is a normal, predefined part of service delivery
• d.An unplanned interruption to a service, or a reduction in the quality of a service experienced by users

A problem is a cause, or potential cause, of one or more incidents. Problem management investigates why incidents occur and works to reduce their likelihood and impact. This distinguishes a problem (the cause) from an incident (the interruption itself) and a known error (a problem that has been analyzed but not resolved).

Problem management typically works in three phases. Which is the correct set?

• a.Logging, categorization, and closure, performed exclusively by the service desk without any specialist involvement
• b.Problem identification, problem control, and error control✓
• c.Detection, diagnosis, and permanent elimination of every cause before any workaround may be used
• d.Evaluate, direct, and monitor, applied by the governing body to every problem raised across the organization

Problem management involves three phases: problem identification (detecting and logging problems), problem control (analyzing problems and documenting workarounds and known errors), and error control (managing known errors and identifying potential permanent resolutions). The evaluate-direct-monitor cycle belongs to governance, not problem management.

What is a 'known error' in problem management?

• a.A low-risk change that is pre-authorized and follows a documented, well-understood procedure without separate approval
• b.An unplanned interruption to a service that has just been reported by a user to the service desk for resolution
• c.A problem that has been analyzed but has not been resolved✓
• d.A predefined, user-initiated request that forms a normal part of routine service delivery for the organization

A known error is a problem that has been analyzed but has not been resolved. Its cause is understood and a workaround may be documented, which allows the impact of related incidents to be reduced even before a permanent fix is available. Distinguishing incidents, problems, and known errors is a common exam point.

What is a 'workaround' in the context of incident and problem management?

• a.A formal contract clause that transfers responsibility for resolving incidents to an external third-party supplier
• b.A pre-authorized, low-risk change that follows a documented and well-understood procedure and needs no separate approval
• c.A solution that reduces or eliminates the impact of an incident or problem for which a full resolution is not yet available✓
• d.A permanent removal of the underlying cause of a problem so that related incidents can never possibly recur again

A workaround is a solution that reduces or eliminates the impact of an incident or problem for which a full resolution is not yet available. Workarounds are often documented in known error records and may be used repeatedly to limit impact while a permanent solution is still being sought.

How does ITIL 4 define a 'change'?

• a.A request from a user, or their authorized representative, that is a normal part of routine service delivery
• b.An unplanned interruption to a service, or a reduction in the quality of a service, experienced by the organization
• c.A cause, or a potential cause, of one or more incidents affecting the organization's products and services
• d.The addition, modification, or removal of anything that could have a direct or indirect effect on services✓

A change is the addition, modification, or removal of anything that could have a direct or indirect effect on services. Change enablement manages changes to maximize the number of successful changes while protecting services from disruption. This definition is distinct from those of an incident, a problem, and a service request.

Change enablement recognizes three types of change. Which is the correct set?

• a.Planned changes, unplanned changes, and reactive changes categorized by whether they were scheduled in advance
• b.Standard changes, normal changes, and emergency changes✓
• c.Minor changes, major changes, and catastrophic changes categorized by their overall cost to the business
• d.Internal changes, external changes, and supplier changes categorized by who requested and implemented them

Change enablement recognizes three change types: standard changes (low-risk, pre-authorized, following a documented procedure), normal changes (scheduled, assessed, and authorized through a defined process), and emergency changes (implemented as soon as possible, often with an expedited assessment).

A change is low-risk, well understood, fully documented, and pre-authorized. Which type of change is it?

• a.A normal change
• b.A standard change✓
• c.An emergency change
• d.A known error

A standard change is low-risk, pre-authorized, and follows a documented, well-understood procedure. Because the authorization is effectively built into the procedure, each instance does not require separate approval. This contrasts with normal changes (individually assessed and authorized) and emergency changes (expedited).

A serious outage requires a fix to be implemented as fast as possible, with an expedited assessment and authorization. Which type of change is this?

• a.An emergency change✓
• b.A normal change
• c.A standard change
• d.A service request

An emergency change must be implemented as soon as possible, for example to resolve a serious outage. Its assessment and authorization are expedited, and a separate change authority (sometimes an emergency change advisory board) may be used, but documentation is typically still completed, often retrospectively.

In change enablement, who authorizes a normal change?

• a.The user who raised the related incident, who always has final authority to approve any change that affects them
• b.No one, because normal changes are pre-authorized in the same way that standard changes are pre-authorized
• c.The service desk agent who logged the change, since logging a change automatically confers the authority to approve it
• d.A change authority appropriate to the type, size, and risk of the change✓

Normal changes are authorized by a change authority appropriate to the type, size, and risk of the change. Assigning the right change authority — rather than routing every change to a single central board — enables faster, more effective decisions. Standard changes, by contrast, are pre-authorized within their procedure.

What is the purpose of the service desk practice?

• a.To ensure that suppliers and their performance are managed appropriately to support the provision of quality services
• b.To capture demand for incident resolution and service requests, and be the point of contact for users✓
• c.To reduce the likelihood and impact of incidents by identifying and managing their actual and potential causes
• d.To ensure that risks are assessed and that changes are authorized and scheduled appropriately across the organization

The purpose of the service desk practice is to capture demand for incident resolution and service requests. It is the single point of contact between the service provider and its users, and it plays a major role in shaping user experience and how the provider is perceived.

