10 ITIL 4 Practices to Know for Work and the Foundation Exam

Ten ITIL 4 practices carry most of what you will use on a service desk and most of what the ITIL 4 Foundation paper rewards: service desk, incident management, service request management, problem management, change enablement, service level management, continual improvement, monitoring and event management, service configuration management and release management. PeopleCert's syllabus asks you to explain the first seven in detail and to recall the purpose of the other three.

The examples below all follow one invented incident, so you can watch the practices hand work to one another instead of memorising ten separate definitions. Northgate Freight is not a real company. It is a regional haulage firm with a three-person service desk, a warehouse full of handheld scanners and a shift that starts at six every morning. ITIL 4 describes more practices than the exam covers, and these ten were picked because a normal working week touches them and because the syllabus gives each a definite treatment. Where this article quotes what the exam asks, it is reading PeopleCert's candidate syllabus, version 4.2.0 from March 2025, and PeopleCert's exam page, both checked in October 2026.

Which ten practices earn a place, and how does the syllabus treat each?

The syllabus has two learning outcomes about practices. The first asks you to recall the purpose of 15 practices and to recall the definitions of seven terms: change, configuration item, event, incident, IT asset, known error and problem. The second asks you to explain seven practices in detail, with the continual improvement model named for continual improvement, and to leave out how each one fits inside the service value chain. Notice what that means: the seven detailed practices also appear on the recall list, so they get asked both ways, as a purpose to remember and as a mechanism to explain.

The ten chosen here are those seven plus three from the recall-only group. Information security, relationship, supplier and IT asset management and deployment management are on the same recall list and matter just as much at work. They were left out only to keep the story to one thread, not because the exam ignores them.

Practice	How the syllabus treats it	Where it turns up in the story
Monitoring and event management	Recall purpose; recall the term event	The warning nobody read
Service desk	Recall purpose; explain in detail	The first dozen calls
Incident management	Recall purpose; explain in detail	Getting the shift moving
Service request management	Recall purpose; explain in detail	The new starter at the same desk
Service configuration management	Recall purpose; recall the term configuration item	Which scanners are affected
Problem management	Recall purpose; explain in detail; recall problem and known error	Finding the cause
Change enablement	Recall purpose; explain in detail; recall the term change	Fixing it safely
Release management	Recall purpose	Rolling out the early-warning setting
Service level management	Recall purpose; explain in detail	Measuring what users feel
Continual improvement	Recall purpose; explain in detail, with the improvement model	Making next Tuesday different

What happens in the first hour, and which four practices take the hit?

At 06:08 on a Tuesday, the sync error count on the warehouse server climbs past its warning level. At 06:10 the first picker's scanner refuses to load the day's pick list. Within a few minutes the desk's phone has not stopped. This is the stretch where four practices work almost at once.

Monitoring and event management

The purpose is to observe services and their components and to record and report the changes of state that matter, then respond to them. An event is a change of state that has significance for managing a service, and not every event is bad: some inform, some warn, some signal an exception. At Northgate the monitoring tool raised a warning at 06:08, but it went to a shared mailbox that nobody reads before eight. The practice had done its observing and failed at its responding, which is the usual weak point.

How the exam asks. This practice sits on the recall list only, so expect its purpose, or the word "event", to appear as a missing-word sentence or a standard question with four plausible definitions. The wrong options usually describe a neighbouring practice, such as the one that restores service after the event turns into a failure.

Service desk

The service desk is the single point of contact between the provider and its users, and its purpose is to capture demand for incident resolution and service requests. At Northgate the desk logs the first call, spots that the second and third describe the same fault, and links them instead of opening a dozen records. It tells the shift supervisor in business words, "pick lists are not loading on the scanners", rather than quoting an error code. That choice of words is the part ITIL 4 stresses: the practice values empathy and an understanding of the user's work as much as technical skill.

How the exam asks. Because the desk is among the seven explained in detail, a scenario may describe an agent behaving well or badly and ask which statement about the service desk is correct. A frequent trap is to treat the desk as the team that fixes everything. It captures and routes demand, and it may resolve what it can, but the practice does not claim to own every fix.

Incident management

The purpose is to minimise the negative impact of incidents by restoring normal service operation as quickly as possible. At Northgate the whole morning shift is affected, so the incident is ranked high on impact and urgency, and the team agrees a workaround within the hour: pickers revert to paper manifests printed from the previous evening's export while an engineer works on the server. The workaround is not the cause being fixed. It buys time, and the incident stays open until the scanners really sync again.

How the exam asks. Explaining incident management means knowing that speed of restoration beats finding the cause, that priority comes from impact and urgency, and that some incidents never reach the desk because users solve them with self-help. List-style questions give four statements and ask for the two that are true, which punishes anyone who half-remembers the practice.

Service request management

The purpose is to handle pre-defined, user-initiated requests effectively and in a user-friendly way. While the scanners are down, a new starter in dispatch needs a scanner login. That is not an incident, because nothing is broken. It is a request that follows a standard workflow, usually with approval built in beforehand, and it should not queue behind the outage or be dressed up as one.

