Home / enterprise-architecture-it-governance / ITIL 4 Foundation Certificate in IT Service Management (ITIL 4 Foundation) / Cheat Sheet
ITIL 4 Foundation Certificate in IT Service Management (ITIL 4 Foundation)

ITIL 4 Foundation Cheat Sheet

ITIL 4 Foundation Tests Precise ITIL Definitions — Not Your Own Service Desk Habits

ITIL 4 Foundation is still offered alongside ITIL (Version 5); secondary sources report PeopleCert plans to sunset ITIL 4 modules at the end of 2027. Answer with the 2019 syllabus wording, not workplace jargon.

Check Your Readiness →
Among the harder certs
Avg: Not published by PeopleCert
Pass: 750 / 1000
Most candidates understand ITIL 4 Foundation Certificate in IT Service Management (ITIL 4 Foundation) concepts — and still fail. This exam tests how you apply knowledge under pressure.

ITIL 4 Foundation Syllabus Map (v1.4)

Forty closed-book questions, one mark each, allocated 5/6/2/1/2/7/17 across the seven learning outcomes. Weights here convert those marks to percentages. Many items are short scenarios asking which practice, change type, value chain activity or principle applies.

  1. 01
    Key concepts of service management (12.5%) — service, value co-creation, utility and warranty, sponsor vs customer vs user, offerings
  2. 02
    Guiding principles (15%) — the seven principles, how they interact, recognising which one a scenario illustrates
  3. 03
    Four dimensions of service management (5%) — organizations and people, information and technology, partners and suppliers, value streams and processes
  4. 04
    Service value system (2.5%) — five components, opportunity and demand as inputs, value as the output
  5. 05
    Service value chain (5%) — plan, improve, engage, design and transition, obtain/build, deliver and support
  6. 06
    Purpose and key terms of 15 practices (17.5%) — one-line purposes and terms such as incident, problem, known error, CI, event
  7. 07
    Seven practices in detail (42.5%) — continual improvement, change enablement, incident, problem, service request, service desk, service level management

Wrong instinct vs correct approach

Several incidents are logged together, including a slow payroll system affecting all staff
✕ Wrong instinct

Resolve incidents in the order they were logged

✓ Correct approach

Incidents are prioritized by an agreed classification based on impact and urgency, so the payroll degradation goes first. A slowdown counts as an incident because ITIL includes any reduction in service quality, not only outages.

A user asks for access to a standard software package through the portal
✕ Wrong instinct

Log it as a low-priority incident ticket

✓ Correct approach

Nothing has failed, so this is a service request: a predefined, agreed action that is part of normal service delivery. Service request management fulfils it, often through an automated, pre-approved workflow.

Which value chain activity makes service components available to agreed specifications, whether bought or built?
✕ Wrong instinct

Design and transition, because components enter live use

✓ Correct approach

Obtain/build ensures components are available when and where needed and meet agreed specifications, covering supplier-acquired and internally built items. Design and transition is anchored on quality, costs and time to market.

An option lists governance as one of the four dimensions of service management
✕ Wrong instinct

Accept governance as a valid dimension

✓ Correct approach

The four dimensions are organizations and people, information and technology, partners and suppliers, and value streams and processes. Governance is a service value system component; PESTLE factors sit outside and constrain all four.

Know these cold

  • ▸ Six value chain activities — lan, improve, engage, design and transition, obtain/build, deliver and support
  • ▸ The service value system turns opportunity and demand into value through five components
  • ▸ Sponsor authorizes budget, customer defines requirements and owns outcomes, user uses the service
  • ▸ Utility means fit for purpose; warranty assures agreed availability, capacity, security and continuity
  • ▸ Standard changes are pre-authorized, normal changes go to a change authority, emergency changes are expedited
  • ▸ Incident is an unplanned interruption or quality reduction; problem is a cause or potential cause
  • ▸ A workaround reduces impact without resolving the problem; known errors stay open until fixed
  • ▸ The service desk is the single point of contact; it does not resolve every incident itself
  • ▸ Continual improvement model — ision, where now, where to be, how, act, did we get there, momentum
  • ▸ An event is a significant change of state; most events are not incidents

Can you answer these without checking your notes?

In this scenario: "Several incidents are logged together, including a slow payroll system affecting all staff" — what should you do first?
Incidents are prioritized by an agreed classification based on impact and urgency, so the payroll degradation goes first. A slowdown counts as an incident because ITIL includes any reduction in service quality, not only outages.
In this scenario: "A user asks for access to a standard software package through the portal" — what should you do first?
Nothing has failed, so this is a service request: a predefined, agreed action that is part of normal service delivery. Service request management fulfils it, often through an automated, pre-approved workflow.
In this scenario: "Which value chain activity makes service components available to agreed specifications, whether bought or built?" — what should you do first?
Obtain/build ensures components are available when and where needed and meet agreed specifications, covering supplier-acquired and internally built items. Design and transition is anchored on quality, costs and time to market.

Common Exam Mistakes — What candidates get wrong

Assuming emergency changes skip authorization altogether

Emergency changes are still assessed and authorized, through an expedited process that may use a separate change authority, reduced testing and deferred documentation. Only standard changes are pre-authorized, with risk assessed when the procedure is created.

Placing workaround documentation in error control

Problem management has three phases: problem identification, problem control (analysis, with workarounds and known errors documented) and error control (managing toward a permanent fix). Restoring a large outage is incident management, not problem management.

Choosing optimize and automate whenever a tool is mentioned

If the scenario is about removing unnecessary steps, the principle is keep it simple and practical. Optimize and automate means optimizing first, then automating where sensible; automating a messy process only automates waste.

Naming release management as the practice that moves software to production

ITIL 4 separates the two: deployment management moves components to live environments, while release management makes new or changed services and features available for use. Release and deployment can happen at different times.

Trusting all-green SLA reports as proof customers are satisfied

The watermelon effect describes green metrics with unhappy customers. Service level management should combine customer engagement, feedback and outcome-based measures linked to business results, written in simple language, not operational metrics alone.

Resources to help you pass ITIL 4 Foundation on your first attempt

ITIL 4 Foundation rewards exact definitions. Check whether you can tell incident, problem, request and change apart.