ServiceNow · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When configuring a Discovery Behavior, what is the primary purpose of defining 'Probes' within the behavior?
To define the IP address range.
To define the credential to be used.
To define which MID Server to use.
To control which probes are launched for specific device types.
Probes within a Discovery Behavior define which probe activities are launched against particular device types, letting administrators tailor discovery to the target classification. This controls probe selection per device type rather than scheduling or credential handling.
If you are troubleshooting a Discovery issue where the device is correctly classified but no data is being populated in the CMDB, which phase should you investigate first?
Exploration
Exploration is the phase that probes a classified device to gather attributes and populate the CMDB; classification alone does not collect data. If the device is correctly classified but records remain empty, the exploration step has failed, so investigate it before patterns, probes or sensors.
Shazzam
Schedule
Classification
Identification
You need to ensure that Discovery ignores a specific range of IP addresses within a larger CIDR block that is already configured. What is the most efficient configuration approach?
Add the ranges to the Excluded IP Ranges related list.
The Excluded IP Ranges related list lets you carve out specific addresses from an already-configured CIDR block without editing or splitting that range. This is the most efficient approach because Discovery skips those addresses during scanning while the parent range remains intact.
Configure a Discovery Behavior to exclude the IPs.
Delete the original schedule and recreate two smaller schedules.
Create an ACL to block the IP addresses.
During the Shazzam phase, Discovery identifies that a port is open. If the port corresponds to a configured classifier but no trigger probe is defined, what is the default behavior?
The classification phase initiates, but exploration cannot trigger.
When a port matches a configured classifier but lacks a trigger probe, Shazzam still passes it to classification, so the device is identified. Exploration, however, depends on trigger probes firing; without one, no further probing occurs, leaving the port classified but unexplored.
The CI is ignored, and the scan continues.
Discovery automatically guesses the OS type.
The scan for that IP is immediately aborted.
An administrator needs to restrict a Discovery Schedule to only scan specific IP addresses within a subnet during off-peak hours. Which configuration fulfills this requirement?
Configure the 'Exclude IP' field directly on the Discovery Schedule record.
Create a Discovery Range in the Discovery Range Sets table and link it to the Discovery Schedule.
Discovery Range Sets are the standard way to define subsets of IPs for a schedule.
Use the Shazzam probe parameters in the behavior definition.
Modify the MID Server cluster properties to filter IP addresses.
What is the purpose of the 'Shazzam' phase in the Discovery process?
To run patterns.
To classify the device type.
To determine which ports are open on the target devices.
Shazzam probes target devices to identify open ports and active services, feeding this data to later classification phases. This directly fulfils the stem's requirement to define the phase's purpose: port and service detection, not credential testing, CI creation, or dependency mapping.
To update the CMDB.
Want more Discovery Configuration practice?
Practice this domainYou are troubleshooting a scenario where Discovery is creating duplicate CIs for the same server. Which table should you inspect to verify the Identification Rule settings for the specific CI class?
cmdb_identifier_entry
The `cmdb_identifier_entry` table stores the identification rules that Discovery applies per CI class, so inspecting it reveals exactly which attribute combinations are being matched. Duplicates arise when those entries are misconfigured or missing, causing the same server to fail matching and create a new CI record instead.
discovery_device_history
sys_reconciliation_rule
cmdb_ci_relation
During a Discovery run, a Linux server is identified, but the CMDB record is not updated with the latest memory information. Which log should be inspected to troubleshoot the Identification and Reconciliation engine (IRE) process?
System Logs > Node Logs
Discovery > Pattern Logs
System Logs > Discovery Logs
System Logs > Identification and Reconciliation Engine Logs
The Identification and Reconciliation Engine logs record how discovered data is matched, merged and written to the CMDB, including why attributes such as memory are rejected or skipped. Inspecting them reveals the reconciliation failure preventing the record update.
A Discovery scan successfully identifies a Linux server, but the 'Operating System' field is not being updated in the CMDB. You have verified that the pattern correctly extracts the OS version. What is the most likely configuration issue?