How the exam asks. The commonest question on this practice is the sorting one: a short scenario, and four options that call the same event a request, an incident, a problem or a change. If something is expected, repeatable and agreed in advance, it is a request.

What happens by the afternoon, and which four practices stop it coming back?

With paper manifests in use and the queue calm, the work turns from restoring to understanding. Four more practices come in, three of which the exam wants explained or recalled with exact terms.

Service configuration management

The purpose is to make accurate and reliable information about services and the components that support them available when and where it is needed. Each scanner, the sync server and its certificate are configuration items, meaning components that must be managed to deliver the service, and the records say which scanners share a firmware build and which server they talk to. Without them the engineer would be walking the warehouse with a clipboard.

How the exam asks. Another recall-only practice: its purpose and the term "configuration item" are the targets. A distractor is often "asset", which sounds similar, so keep the two terms apart. An IT asset is something of financial value; a configuration item is something you must control to deliver a service, and a thing can be both.

Problem management

The purpose is to reduce the likelihood and impact of incidents by identifying their actual and potential causes and by managing workarounds and known errors. After the morning, a problem record is opened. The investigation finds the cause: the sync server's security certificate expired at six o'clock and the scanners refused to trust it. The paper-manifest approach is now written down as a workaround, and the fault is logged as a known error, one with a documented cause and workaround and no permanent fix yet.

How the exam asks. Problem versus incident is the question most candidates meet more than once. The incident is the interruption; the problem is the underlying cause. Two other terms appear on the recall list, problem and known error, and they are good missing-word material because the definitions are short and exact.

Change enablement

The purpose is to maximise the number of successful IT changes by making sure risks are assessed, authorising changes to go ahead and managing the change schedule. Installing a renewed certificate that morning was an emergency change, approved by the person on duty with authority for it. Renewing the same certificate every year afterwards becomes a standard change, a low-risk and well understood change pre-authorised by a documented procedure, so nobody has to convene a meeting for it.

How the exam asks. Expect the three change types and who authorises them. ITIL 4 talks about a change authority, a person or group given the right to approve a type of change, rather than a single fixed board. The deliberate point of the practice is that it should speed up low-risk changes as well as scrutinise risky ones.

Release management

The purpose is to make new and changed services and features available for use. The renewed certificate is not a release, but the follow-up is: a scanner setting that raises a warning well before any certificate expires. Northgate tries it with one shift's scanners, watches for trouble and then offers it to the rest. Making the change available is release management; physically moving it onto the devices is deployment management, which is a separate practice on the same recall list.

How the exam asks. Recall only, so the purpose sentence is what you need. The tempting wrong answer is the purpose of deployment management, because the two sound alike. Release is about availability for use; deployment is about moving components into live environments.

How do service levels and improvement turn one bad morning into a better week?

Service level management

The purpose is to set clear, business-based targets for service performance so that delivery can be assessed, monitored and managed against them. Northgate's old target said the sync server must be up nearly all the time, and on that morning the server was up. The scanners were not usable. The new target is written in the warehouse's terms: pick lists are available on every scanner when the shift starts. A target the business can recognise, measured where users feel it, is what the practice is about.

How the exam asks. Service level management is one of the seven explained in detail, and the syllabus names its own section of the official book rather than a single paragraph. Questions tend to test whether targets are agreed with the business, whether they describe what the customer experiences, and how they are reported back. A statement that measures only the supplier's internal technical numbers is a reliable wrong answer.

Continual improvement

The purpose is to align the organisation's practices and services with changing business needs through ongoing improvement. The syllabus names the continual improvement model as part of what you must explain, and the story shows it working in order:

1. Vision: scanners never block a shift because of a lapsed certificate.
2. Where are we now: expiry is tracked in one person's calendar.
3. Where do we want to be: expiry is monitored, with a warning weeks ahead.
4. How do we get there: add the check, release the scanner setting, route the alert to the desk.
5. Take action: do it, one shift first.
6. Did we get there: the next expiry produces an alert and no incident.
7. Keep the momentum going: apply the same idea to the other certificates and licences.

How the exam asks. Because the model is named in the syllabus, the step order and the question each step asks are fair game. Candidates who understand the story can reconstruct the order, which is easier than memorising it. Note also the guiding principles behind the story, since the same paper tests them separately: start where you are, and progress iteratively with feedback.

How does the Foundation paper put these ten into questions?

PeopleCert's syllabus sets the frame. The exam has 40 questions, each worth one mark, with no negative marking and a closed-book rule. Candidates sitting in a language that is not their native or working language may be awarded an extra quarter of the time. Question levels are Bloom's levels 1 and 2: recall and understanding. Nothing on the paper asks you to design a new practice, only to recognise and explain how the existing ones behave.

Detail	ITIL 4 Foundation
Vendor	PeopleCert
Questions	40 multiple choice
Time	60 minutes
Passing score	65% (26 of 40)
Fee	USD $463
Syllabus	Version 4.2.0, March 2025
Practices explained in detail	7, carrying 17 marks
Practices recalled by purpose	15 practices plus 7 terms, carrying 7 marks

Adding the two practice outcomes gives 24 of the 40 marks, which is 60% of the paper. That sum is this article's arithmetic, not PeopleCert's wording, but it explains why the practices are the part of the syllabus worth the most revision time: the pass line is 26, so the practices alone sit two marks short of it. The full syllabus breakdown is on the ITIL 4 Foundation syllabus page.