Which statement about the modern service desk is correct?

• a.A service desk is responsible for authorizing every change before it can be deployed into the live environment
• b.A service desk must always be physically located in one room and can never use any form of remote or automated channel
• c.A service desk deals only with major incidents and refuses all routine service requests from users of the organization
• d.A service desk need not be a physical location and may use many channels, including phone, portals, chat, and automation✓

A modern service desk does not need to be a single physical location; it can use a range of channels and technologies, including phone, self-service portals, chat, email, and automation. Its role is to capture demand for incident resolution and service requests and to coordinate their handling as the users' point of contact.

Why is the service desk considered important to how users perceive the service provider?

• a.Because it is the users' main point of contact, so their experience of it strongly shapes their overall perception✓
• b.Because the service desk sets the measurable service level targets that determine whether a provider is seen as reliable
• c.Because the service desk authorizes all changes, and users judge a provider mainly by how many changes it approves
• d.Because the service desk is responsible for identifying the root causes of every incident that users report to it

The service desk is the single point of contact between the provider and its users, so users experience the provider directly through it. A positive, efficient, and empathetic service desk strongly shapes user satisfaction and the overall perception of the provider, which is why the practice emphasizes user experience.

What is the purpose of the incident management practice?

• a.To maximize the number of successful changes by assessing risks and authorizing and scheduling changes appropriately
• b.To ensure the organization's suppliers and their performance are managed appropriately to support quality services
• c.To handle predefined, user-initiated service requests effectively and in a user-friendly and consistent manner
• d.To minimize the negative impact of incidents by restoring normal service operation as quickly as possible✓

Incident management aims to minimize the negative impact of incidents by restoring normal service operation as quickly as possible. This may involve applying a workaround rather than immediately finding the underlying cause, which is instead the concern of problem management.

What is the purpose of the problem management practice?

• a.To act as the single point of contact for users and to capture demand for incident resolution and service requests
• b.To reduce the likelihood and impact of incidents by identifying causes and managing workarounds and known errors✓
• c.To set, monitor, and review clear, measurable, business-based targets for the performance of services delivered
• d.To handle all predefined, user-initiated service requests effectively and in a consistent, user-friendly manner

Problem management reduces the likelihood and impact of incidents by identifying actual and potential causes of incidents, and by managing workarounds and known errors. It complements incident management: incident management restores service quickly, while problem management addresses the underlying causes over time.

How do incident management and problem management differ?

• a.They are the same practice under two different names and can be used interchangeably in any given situation
• b.Incident management addresses underlying causes, while problem management only restores service quickly for users
• c.Problem management authorizes changes, while incident management sets measurable business-based service targets
• d.Incident management restores normal service quickly, while problem management addresses the underlying causes✓

Incident management focuses on restoring normal service operation as quickly as possible, often via a workaround. Problem management focuses on the underlying causes of incidents to reduce their likelihood and impact over time. The two are distinct but closely linked practices, a frequently tested distinction.

What is the purpose of the change enablement practice?

• a.To restore normal service operation as quickly as possible following an unplanned interruption to a service
• b.To be the single point of contact for users and to capture demand for incident resolution and service requests
• c.To protect the information the organization needs by safeguarding its confidentiality, integrity, and availability
• d.To maximize successful service and product changes by ensuring risks are assessed and changes authorized✓

Change enablement aims to maximize the number of successful IT changes by ensuring that risks are properly assessed, authorizing changes to proceed, and managing the change schedule. It balances enabling beneficial changes against protecting customers and users from unnecessary disruption.

Which of the following is a 'service request'?

• a.An unplanned interruption to a service that has degraded its quality for many users at once
• b.A user's request for access to an application that is a normal part of service delivery✓
• c.The addition, modification, or removal of anything that could have a direct or indirect effect on services
• d.A cause, or potential cause, of one or more incidents that must be investigated and analyzed

A service request is a request from a user, or their authorized representative, that is a normal part of service delivery — such as a request for information, for access to a resource, or for a standard provisioning action. Service request management handles these predefined requests, distinct from incidents, problems, and changes.

Why can many service requests be fulfilled through standardized, often automated procedures?

• a.Because service requests are predefined and are a normal, expected part of service delivery✓
• b.Because service requests are unpredictable emergencies that must be improvised individually each time they arise
• c.Because service requests always involve high risk and therefore require a fixed, heavily controlled manual process
• d.Because service requests are actually a type of change and so must pass through the full change authorization process

Service requests are predefined and form a normal, expected part of service delivery, so their handling can be standardized and often automated. Establishing clear, repeatable workflows for common requests improves efficiency and user experience, which is a core aim of service request management.

Into which three categories does ITIL 4 group its 34 management practices?

• a.Incident practices, problem practices, and change practices, grouped by the type of record each one primarily handles
• b.General management practices, service management practices, and technical management practices✓
• c.Strategic practices, tactical practices, and operational practices, grouped by the organizational level at which they apply
• d.Mandatory practices, recommended practices, and optional practices, grouped by whether an organization must adopt them

ITIL 4 groups its 34 practices into three categories by their origin: general management practices (adopted from general business, e.g. continual improvement, supplier management), service management practices (developed within service management, e.g. incident management, change enablement), and technical management practices (adapted from technology management, e.g. deployment management).