I85PREP
⌘ K
ITIL 4 IM study materials
ITIL 4 IM study resources

ITIL 4 IM practice questions

One question at a time. Build your ITIL 4 IM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident management concepts and definitions

In ITIL 4, which statement best defines an incident?

  1. An unplanned interruption to a service or a reduction in the quality of a service Correct answer.
  2. A planned change to a configuration item that has been approved by the change authority
  3. A request from a user for something new such as access to an application
  4. A recurring problem with an unknown root cause that requires investigation

Explanation

ITIL 4 defines an incident as an unplanned interruption to a service or a reduction in the quality of a service. The definition is deliberately broad so that degraded performance, not only full outages, is handled through incident management. Planned changes and service requests follow separate practices.

Question 2Incident management concepts and definitions

Which outcome is the primary purpose of the incident management practice?

  1. To record all configuration items and their relationships in the configuration management database
  2. To forecast future demand for services and plan capacity accordingly
  3. To minimize the negative impact of incidents by restoring normal service operation as quickly as possible Correct answer.
  4. To identify the root cause of every incident before any recovery action is taken

Explanation

Incident management focuses on minimizing negative impact by returning service to normal operation as quickly as possible. Root cause analysis belongs primarily to problem management, and it does not have to precede recovery. Speed of restoration, not depth of diagnosis, drives the practice.

Question 3Incident management concepts and definitions

A monitoring tool detects that a payment service is responding but with response times five times slower than normal. How should this be classified under ITIL 4?

  1. As a change, because the service behaviour differs from its baseline
  2. As a service request, because users can still complete payments
  3. As an incident, because the quality of the service has been reduced Correct answer.
  4. As a problem, because the cause of the slowdown is not yet known

Explanation

The ITIL 4 definition covers both unplanned interruptions and reductions in service quality. A severe slowdown that degrades the service therefore qualifies as an incident even though the service is still available. An unknown cause does not by itself make the event a problem; classification depends on what is being managed.

Question 4Incident management concepts and definitions

Which item should be managed as an incident rather than as a service request?

  1. A team asking for a new report to be added to a dashboard
  2. An employee requesting access to a shared drive
  3. A new starter asking for a laptop to be provisioned
  4. A user whose email client crashes every time it is opened after a recent update Correct answer.

Explanation

A crashing email client is an unplanned interruption to a service and is therefore an incident. Requests for new equipment, access, or new functionality are service requests because they are normal, expected demands. The distinguishing factor is whether something that should work has failed or degraded.

Question 5Incident management concepts and definitions

What is a 'major incident' in ITIL 4 terminology?

  1. An incident with significant business impact that requires a separate, prioritized handling approach Correct answer.
  2. Any incident that affects more than one user and is logged outside business hours
  3. An incident that has been escalated to the problem management practice for root cause analysis
  4. An incident that has remained open for longer than the agreed resolution target

Explanation

A major incident is one with significant business impact that is managed through a distinct, high-priority procedure. Organizations define their own thresholds, often in terms of affected users, revenue, or regulatory exposure. It is not defined by elapsed time, user count alone, or by being handed to problem management.

Question 6Incident management concepts and definitions

In ITIL 4, what is the difference between an incident and a problem?

  1. An incident is always more severe than a problem and always takes priority over it
  2. An incident is logged by users, whereas a problem can only be raised by the service desk manager
  3. An incident is closed only after a problem record is created for it
  4. An incident is a live disruption, whereas a problem is a cause, or potential cause, of one or more incidents Correct answer.

Explanation

A problem is defined as a cause, or potential cause, of one or more incidents. Incidents are the observable disruptions or degradations that affect users and services. The two are related but distinct records, and neither is defined by severity or by who raises it.

Question 7Incident management concepts and definitions

Which role typically owns the incident management practice and is accountable for its effectiveness and continual improvement?

  1. The customer who reported the most recent major incident
  2. The change authority that approves standard changes
  3. The service desk analyst who handles the most tickets
  4. The practice owner for incident management Correct answer.

Explanation

Every ITIL 4 practice has a practice owner who is accountable for the practice's effectiveness and ongoing improvement. Individual analysts, approvers, and customers perform roles within processes but do not own the practice. Ownership is a defined accountability rather than a by-product of workload.

Question 8Incident management concepts and definitions

Which statement correctly describes the relationship between incident management and the service value chain?