PeopleCert lists four question styles, and each lands differently on practices:

• Standard. A stem and four options. On practices these are usually scenarios: a short description of a team behaving a certain way and a question about which practice it is using, or which statement about a practice holds.
• Missing word. A sentence with a gap and four candidate words. This is where the purpose lines and the seven terms are tested, so they reward exact wording.
• List. Four statements, two of which are true. A list question on a practice such as problem management punishes the candidate who knows the gist but not the boundary with its neighbours.
• Negative. PeopleCert says these are used only as an exception, when part of the learning outcome is knowing that something is not done. Read the stem twice for "NOT".

The seven explained practices carry the heavier marks, but the recall-only three in this article are not free marks to skip. Their purposes are short, which makes them cheap to learn and easy to lose through a near-miss between two similar sentences.

Does the Version 5 Foundation change how these practices are taught?

ITIL Foundation (Version 5) is on sale at PeopleCert next to ITIL 4 Foundation. Its pages describe Version 5 as an evolution of ITIL, and its own explainer says that for anyone already familiar with ITIL it is "not a reset". On its Version 5 Foundation page, PeopleCert lists "ITIL's management practices" as a topic, describing the role of the practices and how the official practice guides support consistent ways of working. It uses the wording "management practices" rather than "ITIL practices" and publishes no list of which practices the Version 5 paper examines in detail, so this article makes no claim about that. The exam box on that page repeats the ITIL 4 Foundation format: closed book, 40 multiple-choice questions, 60 minutes and a 65% pass mark.

On ITIL 4's lifespan, PeopleCert's FAQ gives a retirement date of 31 December 2027 for every ITIL 4 module and says voucher validity dates will follow. Both pages are in PeopleCert's hands and may change, so read PeopleCert's Version 5 Foundation page, its Version 5 explainer and its ITIL FAQ before you book anything. If the exam you are sitting is ITIL 4, everything above is the syllabus you will be held to. The practices themselves, such as incident, problem and change, are old ideas with a long working life, so the story of Northgate's scanner is still a sound way to learn them whichever edition you take.

How can you rehearse the ten practices without memorising a list?

Treat the Northgate story as a template and rerun it with a fault from your own workplace or from one you can invent: a failed backup, a locked-out account, a payment page that times out. Three passes are enough.

1. Retell it in order. Write the sequence on one page: what was observed, who took the call, what restored service, what was recorded as the cause, how the fix was approved, how it was rolled out, which target it was measured against and what changed afterwards. Gaps in the sequence show you which practice you cannot yet explain.
2. Say each purpose from memory. One sentence per practice, then check it against PeopleCert's exam page and the official book it points to. Do this for all fifteen practices the syllabus lists, not just these ten, since the recall outcome covers them all.
3. Change the wording. The exam will not use your story. Try the same ideas on unfamiliar phrasing and look for which neighbouring practice you are confusing with which, such as incident and problem, or release and deployment.

The third pass is where the ITIL 4 Foundation practice exam earns its place, because it gives you scenario wording you did not write yourself. When a pass is shaky, go back to the one practice that failed rather than rereading everything.

One habit to take from the whole exercise: for any scenario, ask first whether something is broken, wanted, unknown or being altered. Broken is an incident, wanted is a request, unknown is a problem, and altered is a change. Almost every practice question on the paper can be started from that sort.

Frequently Asked Questions

Which ITIL 4 practices does the Foundation exam test in detail?

PeopleCert's syllabus lists seven for explanation: service desk, incident management, problem management, change enablement, service level management, service request management and continual improvement. For a further eight practices, such as monitoring and event management, you only need to recall the purpose.

What is the difference between an incident and a problem in ITIL 4?

An incident is an unplanned interruption or reduction in the quality of a service, and incident management aims to restore service quickly. A problem is the underlying cause of one or more incidents. Problem management looks for that cause and manages workarounds and known errors, so the incidents stop recurring.

How many ITIL 4 practices do you need to know for Foundation?

The syllabus names 15. You recall the purpose of all 15, and recall seven terms such as event, configuration item and known error. Seven of the 15 are examined at explanation level. ITIL 4 describes more practices than that, but the Foundation paper does not examine them.

Is ITIL 4 Foundation still worth taking now that Version 5 exists?

Both editions are on sale at PeopleCert, whose FAQ gives 31 December 2027 as the planned retirement date for ITIL 4 modules, with voucher validity dates still to come. If you need the ITIL 4 qualification, check the dates before booking. The practices covered here, such as incident and change, remain central ITIL ideas.

What does ITIL 4 Foundation give a service desk worker in practice?

It gives a shared vocabulary for sorting work: whether something is an incident, a request, a problem or a change, and which practice owns the next step. That helps colleagues hand work over without argument. It does not prove hands-on technical skill, which employers test separately.

Select ratingPoorOkayGoodGreatAwesome

Average: 4.9 (81 votes)