The CI class is marked as 'Read Only' in the CMDB dashboard.
The Discovery schedule is using the wrong MID server.
A Reconciliation Rule exists that prevents the 'ServiceNow' data source from updating the 'Operating System' attribute.
Reconciliation Rules govern which data source may update a given CMDB attribute. If a rule excludes ServiceNow as an allowed source for the Operating System field, the pattern's correctly extracted value is discarded, leaving the attribute unchanged despite successful discovery.
The Linux pattern is not published to the production environment.
You notice that Discovery is creating duplicate CIs for Windows servers. Which CMDB feature should you investigate first to ensure Discovery correctly identifies existing CIs?
Identification Rules
Identification Rules define which CI attributes (such as serial number, name, or BIOS UUID) are matched to detect an existing CI before insertion. Misconfigured or missing rules cause Discovery to create new records instead of updating existing ones, producing duplicates.
Discovery Schedules
Transform Maps
Data Preserver
When reviewing the CMDB Health Dashboard, you notice a high 'Staleness' score for several Windows servers. What is the primary cause of high staleness?
The CIs are not being reconciled correctly.
The Discovery credentials failed during the last scan.
The CIs have invalid relationship types.
The CIs have not been updated by Discovery within the configured staleness threshold.
Staleness measures how long since a CI's last update by Discovery. When Discovery has not refreshed the Windows server records within the configured staleness threshold, the CMDB Health Dashboard flags them, producing the high staleness score described in the stem.
Which tool provides a visual representation of how different data sources are contributing to the current state of a CI record?
Discovery Log
CI Timeline
The CI Timeline displays a history of updates and the data sources that performed them.
CMDB Health Dashboard
Service Map
Want more CMDB Integration And Maintenance practice?
Practice this domainWhen debugging a pattern that fails to parse a JSON response, which tool in the Pattern Designer provides the most granular view of the variable state after a 'Parse JSON' step?
The 'Variables' tab in the Debugger
The Variables tab shows the content of the temporary memory during the current debug session.
Pattern Log
The CMDB CI Class Manager
The Discovery Status record
You are creating a new Discovery pattern and need to extract data from a command output where lines are separated by a consistent delimiter. Which parsing strategy should you use to map these specific values to table attributes?
JSON parsing
XML parsing
Delimited parsing
Delimited parsing splits command output on a consistent separator, extracting each field into distinct values for attribute mapping. Because the stem specifies lines separated by a uniform delimiter, this strategy directly matches the data structure and populates the target attributes reliably.
Regex parsing
When debugging a pattern that fails during the identification phase, which TWO areas should you inspect in the Pattern Designer?
Credentials
Schedule
Identification section
The Identification section defines the CI identification rules, so failures there stem from incorrect identifier entries, conditions or table selection. Inspecting it directly reveals why the pattern cannot match incoming data during the identification phase.
Identification rules
Identification rules define how the pattern classifies discovered configuration items, so inspecting them reveals why the identification phase fails. They map collected attributes to CI classes and matching criteria, directly satisfying the stem's constraint of debugging identification-phase failures within Pattern Designer.
Discovery log
During pattern debugging, you notice that a specific step is failing to run on a MID Server. You want to see the exact input and output of that step. Where should you look?
Discovery Log
ECC Queue
MID Server Agent Log
Pattern Designer Debugger
The Pattern Designer Debugger executes a pattern step-by-step on the MID Server, exposing each step's exact input and output values. This satisfies the requirement to inspect the specific failing step's data, which the standard pattern log does not capture.
You are modifying a pattern and need to extract a specific attribute from a JSON response returned by an API. Which step type is most appropriate for this task?
Parse Variable
Set Parameter
Regex Extract
Parse JSON
Parse JSON extracts named attributes from a JSON payload returned by an API, satisfying the requirement to pull a specific attribute. It converts the response into structured values usable by later pattern steps, unlike simple string or regex operations.
You are creating a pattern to capture a version number from a command line output. The output is 'Version: 1.2.3.4'. Which parsing strategy is most efficient for this specific string?
