SERVICENOW-CIS-DISCOVERY Discovery Configuration Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are standard Discovery phases that can be seen in the 'Discovery Status' record?

Accepted Answer

Exploration. The four phases are Shazzam, Classification, Identification, and Exploration. Any three of these are valid.

Answer

Incident Creation

Answer

Notification

Question 2

Which THREE of the following are true about Discovery Behaviors?

Accepted Answer

They define which probes to use. Discovery Behaviors are configuration records in ServiceNow Discovery that specify which probes and sensors run during a discovery, so option A is correct because they define which probes to use. Option B is correct because Discovery Behaviors ship with default settings for common discovery patterns (e.g., Windows, Linux, SNMP), letting you run standard discoveries without building probe logic from scratch. Option C is incorrect because populating/updating the CMDB is done by the identification and reconciliation engine (IRE) after discovery results are processed, not by the Discovery Behavior itself. Option D is correct because a Discovery Behavior is a reusable record that can be attached to multiple discovery schedules. Option E is incorrect because MID Server selection and cluster affinity are controlled by MID Server cluster configuration and the schedule's MID Server settings, not by Discovery Behaviors.

Answer

They automatically update the CMDB

Answer

They manage the MID Server cluster affinity

Question 3

Which THREE of the following are true regarding Discovery IP Ranges?

Accepted Answer

They are configured within the Discovery Schedule. Option A is correct because Discovery IP Ranges are defined as part of the Discovery Schedule configuration in ServiceNow Discovery, where each schedule specifies the IP ranges, MID Server, and credentials to use. Option C is correct because the IP ranges determine exactly which IP addresses the Discovery schedule will probe, thereby defining the scope of the scan. Option D is correct because Discovery IP Ranges support exclusion entries (for example, using a range with an exclusion flag or a separate excluded range) so specific devices or subnets can be skipped and not scanned. Option B is not correct because IP ranges are tied to the Discovery Schedule, not assigned to individual MID Servers, although a schedule references a MID Server or MID Server cluster. Option E is not correct because IP ranges are statically configured by an administrator and are not automatically updated when the network changes.

Answer

They are assigned to individual MID servers

Answer

They automatically update based on network changes

Question 4

Which THREE of the following are true about Shazzam?

Accepted Answer

It is the first phase of Discovery. It scans ports, is the first phase, and identifies active IPs.

Answer

It identifies the O/S version

Answer

It updates the CI serial number

Question 5

You need to ensure that Discovery only scans specific ports for a particular set of Linux servers. Where should you configure this customized port list to override the default Shazzam probe settings?

Accepted Answer

In the Discovery Behavior record. The Discovery Behavior record is where you override default Shazzam probe behavior, including the port list used for scanning. By attaching a custom port list to the Discovery Behavior, you scope the scan to only the specified ports for the targeted Linux servers. This overrides the default Shazzam probe port configuration without affecting other discovery schedules or ranges.

Answer

In the Discovery Schedule record

Answer

In the MID Server capability list

Answer

In the Discovery Range set

Question 6

Which phase of Discovery is responsible for determining whether a device is a Windows server, a Linux server, or a network switch?

Accepted Answer

Classification. The Classification phase is responsible for identifying the device type by matching probe results against Classification criteria.

Answer

Identification

Answer

Shazzam

Answer

Exploration

Question 7

Which TWO of the following are true regarding the Shazzam phase?

Accepted Answer

It is used to identify which ports are open. Shazzam is the first phase and is used to identify which ports are open on discovered IPs.

Answer

It gathers detailed CI attributes

Answer

It updates the CMDB directly

Answer

It performs credential validation

Question 8

A discovery administrator needs to ensure that a new subnet range is scanned only during a specific two-hour maintenance window each night. The MID Server is already configured and validated. Which configuration should the administrator create and assign to achieve this requirement?

Accepted Answer

A Discovery Schedule with the desired subnet and a run time of 02:00, assigned to the appropriate MID Server.. Discovery Schedules are the correct tool for defining what IP ranges to scan and when to scan them. By creating a schedule with the desired subnet and setting the run time to 02:00, the administrator ensures the scan occurs only during the maintenance window. Other options either control different aspects of discovery or introduce unnecessary complexity.

Answer

A MID Server property that limits the IP range and sets a cron-like schedule.

Answer

A Discovery Behavior that includes only the subnet range and a time condition.

Answer

A Scheduled Job that runs a custom script to initiate discovery on the subnet at 02:00.

Question 9

A discovery administrator is configuring a new Discovery Schedule for a subnet that contains several load balancers and firewalls. The administrator wants to ensure that only specific IP addresses within the subnet are scanned, and that the schedule runs only during a designated maintenance window. Which combination of Discovery Schedule configuration elements should the administrator use to achieve this?

Accepted Answer

Set the schedule's 'Discover' field to 'IPs' and enter the specific IP addresses, then configure the 'Run' field to 'Periodically' with a specific start time and duration.. The correct configuration uses the Discovery Schedule's 'Discover' field set to 'IPs' to specify individual addresses, and the 'Run' field set to 'Periodically' with a defined start time and duration to constrain execution to the maintenance window. This combination precisely addresses both the IP restriction and the timing requirement without relying on manual intervention or broad subnet scans.