  1. Incident management is only relevant to the 'design and transition' value chain activity
  2. Incident management activities may be performed in several value chain activities, including engage, deliver and support, and improve Correct answer.
  3. Incident management is confined exclusively to the 'obtain/build' value chain activity
  4. Incident management replaces the need for the 'plan' value chain activity during disruptions

Explanation

Incident management is a practice, not a single value chain step, and its activities span multiple value chain activities. Engaging users, delivering and supporting services, and improving based on incident trends are all involved. Practices are combined with value chain activities to form value streams.

Question 9Incident management concepts and definitions

A service desk analyst resolves a user's incident using a documented workaround that restores service but does not fix the underlying fault. What is the correct next step?

  1. Close the incident and, if the underlying cause warrants it, ensure a problem record is raised Correct answer.
  2. Convert the incident into a change request and assign it to the change authority
  3. Reopen the incident and reclassify it as a major incident
  4. Leave the incident open indefinitely until a permanent fix is deployed

Explanation

Restoring service through a workaround satisfies the incident management objective, so the incident can be closed. The unresolved underlying cause may then be addressed through problem management. Keeping incidents open indefinitely distorts reporting and delays value to users.

Question 10Incident management concepts and definitions

What is a workaround in incident management?

  1. A temporary way to reduce or eliminate the impact of an incident when a full resolution is not yet available Correct answer.
  2. A record used to track the cost of resolving an incident
  3. A permanent fix applied to the configuration item that caused the incident
  4. A formal request to change a service so that it meets a new requirement

Explanation

A workaround reduces or removes the impact of an incident while the underlying cause remains unresolved. It is temporary by nature and is often documented so that future occurrences can be handled faster. It is distinct from a permanent fix, which addresses the cause itself.

Question 11Incident management concepts and definitions

Why does ITIL 4 emphasize prioritizing incidents by business impact rather than by the order in which they are reported?

  1. Because users who report first are usually reporting low-severity issues
  2. Because reporting order is never recorded accurately in ticketing systems
  3. Because first-in-first-out ordering is prohibited by the incident management practice
  4. Because impact-based prioritization directs limited resources to the incidents that threaten the most valuable services or users Correct answer.

Explanation

Impact-based prioritization ensures that scarce resources are applied where they protect the most business value. ITIL 4 practices are flexible and do not prohibit any ordering scheme, but they do recommend aligning effort with impact and urgency. Prioritization is a judgement about value, not about ticket timestamps.

Question 12Incident management concepts and definitions

Which combination best reflects how ITIL 4 suggests incidents should be prioritized?

  1. Reporter seniority and department
  2. Impact and urgency Correct answer.
  3. Ticket age and number of reassignments
  4. Cost and duration

Explanation

ITIL guidance links priority to impact (how much the incident affects business outcomes) and urgency (how quickly the impact will become significant). Together these determine how quickly the incident should be addressed. Cost, seniority, and ticket age are not the primary determinants.

Question 13Incident management concepts and definitions

A user calls the service desk to report that a critical finance application is unavailable during month-end close. The service desk cannot resolve it and routes it to the application support team. Which concept does this describe?

  1. Service request fulfilment
  2. Problem management
  3. Functional escalation Correct answer.
  4. Hierarchic escalation

Explanation

Functional escalation moves an incident to a team with greater technical expertise or specialist knowledge. Hierarchic escalation, by contrast, involves raising the incident to higher levels of management. Routing to application support is a transfer of technical capability, so it is functional escalation.

Question 14Incident management concepts and definitions

When does hierarchic escalation of an incident typically occur?

  1. When the user has submitted the same request more than once
  2. When the incident is not progressing, is at risk of breaching targets, or has major business impact Correct answer.
  3. When the incident is a standard service request that needs approval
  4. When the incident requires technical skills held by a different support team

Explanation

Hierarchic escalation raises an incident to higher levels of management, usually because of risk, stalled progress, or significant business impact. It is about authority and visibility rather than technical capability. Functional escalation, in contrast, brings in specialist skills.

Question 15Incident management concepts and definitions

Which statement best captures the ITIL 4 relationship between incident management and the 'swarming' way of working?

