問39
頻出度★★★
インシデント管理に関する記述のうち, 適切なものはどれか。
平成24年度 春期 ITパスポート試験 問39
マネジメント系サービスマネジメント › サービスマネジメントシステム
This question's explanation and your answers so far.
解説
問 39
Incorrectア
For an incident that looks likely to exceed the target resolution time set in the SLA, what you do is not hand it over to problem management but escalate it. If the first point of contact (the service desk) cannot resolve it, it is raised to specialist engineers or a higher support tier — functional escalation; if the impact is large, managers are notified — hierarchical escalation. Either way, the recovery work continues within incident management. The trigger for passing work to problem management is not running out of time but that similar incidents keep recurring, or that identifying the root cause has been judged necessary; failing to resolve an incident within the agreed time does not automatically mean transferring it to problem management.
Incorrectイ
Considering and implementing measures to prevent recurrence (permanent countermeasures) is the role of problem management. Problem management analyses the root cause of incidents, registers it as a known error, and requests the change needed for a fix from change management, so that the same incident never happens again. What incident management does is restore the service in front of it; if it also had to carry recurrence prevention, recovery would be delayed and users would be unable to work for longer. That is exactly why the two processes are kept separate.
- ウ
正解 The correct answer is ウ, “Restoring normal service operation is given priority over investigating the cause of the incident.” An incident is an event that causes (or threatens to cause) an interruption to a service or a drop in its quality; a system outage, extremely slow response, being unable to print, and any other malfunction as seen by users all count as incidents. The purpose of incident management is to restore normal service operation as quickly as possible within the agreed service levels (SLA) and to keep the adverse impact on the business to a minimum. Therefore, rather than spending time working out why it broke, priority goes to getting users back to a state where they can resume their work — by restarting, switching over, swapping in a standby machine, applying a temporary workaround, and so on. Meanwhile, the activity of identifying the root cause, putting permanent countermeasures in place and preventing recurrence is handled by a separate process called problem management, which analyses the matter carefully on the basis of the records passed to it by incident management. This division of roles — recover first (incident management), then find the cause and prevent recurrence afterwards (problem management) — is the core of this question, and ウ is the option that states it correctly.
Incorrectエ
Even for an incident whose resolution method is already known, the fact that it occurred, the date and time, the symptom, the scope of impact, the action taken, and the time taken to recover must all be recorded. Records serve as the basis for measuring whether the SLA is being met, and they also make visible, as a count, how often the same symptom keeps occurring, giving problem management the material it needs to decide whether to tackle the root cause. Accumulated records can further be reused as service desk procedures, FAQs, or known errors, making future responses faster. Skipping the records loses all of this, so this option, which claims that recording is unnecessary, is wrong.
ここがポイント
- The purpose of incident management is to restore normal service operation as quickly as possible within the agreed service levels and to minimise the impact on the business. Recovery takes priority over investigating the cause, and applying a temporary workaround is a legitimate means.
- The division of roles between incident management and problem management: incident management fixes the outage happening now (temporary measures and recovery), while problem management identifies the root cause so that it never happens again (permanent countermeasures and recurrence prevention). What you do when an incident cannot be resolved in time is escalate it, and every incident — including ones already resolved or already known — is recorded.
用語