The incident management practice aims to minimize the negative impact of incidents by restoring normal service operation as quickly as possible1. A major incident is an incident that has a significant impact or urgency for the business and requires a high level of coordination and resources to resolve2. The most likely way of resolving major incidents is by forming a temporary team working together to identify a resolution, such as a major incident team or a swarming team3. The other statements are not true because:

Users establishing a resolution using self-help: Self-help is an option for users to resolve their own incidents with minimal or no assistance from the service provider, but it is not suitable for major incidents that require urgent and expert attention3.

The service desk identifying the cause and a resolution: The service desk is responsible for logging, categorizing, prioritizing, and escalating incidents, but it may not have the skills or authority to identify the cause and a resolution for major incidents that involve multiple teams or suppliers3.

A support team following detailed procedures for investigating the incident: A support team may follow detailed procedures for investigating the incident, but it may not be able to resolve major incidents that require cross-functional collaboration or escalation3. References: ITIL Foundation - ITIL 4 Edition, page 14; ITIL® 4 – A Pocket Guide, page 32; ITIL® 4 Practice Guide: Incident Management, page 8.