SERVICENOW-CIS-DISCOVERY Discovery Configuration — 30 Questions

Question 1

Which phase of Discovery is responsible for matching the fingerprint of a device to a specific Classification record?

Accepted Answer

Classification. Classification is the phase where the device is identified based on the fingerprints returned by probes.

Answer

Identification

Answer

Shazzam

Answer

Exploration

Question 2

During the Classification phase, Discovery identifies a device as a Linux server but fails to populate the serial number. Which troubleshooting step is most effective?

Accepted Answer

Check the ECC Queue for 'Input' records related to the SNMP probes and review the pattern logs.. The ECC Queue is the central communication channel between the MID Server and the ServiceNow instance, and it logs every probe and sensor execution. When a Linux server is classified but serial number is missing, the issue typically lies in the SNMP probe's output or the pattern's parsing logic. Checking 'Input' records in the ECC Queue for SNMP probes and reviewing pattern logs directly reveals whether the probe returned the serial number and whether the pattern failed to extract it, making this the most targeted troubleshooting step.

Answer

Change the MID Server user to an admin account.

Answer

Delete the Discovery Schedule and recreate it.

Answer

Re-run the Shazzam probe for that specific IP.

Question 3

A customer requires that a specific Discovery Schedule only executes during maintenance windows on weekends. Which configuration setting should be modified?

Accepted Answer

Adjust the 'Run' field to 'Periodically' and select a custom Schedule record.. Discovery Schedules control when discovery runs, and the 'Run' field determines the execution pattern. Setting it to 'Periodically' and selecting a custom Schedule record allows the schedule to run only during defined maintenance windows, such as weekends. This is the correct configuration point for time-based execution constraints.

Answer

Change the discovery pattern logic.

Answer

Update the Discovery Behavior record.

Answer

Modify the MID Server cluster affinity.

Question 4

Which of the following is NOT a phase of the Discovery process?

Accepted Answer

Verification. The Discovery process phases are Identification, Exploration, and Shazzam (which is a port scanner phase). Verification is not a standard phase; it is part of the overall discovery cycle but not a named phase. Therefore, Verification is NOT a phase.

Answer

Identification

Answer

Shazzam

Answer

Exploration

Question 5

Which record type is used to associate a credential with a specific Discovery Schedule, allowing for secure and automated credential selection?

Accepted Answer

Credential Alias. A Credential Alias is used to associate a credential with a specific Discovery Schedule. It allows for secure and automated credential selection by mapping an alias to one or more credentials, which are then used during Discovery. The schedule references the alias, and the MID Server selects the appropriate credential based on the alias and target.

Answer

Discovery Range

Answer

Discovery Behavior

Answer

MID Server Cluster

Question 6

A Discovery Schedule is configured but not running. Where is the first place you should look for errors?

Accepted Answer

Discovery Log. The Discovery Log is the primary diagnostic tool for Discovery schedules. It records the execution status of each phase (e.g., Scanning, Identification, Exploration) and captures errors such as authentication failures, probe timeouts, or pattern issues. When a schedule is not running, the Discovery Log will show whether the schedule was triggered, if it failed to start, or if it encountered an error during execution. This is the first place to check because it provides a timeline of events specific to the Discovery process, unlike system or MID Server logs which are more general.

Answer

System Logs

Answer

MID Server Logs

Answer

CMDB Health Dashboard

Question 7

What happens if a device is discovered that matches two different Classification records?

Accepted Answer

It uses the classifier with the highest priority.. When a discovered device matches multiple Classification records, ServiceNow Discovery evaluates all matching classifiers and applies the one with the highest priority value. Priority is a numeric field on the Classification record, and the classifier with the highest priority (lowest numeric value depending on configuration, but conceptually the top-ranked one) wins. This deterministic tie-break prevents ambiguity and ensures consistent CI classification across the environment.

Answer

It errors out and stops discovery.

Answer

It asks the user to choose.

Answer

It applies both classifiers.

Question 8

Which of the following is a valid method to trigger a Discovery scan manually?

Accepted Answer

Click 'Discover Now' on the Discovery Schedule record.. You can click the 'Discover Now' button on a Discovery Schedule record.

Answer

Edit the ECC Queue.

Answer

Restart the MID Server.

Answer

Run a Business Rule.

Question 9

Which field on the Discovery Schedule allows you to restrict the discovery to specific device types?

Accepted Answer

Behavior. The 'Behavior' field is used to select which probes/patterns run, effectively limiting what is discovered.

Answer

Schedule

Answer

MID Server

Answer

IP Range

Question 10

Which phase comes immediately after the Identification phase?

Accepted Answer

Exploration. The phases are Shazzam -> Classification -> Identification -> Exploration.

Answer

Reconciliation

Answer

Classification

Answer

Shazzam

Question 11

When configuring a custom probe, what is the best practice for ensuring that the probe executes only on relevant devices?

Accepted Answer

Associate the probe with a specific Classifier.. Linking the probe to a specific 'Classifier' or 'Pattern' ensures it only runs when the device type matches.

Answer

Include logic in the probe script.

Answer

Add the IP address to the probe.

Answer

Assign the probe to all schedules.

Question 12

When a MID server is part of a cluster, what happens if one node fails during a discovery scan?

