Honest question — which ITIL topic actually destroys people on the exam?

Just passed last week so this is very fresh for me. The incident vs. problem vs. change enablement triangle absolutely got me — I went in thinking I had it down and then hit a question where the scenario had elements of all three and I genuinely froze. The thing that finally clicked for me was stopping trying to memorize definitions and instead asking "what's the actual goal of this practice?" Incident management wants to restore service fast, full stop. Problem management wants to eliminate the root cause so it stops happening. Once I framed it that way, the tricky scenario questions got a lot clearer.

The other one that catches people off guard is continual improvement. It sounds so intuitive that you don't study it hard enough, and then the exam hits you with a question about where it sits in the service value chain and you realize you just assumed you knew. It touches literally everything — that's kind of the whole point — but the exam wants you to be precise about it.

Honestly the practices section just demands more time than it feels like it should. I kept thinking "I get the concept" and moving on, and that's exactly where I lost points. Going back and doing practice questions specifically for the ones that felt obvious was what saved me in the end.

Failed my first attempt by four questions and honestly it stung more than I expected. The practices section is exactly what got me too — I kept mixing up incident management and problem management in ways that felt obvious in hindsight but were genuinely confusing under exam conditions. The thing is, I "knew" the definitions. I could recite them. But the questions don't ask you to recite, they give you a scenario and expect you to pick the right practice, and that's a completely different skill.

What I changed for round two was stopping the flashcard grind and actually working through scenario questions until I could feel the difference, not just describe it. Incident management is reactive — restore service, fast. Problem management is about digging into why incidents keep happening. Sounds simple but when you're reading a question about a recurring server outage and they're asking what the next step is, your brain wants to blur the line. I also stopped treating the four dimensions and guiding principles as "background reading" and started paying attention to how they show up embedded in practice-level questions. They're everywhere once you notice them.

One other thing that tripped me up the first time: service request management vs. incident management. So many people conflate those. A password reset is not an incident. Keeping that boundary sharp in your head matters more than you'd think on exam day.

The practices section is where most people silently bleed points without realizing it until they're staring at their score breakdown. Incident vs. problem vs. change enablement — on paper they sound distinct, but the exam loves to write scenarios where two of them are technically happening at the same time and you have to pick which practice "owns" that moment. That's the part that got me early on.

What actually helped me lock it in was drilling scenario questions specifically, not just reading definitions. I used free itil practitioner questions and answers and the thing I liked was that the explanations didn't just tell you the right answer — they'd spell out why the other three options were wrong, which is honestly where the real learning happens with ITIL. Once I understood the logic behind the distractors, the practices started feeling less like a list to memorize and more like a framework with actual internal logic.

The other one that trips people up is the service value chain activities — specifically the difference between "Obtain/Build" and "Design & Transition." They blur together in practice questions and if you're pattern-matching on keywords instead of understanding what each activity is responsible for, you'll get burned. Worth going back and mapping each practice to where it fits in the SVC before your next attempt.

The practices overlap is genuinely the hardest part, and incident vs. problem management is where most people stumble because the distinction feels artificial until you've seen it applied. What clicked for me was stopping the flashcard grind and just mapping out a single realistic IT scenario end-to-end — like a database server going down. I'd walk through it: the user calls the helpdesk, that's incident management kicking in, goal is restore service fast. Then I'd ask "but why did this happen three Tuesdays in a row?" — now we're in problem management territory, trying to find the root cause. Running through five or six scenarios like that in a notebook made the boundary between them stick in a way that definitions never did.

The other thing that helped was treating the guiding principles and the four dimensions as a lens over each practice, not separate topics. A lot of exam questions aren't really asking you to define something — they're asking you to apply it in context. So when a question describes a scenario, I'd ask myself "which dimension is this touching?" before even reading the answer choices. That slowed me down at first but cut down on the trap answers significantly. The traps are almost always one practice that sounds right but belongs to a slightly different phase of the service value chain.

Barely passing still counts — you got there. If you're going on to Managing Professional modules, that foundation pain is actually useful because the practices get way more granular and you'll be glad you wrestled with the basics.

Failed my first attempt and honestly the 34 practices wrecked me too. I'd been studying definitions in isolation, trying to memorize what each one "does," but the exam doesn't care about that. It wants to know how they interact, and I wasn't ready for that at all. The second time around I stopped reading practice descriptions and started doing scenario questions almost exclusively. That's what shifted it for me.

The incident vs problem distinction is the one that trips people up the most, I think. Incident management is about restoring service fast. Problem management is about figuring out why it keeps happening. Sounds obvious written out like that, but when you're in a question with four plausible answers it gets messy. Just keep asking yourself "are we putting out the fire or finding the source?" and you'll start picking the right one more often than not.