ITIL OSA Event Management Ultimate
Exam
**Question 1. Which of the following best describes the primary purpose of Event Management in ITIL?
**
A) To perform detailed root-cause analysis of incidents
B) To detect, analyze, and determine appropriate control actions for events
C) To design new IT services from business requirements
D) To allocate budget for infrastructure upgrades
Answer: B
Explanation: Event Management’s core purpose is to detect events, analyze their significance, and
decide on control actions, not to conduct deep problem analysis or service design.
**Question 2. In the scope of Event Management, which item is explicitly excluded?**
A) Monitoring configuration items (CIs)
B) Detailed root-cause analysis of service failures
C) Generating alerts for threshold breaches
D) Recording event logs in the CMDB
Answer: B
Explanation: Detailed root-cause analysis belongs to Problem Management; Event Management stops at
detection and initial response.
**Question 3. An event that indicates a user login to a server is an example of which event type?**
A) Informational
B) Warning
C) Exception
D) Critical
Answer: A
, ITIL OSA Event Management Ultimate
Exam
Explanation: User logins are routine, non-critical occurrences and are classified as informational events.
**Question 4. Which event type signals that a system has reached 85 % CPU utilization, a level defined
as a threshold?**
A) Informational
B) Warning
C) Exception
D) Incident
Answer: B
Explanation: Crossing a predefined threshold without causing immediate failure is a warning event.
**Question 5. A security breach that disables a firewall is categorized as which type of event?**
A) Informational
B) Warning
C) Exception
D) Advisory
Answer: C
Explanation: Security breaches and service failures are exception events requiring immediate attention.
**Question 6. What is the main difference between an alert and a notification in Event Management?**
A) Alerts are generated by humans; notifications are automated
B) Alerts indicate that an event occurred; notifications identify who must be informed
C) Alerts are only for warnings; notifications are only for exceptions
D) There is no difference; the terms are interchangeable
Answer: B
, ITIL OSA Event Management Ultimate
Exam
Explanation: An alert signals the occurrence of an event; a notification determines the audience for that
alert.
**Question 7. Which monitoring approach actively queries a device for status information?**
A) Passive monitoring
B. Reactive monitoring
C. Active monitoring
D. Event-driven monitoring
Answer: C
Explanation: Active monitoring uses agents or scripts to poll devices periodically, whereas passive
monitoring waits for devices to send data.
**Question 8. When interfacing with Configuration Items (CIs) to pull status data, which ITIL component
provides the authoritative CI information?**
A) Service Catalog
B) Service Level Management
C) Configuration Management Database (CMDB)
D) Knowledge Management
Answer: C
Explanation: The CMDB stores CI details and relationships, enabling Event Management to retrieve
accurate status information.
**Question 9. The process of ignoring “noise” and focusing on actionable data is known as:**
A) Event correlation
B) Event filtering
C) Event escalation
D) Event logging
Exam
**Question 1. Which of the following best describes the primary purpose of Event Management in ITIL?
**
A) To perform detailed root-cause analysis of incidents
B) To detect, analyze, and determine appropriate control actions for events
C) To design new IT services from business requirements
D) To allocate budget for infrastructure upgrades
Answer: B
Explanation: Event Management’s core purpose is to detect events, analyze their significance, and
decide on control actions, not to conduct deep problem analysis or service design.
**Question 2. In the scope of Event Management, which item is explicitly excluded?**
A) Monitoring configuration items (CIs)
B) Detailed root-cause analysis of service failures
C) Generating alerts for threshold breaches
D) Recording event logs in the CMDB
Answer: B
Explanation: Detailed root-cause analysis belongs to Problem Management; Event Management stops at
detection and initial response.
**Question 3. An event that indicates a user login to a server is an example of which event type?**
A) Informational
B) Warning
C) Exception
D) Critical
Answer: A
, ITIL OSA Event Management Ultimate
Exam
Explanation: User logins are routine, non-critical occurrences and are classified as informational events.
**Question 4. Which event type signals that a system has reached 85 % CPU utilization, a level defined
as a threshold?**
A) Informational
B) Warning
C) Exception
D) Incident
Answer: B
Explanation: Crossing a predefined threshold without causing immediate failure is a warning event.
**Question 5. A security breach that disables a firewall is categorized as which type of event?**
A) Informational
B) Warning
C) Exception
D) Advisory
Answer: C
Explanation: Security breaches and service failures are exception events requiring immediate attention.
**Question 6. What is the main difference between an alert and a notification in Event Management?**
A) Alerts are generated by humans; notifications are automated
B) Alerts indicate that an event occurred; notifications identify who must be informed
C) Alerts are only for warnings; notifications are only for exceptions
D) There is no difference; the terms are interchangeable
Answer: B
, ITIL OSA Event Management Ultimate
Exam
Explanation: An alert signals the occurrence of an event; a notification determines the audience for that
alert.
**Question 7. Which monitoring approach actively queries a device for status information?**
A) Passive monitoring
B. Reactive monitoring
C. Active monitoring
D. Event-driven monitoring
Answer: C
Explanation: Active monitoring uses agents or scripts to poll devices periodically, whereas passive
monitoring waits for devices to send data.
**Question 8. When interfacing with Configuration Items (CIs) to pull status data, which ITIL component
provides the authoritative CI information?**
A) Service Catalog
B) Service Level Management
C) Configuration Management Database (CMDB)
D) Knowledge Management
Answer: C
Explanation: The CMDB stores CI details and relationships, enabling Event Management to retrieve
accurate status information.
**Question 9. The process of ignoring “noise” and focusing on actionable data is known as:**
A) Event correlation
B) Event filtering
C) Event escalation
D) Event logging