Accepted Answer

The task is re-assigned to another available node in the cluster.. In a ServiceNow MID Server cluster, discovery tasks are distributed across available nodes. If a node fails mid-scan, the MID Server cluster's heartbeat and task reassignment mechanism detects the failure and automatically reassigns the in-progress discovery task to another healthy node in the cluster. This ensures high availability and resilience for discovery operations without manual intervention.

Answer

The scan is marked as 'Partial'.

Answer

The scan restarts from the beginning.

Answer

The scan fails completely.

Question 13

Which TWO of the following are primary functions of a Discovery Behavior?

Accepted Answer

Assigning specific probes to a schedule. A Discovery Behavior's core purpose is to bind specific probes (and probe parameters) to a schedule, determining when and how those probes run against discovered devices. Option C is also correct because the behavior defines what data to collect for particular device types by selecting the appropriate probes and their parameters for those classifications. Option A is not a behavior function; target IP ranges are defined in a Discovery Schedule's IP range or in a Discovery Range Set. Option D is not part of a behavior; MID Server credentials are managed via Credentials and MID Server configuration records. Option E is not a behavior function; the discovery job timing is controlled by the Discovery Schedule, not the behavior itself.

Answer

Defining the target IP address range

Answer

Managing MID Server credentials

Answer

Scheduling the discovery job

Question 14

Which THREE of the following are valid states for a MID Server?

Accepted Answer

Up. In ServiceNow, a MID Server's valid operational states are Up, Down, and Paused. Option A (Up) is correct because it indicates the MID Server is running and actively able to execute jobs and probes for its instance. Option C (Down) is correct because it represents a MID Server that is not currently running or reachable, so it cannot process work. Option D (Paused) is correct because an administrator can pause a MID Server to temporarily stop it from accepting new jobs while keeping it registered. Option B (Deleted) is not a state; deletion removes the MID Server record entirely rather than being a status value. Option E (Pending Update) is not a valid MID Server state; upgrade-related conditions are handled through the upgrade/version fields and processes, not as a MID Server status.

Answer

Deleted

Answer

Pending Update

Question 15

Which THREE of the following are potential outcomes for an IP in a Discovery scan?

Accepted Answer

Classification failed. An IP can be identified as a device, it might be unreachable, or it might be classified but fail during exploration.

Answer

Automatically moved to a different subnet

Answer

Automatically created as a user

Question 16

Which THREE of the following are standard Discovery phases that can be seen in the 'Discovery Status' record?

Accepted Answer

Exploration. The four phases are Shazzam, Classification, Identification, and Exploration. Any three of these are valid.

Answer

Incident Creation

Answer

Notification

Question 17

Which THREE of the following are true about Discovery Behaviors?

Accepted Answer

They define which probes to use. Discovery Behaviors are configuration records in ServiceNow Discovery that specify which probes and sensors run during a discovery, so option A is correct because they define which probes to use. Option B is correct because Discovery Behaviors ship with default settings for common discovery patterns (e.g., Windows, Linux, SNMP), letting you run standard discoveries without building probe logic from scratch. Option C is incorrect because populating/updating the CMDB is done by the identification and reconciliation engine (IRE) after discovery results are processed, not by the Discovery Behavior itself. Option D is correct because a Discovery Behavior is a reusable record that can be attached to multiple discovery schedules. Option E is incorrect because MID Server selection and cluster affinity are controlled by MID Server cluster configuration and the schedule's MID Server settings, not by Discovery Behaviors.

Answer

They automatically update the CMDB

Answer

They manage the MID Server cluster affinity

Question 18

Which THREE of the following are true regarding Discovery IP Ranges?

Accepted Answer

They are configured within the Discovery Schedule. Option A is correct because Discovery IP Ranges are defined as part of the Discovery Schedule configuration in ServiceNow Discovery, where each schedule specifies the IP ranges, MID Server, and credentials to use. Option C is correct because the IP ranges determine exactly which IP addresses the Discovery schedule will probe, thereby defining the scope of the scan. Option D is correct because Discovery IP Ranges support exclusion entries (for example, using a range with an exclusion flag or a separate excluded range) so specific devices or subnets can be skipped and not scanned. Option B is not correct because IP ranges are tied to the Discovery Schedule, not assigned to individual MID Servers, although a schedule references a MID Server or MID Server cluster. Option E is not correct because IP ranges are statically configured by an administrator and are not automatically updated when the network changes.

Answer

They are assigned to individual MID servers

Answer

They automatically update based on network changes

Question 19

Which THREE of the following are true about Shazzam?

Accepted Answer

It is the first phase of Discovery. It scans ports, is the first phase, and identifies active IPs.

Answer

It identifies the O/S version

Answer

It updates the CI serial number

Question 20

You need to ensure that Discovery only scans specific ports for a particular set of Linux servers. Where should you configure this customized port list to override the default Shazzam probe settings?

Accepted Answer

In the Discovery Behavior record. The Discovery Behavior record is where you override default Shazzam probe behavior, including the port list used for scanning. By attaching a custom port list to the Discovery Behavior, you scope the scan to only the specified ports for the targeted Linux servers. This overrides the default Shazzam probe port configuration without affecting other discovery schedules or ranges.

Answer

In the Discovery Schedule record

Answer

In the MID Server capability list

Answer

In the Discovery Range set