  1. Swarming brings together the people with the right skills to collaborate on an incident rather than passing it sequentially between tiers Correct answer.
  2. Swarming replaces the need for any incident categorization or prioritization
  3. Swarming requires that every incident be assigned to a single named individual until closure
  4. Swarming is only permitted for major incidents and is prohibited for minor ones

Explanation

Swarming is a collaborative approach in which people with relevant skills work together on an incident instead of escalating it step by step through tiers. It complements, rather than replaces, categorization and prioritization. ITIL 4 treats it as a flexible way of organizing work rather than a rigid rule.

Question 16Incident management concepts and definitions

Which metric is most directly aligned with the core purpose of incident management?

  1. The number of changes rejected by the change authority
  2. The number of problems closed with a confirmed root cause
  3. The number of configuration items registered in the CMDB
  4. The percentage of incidents resolved within agreed resolution targets Correct answer.

Explanation

Because incident management aims to restore service quickly, the proportion of incidents resolved within agreed targets is a direct indicator of its effectiveness. Change rejection rates, CMDB counts, and problem closure relate to other practices. Metrics should reflect the purpose of the practice being measured.

Question 17Incident management concepts and definitions

A single underlying database fault is generating hundreds of separate user-reported incidents. What is the most appropriate action from an incident and problem management perspective?

  1. Link the incidents to a single problem record so the underlying cause is investigated once Correct answer.
  2. Close all incidents without action because the fault is already known
  3. Treat each user report as an independent major incident
  4. Reclassify all the reports as service requests to reduce the incident count

Explanation

When many incidents share a cause, linking them to one problem record allows the cause to be investigated once and avoids duplicated effort. Individual incidents may still be handled for restoration, but the cause is managed centrally. Reclassifying genuine failures as service requests would misrepresent what happened.

Question 18Incident management concepts and definitions

Which statement about incident categorization is most consistent with ITIL 4?

  1. Categorization supports routing, trend analysis, and reporting, and should be applied consistently Correct answer.
  2. Categorization must be performed only by the practice owner
  3. Categorization should be changed at every reassignment to reflect new information
  4. Categorization is optional and adds no value once an incident has been logged

Explanation

Consistent categorization helps route incidents to the right teams and enables meaningful trend analysis and reporting. It is a practical aid to management, not a bureaucratic formality. While categories may be corrected when information changes, constant re-categorization undermines reporting quality.

Question 19Incident management concepts and definitions

An incident is detected automatically by monitoring before any user reports it. What does this illustrate about incident identification?

  1. Only user-reported events qualify as incidents under the ITIL 4 definition
  2. Monitoring-detected events are service requests until a user confirms them
  3. Automatically detected events must be reclassified as problems
  4. Incidents may be identified by users, technical staff, or monitoring tools Correct answer.

Explanation

ITIL 4 does not restrict incident identification to user reports; anyone or any tool that detects a disruption or degradation can raise an incident. Automated detection is often faster and catches issues before users are affected. The source of detection does not change the nature of the event.

Question 20Incident management concepts and definitions

Which statement best describes the role of the service desk within incident management?

  1. The service desk owns the problem management practice and performs all root cause analysis
  2. The service desk is solely responsible for approving changes that resolve incidents
  3. The service desk is the single point of contact for users and typically logs, categorizes, and resolves or routes incidents Correct answer.
  4. The service desk is only involved when an incident becomes a major incident

Explanation

The service desk acts as the user-facing entry point, capturing incidents, applying known solutions where possible, and routing the rest to appropriate teams. It supports incident management but does not own change approval or problem investigation. Its involvement begins at first contact, not only at major incidents.

Question 21Incident management concepts and definitions

A major incident has been declared. Which action is most consistent with ITIL 4 guidance for major incident handling?

  1. Wait for a full root cause analysis before communicating with stakeholders
  2. Suspend all other incident handling until the major incident is closed
  3. Assign a dedicated major incident owner or team and communicate status regularly to stakeholders Correct answer.
  4. Delay declaring the major incident until the service has been unavailable for one hour

Explanation

Major incidents benefit from clear ownership and proactive, regular communication so that stakeholders can manage their own business impact. Investigation of the cause can run in parallel rather than blocking communication. Organizations set their own declaration thresholds rather than waiting for a fixed elapsed time.

Question 22Incident management concepts and definitions

An organization wants to reduce repeat incidents caused by the same known error. Which practice combination is most appropriate?