Answer

Set the schedule's 'Discover' field to 'IP range' and specify the subnet, then use a 'Discovery Behavior' to exclude the load balancers and firewalls.

Answer

Set the schedule's 'Discover' field to 'IPs' and enter the specific IP addresses, then configure the 'Run' field to 'On demand' and manually trigger it during the maintenance window.

Answer

Set the schedule's 'Discover' field to 'IPs' and enter the specific IP addresses, then configure the 'Run' field to 'Periodically' and set the 'Max run time' to 1 hour.

Question 10

A discovery administrator notices that several Windows servers are being classified as 'Linux' in the CMDB. After investigating, the administrator finds that the Shazzam phase is returning incorrect port information. Which action should the administrator take to resolve the misclassification?

Accepted Answer

Update the Classification criteria to correctly match Windows servers based on the data returned by probes.. Misclassification of Windows servers as Linux indicates that the classification criteria are not correctly distinguishing between the two. Updating these criteria to properly match Windows-specific attributes, such as open ports or registry information, will ensure accurate CI class assignment. Other actions do not target the root cause and may cause additional problems.

Answer

Reinstall the MID Server to reset the discovery process.

Answer

Modify the Shazzam probe to scan additional ports that are specific to Windows.

Answer

Disable the Shazzam phase and rely solely on patterns for classification.

Question 11

A discovery administrator needs to prevent a MID Server named 'MID-EU-01' from being automatically selected by any new horizontal discovery schedules, but the MID Server must remain available for existing schedules that already reference it. Which configuration on the MID Server record accomplishes this?

Accepted Answer

Set the MID Server's 'Used for' field to 'Service Mapping' only.. The MID Server 'Used for' field is the supported targeting control that scopes a MID Server to a discovery behavior. Changing it to Service Mapping only stops new horizontal discovery schedules from automatically choosing that MID Server. Because existing schedules that already name the MID Server continue to reference it explicitly, they keep running, satisfying both halves of the requirement without disabling the MID Server.

Answer

Set the MID Server's 'Validated' field to false.

Answer

Set the MID Server's 'Application' field to 'Discovery' only.

Answer

Set the MID Server's 'Capabilities' field to exclude 'Horizontal Discovery'.

Question 12

A discovery administrator is preparing to run discovery against a subnet that contains both production servers and network printers. The administrator wants to avoid creating CIs for the printers while still discovering the servers. Which two configuration actions should the administrator take? (Choose two.)

Accepted Answer

Use classification criteria to prevent the printers from matching any CI class.. Excluding printers while still discovering servers is best achieved by scoping discovery to IP ranges that omit the printer addresses and by ensuring classification criteria do not map printer fingerprints to a CI class. Together these controls prevent both the probing and the CI creation for printers, while leaving server discovery and classification fully functional on the same schedule.

Answer

Disable the MID Server's 'Shazzam' capability so printers are not port-scanned.

Answer

Set the schedule's 'Discover' field to 'Servers only'.

Answer

Add the printer device class to the schedule's 'Exclude' list on the Discovery Schedule record.

Question 13

A discovery administrator is configuring a new Discovery Schedule for a data center subnet. The administrator needs to ensure that the discovery process does not overwhelm the network and that only authorized devices are scanned. Which two actions should the administrator take when configuring the Discovery Schedule? (Choose two.)

Accepted Answer

Set the 'Discover' field to 'IPs' and list only the authorized IP addresses.. To avoid overwhelming the network and scan only authorized devices, the administrator should restrict the scan to specific authorized IPs using the 'IPs' option in the Discover field, and schedule the discovery to run periodically during off-peak hours with a limited duration. These two actions directly address the network load and authorization concerns.

Answer

Set the 'Max run time' to 24 hours to allow the discovery to complete without interruption.

Answer

Enable the 'Use MID Server' option and select a MID Server with sufficient capacity.

Answer

Set the 'Discover' field to 'IP range' and specify the subnet to be scanned.

Question 14

When configuring a Discovery Behavior, what is the primary purpose of defining 'Probes' within the behavior?

Accepted Answer

To control which probes are launched for specific device types.. Probes within a Discovery Behavior define which probes are launched for specific device types. This allows customization of the discovery process for different classes of devices, ensuring appropriate probes are used.

Answer

To define the IP address range.

Answer

To define the credential to be used.

Answer

To define which MID Server to use.

Question 15

If you are troubleshooting a Discovery issue where the device is correctly classified but no data is being populated in the CMDB, which phase should you investigate first?

Accepted Answer

Exploration. If a device is correctly classified but no data is populated in the CMDB, the Exploration phase should be investigated first. Exploration is responsible for gathering detailed information from the device, such as hardware, software, and network configuration. If Exploration fails or is misconfigured, no data will be collected, even if classification and identification succeed.

Answer

Shazzam

Answer

Schedule

Answer

Classification

Answer

Identification