ISO 20000 Service Management System (SMS) Questions and Answers

Question 1

A service provider is implementing a Service Management System (SMS) according to ISO/IEC 20000-1. As part of the 'CHECK' phase of the Plan-Do-Check-Act (PDCA) cycle, which of the following activities is most representative?

Accepted Answer

Reviewing service reports against Service Level Agreement (SLA) targets.

Answer

The 'CHECK' phase of the PDCA cycle involves monitoring, measuring, and reviewing the SMS and services against policies, objectives, and service requirements. Reviewing service reports to compare performance against agreed SLA targets is a core activity of this phase. Establishing scope is 'PLAN', implementing plans is 'DO', and assigning roles could be part of 'PLAN' or 'DO'.

Question 2

An organization wants to demonstrate its capability to consistently design, transition, deliver, and improve services that fulfill service requirements. Which part of the ISO/IEC 20000 standard specifies the requirements for a Service Management System (SMS) to achieve this?

Accepted Answer

ISO/IEC 20000-1

Answer

ISO/IEC 20000-1 is the part of the standard that specifies the mandatory requirements for an organization to establish, implement, maintain, and continually improve a Service Management System (SMS). Organizations can be formally audited and certified against this part. ISO/IEC 20000-2 provides guidance on the application of an SMS, and other parts provide further guidance or relate to other frameworks.

Question 3

A financial services company is defining its Service Continuity and Availability Management plans as part of its ISO 20000-compliant SMS. Which of the following is a mandatory requirement for this process group?

Accepted Answer

Assessing and documenting risks to the continuity and availability of services.

Answer

According to ISO/IEC 20000-1, the service provider is required to assess and document the risks to service continuity and availability. Based on this risk assessment, requirements are agreed upon and plans are created, maintained, and tested. Guaranteeing 100% availability is often unrealistic, plans must be tested proactively, and solutions should be risk-based, not necessarily the most expensive.

Question 4

Within the context of an ISO 20000 Service Management System, what is the primary purpose of the Information Security Management process?

Accepted Answer

To effectively manage information security risks and implement controls within the scope of the SMS.

Answer

The Information Security Management process within ISO 20000 is focused on managing information security holistically within the scope of the services being delivered. This involves establishing a policy, assessing risks, and implementing necessary controls to protect the confidentiality, integrity, and availability of information. While physical security, training, and antivirus software are potential controls, the primary purpose is the overall management of security based on risk.

Question 5

A company has successfully implemented an SMS and achieved ISO 20000 certification. To maintain this certification, the company must demonstrate a commitment to continual improvement. Which of the following activities BEST demonstrates this principle?

Accepted Answer

Analyzing trends in service performance and identifying opportunities for enhancement.

Answer

Continual improvement is a core principle of ISO 20000, driven by the PDCA cycle. Analyzing trends, reviewing performance, and proactively identifying opportunities for improvement are key activities that demonstrate an ongoing commitment to enhancing the SMS and service delivery. The other options suggest a static or reactive approach, which is contrary to the principle of continual improvement.

ISO 20000 Certification Practice Test

ISO 20000 Certification Practice Test

ISO 20000 Service Management System (SMS) Questions and Answers