  1. Capacity management alone, because repeat incidents indicate insufficient capacity
  2. Change enablement alone, because any fix requires a change
  3. Incident management to restore service quickly, combined with problem management to remove the underlying cause Correct answer.
  4. Service request management alone, because repeat incidents are requests

Explanation

Incident management restores service and problem management addresses the cause, so combining them reduces recurrence while protecting users in the meantime. Known errors can be documented with workarounds while a permanent fix is developed. Change enablement may implement the fix but does not by itself investigate causes.

Question 23Incident management concepts and definitions

An incident is resolved by a temporary workaround, and the underlying fault remains. Which statement best reflects ITIL 4 thinking about closing that incident?

  1. The incident must stay open until the permanent fix is deployed, because the service is not truly restored
  2. The incident should be closed and no further record kept of the known error
  3. The incident should be reclassified as a problem and removed from incident reporting
  4. The incident can be closed once service is restored, while the remaining risk is managed through problem management Correct answer.

Explanation

Incident management's objective is restoration, so closure after a successful workaround is appropriate. The residual risk is then managed through problem management, including known error records and any resulting changes. Keeping incidents open until a permanent fix would misstate restoration performance and delay closure.

Question 24Incident management concepts and definitions

A service provider measures incident management success only by average resolution time. What is the main weakness of this approach?

  1. Resolution time is a prohibited metric under ITIL 4
  2. Average resolution time is impossible to calculate from incident records
  3. Average resolution time is only relevant to problem management
  4. A single speed metric can reward fast closure of easy tickets while ignoring impact, recurrence, and user experience Correct answer.

Explanation

Focusing on one speed metric can encourage closing easy incidents quickly while neglecting high-impact or recurring ones. ITIL 4 encourages a balanced view that considers impact, recurrence, and the experience of users and teams. No single metric fully represents the purpose of the practice.

Question 25Incident management concepts and definitions

Two teams disagree about whether a slow but functioning reporting service should be logged as an incident. Which reasoning is most consistent with the ITIL 4 definition?

  1. It is not an incident because the service is still available to users
  2. It is a problem because slowness always indicates an unknown cause
  3. It is an incident because a reduction in the quality of a service falls within the definition Correct answer.
  4. It is a service request because users are asking for faster performance

Explanation

The ITIL 4 definition explicitly includes a reduction in service quality, not only full unavailability. Degraded performance that materially affects users therefore qualifies as an incident. Whether the cause is known is irrelevant to the classification decision.

Question 26Incident management concepts and definitions

In ITIL 4, which definition best describes an incident?

  1. A recurring event that has not yet been diagnosed and has no known cause
  2. A change to a configuration item that has not yet been approved
  3. An unplanned interruption to a service or reduction in the quality of a service Correct answer.
  4. A request from a user for something that is normally delivered as part of standard service

Explanation

ITIL 4 defines an incident as an unplanned interruption to a service or a reduction in the quality of a service. The definition is deliberately broad so that partial degradation, not only total outage, is captured. Anything that lowers perceived or actual service quality can be logged and managed as an incident.

Question 27Incident management concepts and definitions

A monitoring tool raises an alert because a payment gateway is responding more slowly than its target, although it is still completing transactions. How should this be treated under ITIL 4 incident management?

  1. As a service request, because the gateway is still processing payments
  2. As a problem, because no user has complained and the cause is unknown
  3. As a change request, because the gateway configuration will need adjusting
  4. As an incident, because service quality has been reduced even though the service still functions Correct answer.

Explanation

The ITIL 4 definition covers a reduction in the quality of a service, not only a full outage. Degraded performance against an agreed target is a reduction in quality, so it qualifies as an incident. Logging it allows the organization to restore normal performance before users are seriously affected.

Question 28Incident management concepts and definitions

Under ITIL 4, what is the essential distinction between an incident and a problem?

  1. An incident must be closed within a fixed time, while a problem must be closed within the same time
  2. An incident is always user-reported, while a problem is always detected by monitoring tools
  3. An incident is a service failure or degradation, while a problem is a cause, or potential cause, of one or more incidents Correct answer.
  4. An incident is handled by the service desk, while a problem is handled only by external suppliers

Explanation

ITIL 4 separates the observable failure from its underlying cause. An incident is the unplanned interruption or quality reduction experienced, while a problem is a cause or potential cause of one or more incidents. This separation lets an organization restore service quickly and investigate root cause separately.

