During an ITIL-aligned review, an operations lead needs to distinguish incident management from problem management. Which statement correctly captures the difference in their primary objectives?
AIncident management removes the root cause of recurring faults, while problem management provides a fast temporary workaround to users
BIncident management restores normal service operation as quickly as possible, while problem management identifies and removes the underlying cause of one or more incidentscheck_circle Correct
CIncident management authorises configuration changes, while problem management maintains the definitive record of approved assets
DIncident management measures service-level attainment, while problem management negotiates the service-level agreement with the customer
Distinguish incident management (rapid restoration) from problem management (root-cause elimination) as separate ITIL objectives. ITIL treats an incident as an unplanned interruption whose handling aims to restore service fast, whereas a problem is the underlying cause whose management seeks permanent removal; conflating speed of restoration with root-cause work is the classic error this item targets.
Why A is wrong: This reverses the two disciplines; root-cause removal is problem management and the tempting overlap is that problem management does produce workarounds, but restoration speed belongs to incident management.
Why B is correct: This is the standard ITIL distinction: incident management prioritises rapid service restoration and problem management targets root-cause elimination.
Why C is wrong: These describe change and configuration management respectively, so the statement misattributes both objectives despite sounding process-oriented.
Why D is wrong: Both clauses belong to service-level management, not to the incident or problem processes, so the pairing is tempting but wrong.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
A vulnerability assessment attempts to exploit weaknesses to prove impact, whereas a penetration test only lists known weaknesses without exploiting them
errorWhy it is wrong: This swaps the definitions; exploiting weaknesses to prove impact is the penetration test, so the mapping is reversed and wrong.
Compressing archived logs to reduce the storage footprint of long retention periods
errorWhy it is wrong: Compression saves space and is tempting as good log hygiene, but it does nothing to detect or prevent tampering, so it does not preserve integrity.
Data loss prevention (DLP), which inspects data in use, in transit, and at rest to block unauthorised movement of sensitive information
errorWhy it is wrong: DLP is tempting because it also inspects activity, but its purpose is preventing exfiltration of sensitive data, not correlating events to raise incident alerts.