Name-Value pair parsing
Delimiter parsing
Regex parsing
Regex parsing extracts the version substring directly by matching the literal "Version:" anchor and capturing the numeric pattern \d+\.\d+\.\d+\.\d+, satisfying the need to isolate 1.2.3.4 from surrounding text in a single pass. Fixed-index or delimiter splitting would require extra steps to strip the label and punctuation.
XML parsing
Want more Discovery Pattern Design practice?
Practice this domainYou notice a MID Server has the status 'Down' in the ServiceNow instance, but the service is running on the host. What is the first step to troubleshoot?
Restart the ServiceNow instance.
Update the MID Server version in the MID Server record.
Reinstall the MID Server.
Check the agent log file (agent/logs/agent0.log.0) for connection errors.
The agent log records connection attempts, authentication failures and MID Server communication errors, so it reveals why the instance reports 'Down' despite the service running. This satisfies the requirement to identify the connection fault first before restarting or reconfiguring anything.
A customer needs to restrict a MID Server to only perform discovery on specific IP ranges. Which mechanism should be used to accomplish this?
Set the 'Scan Limitation' property on the MID Server configuration file.
Use the 'Discovery Schedule' Exclude IP list only.
Define 'MID Server IP Ranges' related list on the MID Server record.
The MID Server IP Ranges related list constrains discovery to the specified address ranges, satisfying the requirement to limit scanning to particular subnets. Entries added there act as an inclusion filter, so the MID Server only probes those ranges and ignores everything else, directly enforcing the customer's scope restriction.
Apply a Business Rule to the ECC Queue.
Where do you define the MID Server capabilities that allow it to perform specific tasks like Orchestration or Discovery?
In the 'Discovery Definition' module.
In the 'MID Server Properties' module.
In the config.xml file.
In the MID Server record's 'Capabilities' related list.
The Capabilities related list on the MID Server record controls which functions that agent may run, such as Discovery or Orchestration. Adding or removing capability entries directly governs task eligibility, satisfying the stem's requirement for where capabilities are defined.
You are deploying a MID Server behind a strict firewall. To ensure the MID Server can communicate with the ServiceNow instance without opening unsolicited inbound ports, which configuration is required?
Ensure the firewall allows outbound HTTPS traffic from the MID Server to the instance.
The MID Server initiates all communication, so the firewall only needs to permit outbound TCP 443 to the instance. No inbound port or DMZ listener is required, satisfying the strict-firewall constraint while enabling discovery and orchestration.
Set the MID Server listener port to 8443 on the local firewall.
Configure the instance to use an inbound static IP for the MID Server.
Enable the 'Inbound Proxy' setting in the MID Server configuration file.
A MID Server Cluster is configured with two nodes. One node goes down. How does the MID Server Cluster handle the failover?
The cluster requires a manual restart of the remaining node to resume work.
The instance marks the MID Server as 'Down' and stops all processing for the entire cluster.
All tasks are automatically lost and must be manually re-run.
The cluster automatically shifts the workload to the healthy node in the cluster.
A ServiceNow MID Server Cluster uses an active/active design, so both nodes continuously poll the instance for jobs. When one node fails, the healthy node simply continues collecting the remaining scheduled work; no manual intervention or configuration change is required. This satisfies the stem's automatic failover requirement.
When using multiple MID Servers for load balancing, what is the best way to group them?
Create a MID Server Cluster.
A MID Server Cluster groups multiple MID Servers under one logical name, so Discovery distributes horizontal jobs across members automatically. This satisfies the stem's load-balancing requirement, since clusters provide built-in failover and workload sharing rather than manual per-server assignment.
Use the 'MID Load Balancer' application.
Update the config.xml on each server to point to the same instance node.
Assign them the same IP range.
Want more Mid Server Management practice?
Practice this domainThe vendor does not publish an exact question count for the SERVICENOW-CIS-DISCOVERY. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Discovery Configuration, CMDB Integration And Maintenance, Discovery Pattern Design, Mid Server Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official ServiceNow SERVICENOW-CIS-DISCOVERY exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.