A user cannot sign in to a business application. The service desk restores access by restarting a failed component. The user is working again, but the same fault returns the next morning. Was the team dealing with an incident or a problem? Potentially both, at different points.

This is one of the most useful distinctions to understand when studying ITIL 4 Foundation. It also improves how you think about day-to-day support work.

Start with the immediate disruption

An incident is an unplanned interruption to a service or a reduction in service quality. Incident management focuses on restoring normal service as quickly as practical. The service desk might gather symptoms, prioritise the impact, contact a specialist and apply a known workaround. The immediate question is: How do we get the service working for users?

In the sign-in example, restoring access lets colleagues resume their work. That matters even if the team does not yet know precisely why the component failed.

Then investigate the underlying cause

A problem concerns an actual or potential cause of one or more incidents. Problem management helps reduce the likelihood or impact of future incidents by identifying causes, workarounds and longer-term solutions. Its question is: Why did this happen, and how can we stop it happening again?

If the application fails every morning, simply restarting it each time is not enough. The team might compare logs, check a scheduled task and identify a capacity issue. A documented workaround may help incident responders while the permanent fix is planned and tested.

Situation	Main focus
Staff cannot access a service now	Restore service through incident management
The same failure keeps returning	Investigate its cause through problem management
A known workaround restores access	Use it to reduce disruption while further work continues

How to handle an exam scenario

Read the wording before choosing an answer. If the question asks for the best way to restore service now, think about incident management. If it asks how to investigate repeated failures or prevent recurrence, think about problem management. A single real-world event can involve both practices, so do not assume that using one means the other is unnecessary.

Create two columns in your revision notes: "restore service" and "understand cause". For each practice question you miss, write down the phrase in the scenario that points to one of those goals. This builds judgement rather than relying on memorised keywords alone.

To put the distinction into a broader service-management context, explore the ICT Exam Academy ITIL 4 Foundation course.