Question 29Incident management concepts and definitions

A user reports that a printer occasionally produces garbled output. The analyst restores normal printing by restarting the print spooler, and the fault later recurs. What is the correct ITIL 4 treatment of the restart action?

  1. It is a change, because a service component was restarted
  2. It is a permanent resolution, because printing worked again afterwards
  3. It is a workaround, because service was restored without removing the underlying cause Correct answer.
  4. It is a problem closure, because the spooler was identified as the faulty component

Explanation

A workaround restores service without addressing the root cause, and the recurrence confirms the cause remained. ITIL 4 distinguishes this from a permanent resolution, which removes the fault. The recurring fault should also prompt a problem record so the cause can be investigated.

Question 30Incident management concepts and definitions

Which statement reflects the ITIL 4 position on who may raise an incident?

  1. Only technical support teams may raise incidents, because they understand the technology
  2. Incidents may be raised by users, by service desk staff, or automatically by monitoring and event tools Correct answer.
  3. Only the service desk may raise incidents, because it is the single point of contact
  4. Only users with an approved service request may raise incidents

Explanation

ITIL 4 recognizes that incidents can be identified through multiple channels, including users, service desk personnel, and automated tooling. Event monitoring can detect failures before users report them. The practice should therefore accept and correlate incidents from all these sources.

Question 31Incident management concepts and definitions

An organization wants incidents to be routed quickly to the team most able to restore service. Which incident management activity most directly supports this?

  1. Problem management root cause analysis
  2. Categorization and initial diagnosis to determine the nature of the incident and the appropriate resolver Correct answer.
  3. Continual improvement of the service value chain
  4. Service level agreement review with the customer

Explanation

Categorization and initial diagnosis establish what kind of incident it is and which support group should handle it. This routing decision is what enables fast restoration by the right team. Root cause analysis and SLA review happen outside the immediate routing step.

Question 32Incident management concepts and definitions

Which statement best describes the purpose of incident management in ITIL 4?

  1. To document every configuration item affected by a failure
  2. To minimize the negative impact of incidents by restoring normal service operation as quickly as possible Correct answer.
  3. To eliminate all incidents from the production environment
  4. To negotiate service level agreements with customers

Explanation

The purpose of incident management is to minimize negative impact by restoring normal service operation as quickly as possible. It accepts that incidents will occur and focuses on fast recovery rather than on prevention alone. Prevention of incidents belongs more to problem management and continual improvement.

Question 33Incident management concepts and definitions

A major incident is under way and the incident manager needs additional authority to commit resources across several teams. Which ITIL 4 concept describes moving the incident to a higher level of authority?

  1. Swarming
  2. Event correlation
  3. Functional escalation
  4. Hierarchic escalation Correct answer.

Explanation

Hierarchic escalation moves an incident to a higher level of authority or management when more resources, decisions, or visibility are needed. Functional escalation, by contrast, moves work to a team with greater technical skill. The two are distinct and may be used together during a major incident.

Question 34Incident management concepts and definitions

Two incidents affect the same service on the same morning. Incident A prevents 400 warehouse staff from dispatching orders, while Incident B affects one analyst's reporting query. Which prioritization reasoning is most consistent with ITIL 4?

  1. Incident A should generally be prioritized because its business impact is far greater Correct answer.
  2. Incident B should be prioritized because reporting is a management function
  3. Both should receive identical priority because both are incidents
  4. Incident B should be prioritized because it was reported first

Explanation

ITIL 4 prioritizes incidents according to business impact and urgency rather than report order. A disruption stopping 400 staff from dispatching orders has a far greater impact than one analyst's query. Priority should reflect the effect on the organization and its customers.

Question 35Incident management concepts and definitions

A service desk logs an incident, restores service, and closes it. Later the same failure recurs repeatedly. Which ITIL 4 action is most appropriate to prevent recurrence?

  1. Reclassify the incident as a service request
  2. Raise a problem record so the underlying cause can be investigated and removed Correct answer.
  3. Reduce the priority of future incidents of the same type
  4. Reopen the closed incident and leave it open indefinitely

Explanation

Repeat incidents point to an unresolved cause, which is exactly what problem management exists to address. Raising a problem record allows the cause to be analysed and a permanent fix pursued. Incident management alone restores service and is not designed to remove causes.

