- A company experiences a system outage and the IT team restores service within the SLA timeframe. However, the same outage occurs again three weeks later. This pattern most likely indicates a failure in:
Answer: Problem management - the root cause was not identified and eliminated after the first incident, allowing the underlying issue to cause recurrence.
Recurring incidents indicate that incident management restored service but problem management failed - the root cause was not found and fixed, allowing the same underlying issue to cause another outage. Answer A is correct. The first restoration met SLA (B). There is no evidence of a change (C) or backup issue (D).
- A company experiences a ransomware attack that encrypts 60% of its production data. The incident response team's first priority should be:
Answer: Containing the attack by isolating affected systems to prevent further spread, then beginning the investigation and recovery process.
The first incident response priority is containment - isolating affected systems to stop the ransomware from spreading further. Investigation, notification, and recovery follow containment. Answer C is correct. Paying ransom (A) is a last resort that doesn't guarantee recovery. Customer notification (B) comes after containment and assessment. Root cause analysis (D) follows containment.
- During an audit of incident management controls, an auditor finds that critical system incidents are not escalated to senior management until they have been unresolved for more than 48 hours. The primary risk of this escalation policy is:
Answer: Critical incidents may remain unresolved for up to 48 hours without senior management awareness, delaying resource allocation and potentially exceeding recovery time objectives.
A 48-hour escalation delay for critical incidents means management is unaware and cannot allocate additional resources for up to two days - potentially well beyond the RTO for critical systems. Answer B is correct. Over-notification (A) is not the risk for critical incidents. Report preparation (C) is a minor concern. Vendor SLAs (D) are a separate consideration.
- An organization's incident management process requires that all resolved incidents be reviewed within 5 business days to confirm the resolution is effective and the incident has not recurred. This post-resolution review primarily supports which objective?
Answer: Verifying that the fix was effective and triggering problem management investigation if the incident recurs within the review window.
Post-resolution review confirms fix effectiveness and catches early recurrences that should trigger problem management - connecting incident and problem management processes. Answer A is correct. Billing documentation (B), satisfaction ratings (C), and archiving (D) are administrative activities that are not the primary purpose.
- Which of the following best describes a 'workaround' in ITSM incident and problem management?
Answer: A temporary solution that reduces the impact of an incident or problem until a permanent fix can be implemented.
A workaround is a temporary measure - it mitigates impact but does not fix the underlying cause. It buys time until a proper solution is developed and implemented. Answer D is correct. A permanent fix (A) eliminates the need for a workaround. A security patch (B) may be a fix, not a workaround. Manual processes (C) may be workarounds but the definition is broader.
- After a major security incident, an organization conducts a post-incident review. The primary purpose of this review is to:
Answer: Understand what happened, why it happened, what was done well, what could be improved, and what actions will prevent recurrence.
A post-incident review (also called a post-mortem or lessons learned) is focused on understanding and improvement - not blame - covering the full incident timeline, response effectiveness, and preventive actions. Answer D is correct. Blame assignment (A) is counterproductive. Insurance reporting (B) is a compliance activity. Board reporting (C) may follow but is not the review's primary purpose.
- During an audit, an organization claims its incident management process is effective because 'issues get fixed.' The auditor should evaluate this claim by reviewing:
Answer: Incident logs, SLA compliance rates, recurring incident patterns, root cause analysis completion rates, and evidence of permanent fixes implemented.
Auditing incident management effectiveness requires objective evidence: ticket data, SLA compliance, recurrence patterns, RCA completion, and fix implementation - not anecdotal claims. Answer D is correct. Satisfaction surveys (A), headcount (B), and strategic plans (C) do not directly measure incident management process effectiveness.
- Which of the following metrics best measures the effectiveness of problem management?
Answer: The reduction in recurring incidents over time as root causes are identified and permanently fixed.
Problem management effectiveness is measured by whether it reduces incident recurrence - finding and fixing root causes should result in fewer repeat incidents over time. Answer B is correct. Incident volume (A) measures incident arrival rate, not problem management effectiveness. Cost (C) measures efficiency. First-call resolution (D) measures incident management performance.
- Which of the following is a key control that helps ensure incidents are escalated appropriately when they cannot be resolved within defined timeframes?
Answer: Documented escalation paths and timeframes that automatically trigger notification of senior staff and management when incidents breach defined resolution windows.
Documented escalation paths with defined triggers ensure that unresolved incidents automatically escalate to higher levels of authority, ensuring resources and management attention are applied before incidents cause unacceptable disruption. Answer A is correct. Mobile phones (B), org charts (C), and training (D) are supporting elements but not the escalation control itself.
- In IT service management (ITSM), what is the primary distinction between 'incident management' and 'problem management'?
Answer: Incident management focuses on restoring normal service as quickly as possible; problem management focuses on identifying and eliminating the root cause to prevent recurrence.
Incident management prioritizes speed of restoration - getting users back to work. Problem management digs deeper to find and eliminate the underlying root cause so the incident does not recur. Answer D is correct. Seniority (A) and domain scope (B) are not the distinguishing factors. Problem management can be both reactive and proactive (C).