Question 36Incident management concepts and definitions

What does ITIL 4 mean by 'normal service operation' in the context of incident management?

  1. The service being monitored continuously by automated tools
  2. The service operating with all redundancy and backup systems active
  3. The service running with no open changes or configuration updates
  4. The service delivering its agreed performance and functionality as defined in service level agreements Correct answer.

Explanation

Normal service operation is understood relative to what has been agreed with the customer, typically captured in service level agreements. Restoration means returning the service to that agreed state. It does not require perfection or the absence of all risk.

Question 37Incident management concepts and definitions

An organization classifies incidents by impact and urgency to derive priority. Which statement about this approach is most consistent with ITIL 4?

  1. Priority is fixed by the resolver team after diagnosis is complete
  2. Priority is derived from the seniority of the person who reports the incident
  3. Priority is assigned only to major incidents, with all others treated equally
  4. Priority is derived from impact and urgency, and the resulting priority guides the order and effort of response Correct answer.

Explanation

ITIL 4 derives priority from impact and urgency, and that priority then drives response order and resourcing. This allows consistent decisions across many simultaneous incidents. Seniority of the reporter and resolver preference are not the basis for priority.

Question 38Incident management concepts and definitions

During a major incident affecting a customer-facing service, which communication behaviour is most consistent with ITIL 4 incident management?

  1. Announce a resolution time and avoid further updates unless the estimate changes
  2. Withhold information until the root cause has been fully identified
  3. Communicate only with the technical resolver teams to avoid distraction
  4. Provide agreed, regular updates to affected users and stakeholders until service is restored Correct answer.

Explanation

Incident management includes keeping users and stakeholders informed with agreed, regular updates during disruption. Communication supports the practice's aim of managing the negative impact of incidents, including uncertainty. Waiting for root cause would leave stakeholders uninformed for too long.

Question 39Incident management concepts and definitions

An incident is resolved by a temporary fix, and the underlying fault remains. Which statement best reflects ITIL 4 guidance?

  1. The incident should be reclassified as a problem and removed from incident records
  2. The incident should be closed without any record of the temporary fix
  3. The incident must remain open until the underlying fault is permanently removed
  4. The incident can be closed once service is restored, while the unresolved cause is managed through problem management Correct answer.

Explanation

Incident management is concerned with restoring service, so an incident may be closed once service is back to normal. The remaining cause is then handled through problem management. Recording the workaround preserves knowledge for future occurrences.

Question 40Incident management concepts and definitions

An incident management team measures success purely by the number of incidents closed per analyst per day. What is the main weakness of this measure?

  1. It rewards volume of closures rather than restoration of service quality and reduction of negative impact Correct answer.
  2. It cannot be calculated without root cause analysis data
  3. It requires approval from the problem management practice owner
  4. It applies only to major incidents and not to routine ones

Explanation

Counting closures per analyst encourages speed and volume without regard to whether service quality was genuinely restored or impact reduced. ITIL 4 aligns measures with the purpose of the practice, which is minimizing negative impact. A balanced set of measures should also consider restoration time, recurrence, and customer experience.

Question 41Incident management roles, responsibilities and value streams

In ITIL 4, which role typically owns the incident management practice at the organizational level and is accountable for its overall effectiveness?

  1. The problem manager assigned to the team
  2. The major incident manager on duty
  3. The practice owner for incident management Correct answer.
  4. The service desk analyst who handles most incidents

Explanation

ITIL 4 practices have a practice owner who is accountable for the practice's overall capability, resources and continual improvement across the organization. Individual analysts, major incident managers and problem managers perform operational roles but do not carry organization-wide accountability for the practice itself.

Question 42Incident management roles, responsibilities and value streams

What is the primary purpose of the incident management practice in ITIL 4?

  1. To identify and remove the root causes of recurring failures
  2. To negotiate and agree service level targets with customers
  3. To design new services that meet agreed capacity requirements
  4. To restore normal service operation as quickly as possible and minimize adverse impact Correct answer.

Explanation

Incident management focuses on returning service to normal operation quickly and limiting negative business impact, not on permanent root-cause elimination. Root-cause work belongs to problem management, while design and SLA negotiation sit in other practices.

Question 43Incident management roles, responsibilities and value streams

In the ITIL 4 value chain, during which activity is an incident most likely to be first detected and logged?