- An organization's problem management process requires a root cause analysis (RCA) for all P1 (critical) incidents. After a major database outage, no RCA is conducted because 'the team was too busy with other work.' The most significant risk of this gap is:
Answer: The underlying cause of the outage remains unaddressed, increasing the likelihood of recurrence and future disruptions to critical systems and financial operations.
Without RCA, the root cause of a critical outage is unknown and unresolved - the same failure mechanism can cause another outage. Answer C is correct. Certification impacts (A) are secondary. Performance reviews (B) are unrelated. Open tickets (D) are an administrative issue.
- Which of the following metrics is most useful for evaluating the effectiveness of an incident management process?
Answer: Mean time to resolve (MTTR) - the average time from incident detection to service restoration.
MTTR directly measures incident management effectiveness - how quickly the team restores service after an incident. Answer A is correct. MTBF (B) measures reliability, not incident management effectiveness. Total incidents logged (C) measures volume, not resolution effectiveness. Reporting source (D) is a detection metric.
- An IT team resolves incidents by restarting servers whenever applications crash, without investigating why the crashes occur. Over six months, the same servers are restarted 47 times. This approach reflects:
Answer: Effective incident management but failed problem management - the root cause of the crashes has not been investigated or resolved.
Quick restarts demonstrate responsive incident management. However, 47 restarts without root cause investigation is a clear problem management failure - the recurring crashes indicate an unresolved underlying issue. Answer B is correct. Quick restoration alone is not sufficient (A). The frequency suggests a resolvable problem (C). Restarts are not change management (D).
- When evaluating an organization's incident management process from a financial reporting perspective, which of the following types of incidents are most important to assess?
Answer: Incidents affecting systems that support financial transaction processing, financial reporting, or access to financial data.
For financial reporting purposes, incidents affecting financial systems are most critical - they can delay reporting, corrupt data, or enable unauthorized access to financial information. Answer D is correct. Not all incidents affect financial reporting (A). Partial service degradation may also matter (B). Management reporting is not the selection criterion (C).
- Which of the following best describes the concept of 'service degradation' in incident management?
Answer: A condition where a service is partially available or operating below normal performance standards, representing an incident even if the service has not completely failed.
Service degradation - partial availability or reduced performance - qualifies as an incident and should be logged and addressed, even if users can still technically access the system. Answer C is correct. Permanent capacity reduction (A) is a different concept. Planned maintenance (B) is a scheduled activity, not an incident. Hardware aging (D) is a different phenomenon.
- An auditor evaluating incident management controls for a financial services company finds that the company has no documented incident response procedures. The primary risk is:
Answer: During an actual incident, the response will be ad hoc and inconsistent, potentially increasing resolution time, escalating impact, and missing critical response steps.
Without documented procedures, incident response depends on individual knowledge and improvisation - leading to inconsistent, slower, and incomplete responses that increase damage. Answer D is correct. Regulatory fines (A) may follow but are secondary. System usability (B) is unrelated. Insurance (C) is a separate consideration.
- An organization conducts quarterly incident management reviews with IT leadership. Which of the following agenda items would be most valuable for improving the incident management process?
Answer: Reviewing incident volume trends, SLA compliance rates, recurring incident patterns, open problem records, and outstanding root cause analysis actions.
Effective incident management review covers performance metrics (volume, SLAs), systemic patterns (recurring incidents), and follow-through on problem management (open problems, RCA actions) - enabling continuous improvement. Answer C is correct. On-call schedules (A), capital plans (B), and vendor contracts (D) are not incident management review content.
- An organization's ITSM platform automatically creates a problem record when three or more incidents with the same category and affected system are logged within a 30-day period. This automation is designed to:
Answer: Proactively trigger problem management investigation when patterns suggest an underlying systemic issue, preventing continued reactive incident handling.
Automated problem record creation based on incident patterns is a proactive problem management trigger - identifying systemic issues before they cause further damage, rather than waiting for manual escalation. Answer B is correct. Merging tickets (A) is a different function. User alerts (C) and cost calculation (D) are secondary functions.
- Which of the following represents an effective integration between incident management and change management processes?
Answer: When problem management identifies a root cause requiring a fix, the fix is implemented through the formal change management process to ensure it is authorized, tested, and documented.
The formal link between problem management and change management ensures that fixes identified through root cause analysis are implemented in a controlled, authorized manner - preventing rushed fixes that could cause new problems. Answer A is correct. Pre-approval of all incident restorations (B) would cause unacceptable delays. Independence (C) creates gaps. Change initiation is not limited to problem managers (D).
- During an audit, an IT auditor reviews the incident log and finds that several high-severity incidents affecting the financial reporting system were not logged in the incident management system. The primary risk of unlogged incidents is:
Answer: The organization loses visibility into system reliability patterns, management cannot make informed decisions, and root cause analysis cannot be performed on untracked issues.
Unlogged incidents create blind spots - management cannot see patterns, cannot perform trend analysis, and cannot trigger problem management for recurring issues. Answer A is correct. Capacity (B), automatic SOC failures (C), and employee complaints (D) are not the primary risks.