  1. Obtain/build
  2. Plan
  3. Engage
  4. Deliver and support Correct answer.

Explanation

Incidents are typically detected while services are being delivered and supported to users, which is the deliver-and-support value chain activity. The other activities concern planning, stakeholder engagement and building components rather than day-to-day operational restoration.

Question 44Incident management roles, responsibilities and value streams

Which statement best describes the responsibility of the service desk in incident management?

  1. It approves changes required to fix every incident
  2. It authorizes budget for major incident recovery efforts
  3. It logs, categorizes and owns the incident through to resolution or escalation Correct answer.
  4. It permanently resolves all technical root causes of incidents

Explanation

The service desk is the single point of contact that captures incident details, classifies them and retains ownership until resolution or appropriate escalation. It does not hold budget authority, perform root-cause analysis, or approve changes.

Question 45Incident management roles, responsibilities and value streams

An incident is resolved but the user has not yet confirmed that the service works as expected. What is the correct state of this incident?

  1. Reopened, because the user has not responded
  2. Closed, because the technical fix has been applied
  3. Cancelled, because no further action is planned
  4. Resolved, pending user confirmation before closure Correct answer.

Explanation

ITIL distinguishes resolution, where the underlying issue is addressed, from closure, which follows confirmation and any agreed wrap-up. An incident stays resolved until the user or requester confirms restoration and closure criteria are met.

Question 46Incident management roles, responsibilities and value streams

What distinguishes a major incident from other incidents in ITIL 4?

  1. It can only be declared by the service desk manager
  2. It always originates from a failed change record
  3. It has significant business impact and requires a coordinated, prioritized response Correct answer.
  4. It is automatically escalated to problem management within one hour

Explanation

A major incident is defined by its high business impact or urgency and needs a special coordinated response with senior attention and communication. It is not tied to a single origin such as a change, nor to a fixed escalation timer or one job title.

Question 47Incident management roles, responsibilities and value streams

Why does ITIL 4 emphasize that incident management should be integrated with the value stream rather than handled in isolation?

  1. Because incidents must always be closed within the same hour they are logged
  2. Because incident data and handoffs feed other practices and influence end-to-end value delivery Correct answer.
  3. Because each incident must be resolved by the team that built the service
  4. Because incident records replace the need for a configuration management database

Explanation

Incident handling is one part of a wider value stream, and its information and handoffs affect problem management, change enablement and continual improvement. Integration supports end-to-end flow, but it does not impose a universal one-hour closure rule or replace other records.

Question 48Incident management roles, responsibilities and value streams

Which action best reflects the ITIL 4 guiding principle of 'collaborate and promote visibility' in incident handling?

  1. Sharing incident progress and known errors through accessible channels with relevant stakeholders Correct answer.
  2. Restricting incident status information to senior managers only
  3. Logging incidents only after they have been technically resolved
  4. Closing incidents quickly to keep dashboards green

Explanation

Collaboration and visibility means making relevant information available to the people who need it, such as users, support teams and management, so work flows smoothly. Hiding status, gaming metrics or delaying logging all undermine transparency and effective response.

Question 49Incident management roles, responsibilities and value streams

A user reports that an application is slow for the whole department after a recent deployment. Which combination of dimensions should the incident manager consider when assessing impact?

  1. Affected users, business criticality of the service, and time sensitivity of the work Correct answer.
  2. Only the number of affected users, ignoring business criticality
  3. Only the technical severity reported by the monitoring tool
  4. Only the cost of the deployment that preceded the issue

Explanation

Impact assessment weighs how many people and which business functions are affected, how critical the service is, and how urgent restoration is. Relying on a single factor such as user count, tool severity or deployment cost gives an incomplete picture.

Question 50Incident management roles, responsibilities and value streams

An incident has been logged with high urgency but low impact. According to typical ITIL 4 prioritization logic, how should its priority be set?

  1. Priority should be low because impact is the only factor that matters
  2. Priority should reflect a combination of impact and urgency, likely moderate Correct answer.
  3. Priority should be high because urgency alone drives it
  4. Priority should be set to the maximum whenever urgency is high

Explanation

Priority is derived from both impact and urgency together, so high urgency with low impact generally yields a moderate priority rather than an extreme one. Neither factor alone should determine priority, and maximum priority is reserved for the most severe combinations.