SERVICENOW-CIS-DISCOVERY Discovery Configuration — Timed 15 Questions

Question 1

Which phase of Discovery is responsible for matching the fingerprint of a device to a specific Classification record?

Accepted Answer

Classification. Classification is the phase where the device is identified based on the fingerprints returned by probes.

Answer

Identification

Answer

Shazzam

Answer

Exploration

Question 2

During the Classification phase, Discovery identifies a device as a Linux server but fails to populate the serial number. Which troubleshooting step is most effective?

Accepted Answer

Check the ECC Queue for 'Input' records related to the SNMP probes and review the pattern logs.. The ECC Queue is the central communication channel between the MID Server and the ServiceNow instance, and it logs every probe and sensor execution. When a Linux server is classified but serial number is missing, the issue typically lies in the SNMP probe's output or the pattern's parsing logic. Checking 'Input' records in the ECC Queue for SNMP probes and reviewing pattern logs directly reveals whether the probe returned the serial number and whether the pattern failed to extract it, making this the most targeted troubleshooting step.

Answer

Change the MID Server user to an admin account.

Answer

Delete the Discovery Schedule and recreate it.

Answer

Re-run the Shazzam probe for that specific IP.

Question 3

A customer requires that a specific Discovery Schedule only executes during maintenance windows on weekends. Which configuration setting should be modified?

Accepted Answer

Adjust the 'Run' field to 'Periodically' and select a custom Schedule record.. Discovery Schedules control when discovery runs, and the 'Run' field determines the execution pattern. Setting it to 'Periodically' and selecting a custom Schedule record allows the schedule to run only during defined maintenance windows, such as weekends. This is the correct configuration point for time-based execution constraints.

Answer

Change the discovery pattern logic.

Answer

Update the Discovery Behavior record.

Answer

Modify the MID Server cluster affinity.

Question 4

Which of the following is NOT a phase of the Discovery process?

Accepted Answer

Verification. The Discovery process phases are Identification, Exploration, and Shazzam (which is a port scanner phase). Verification is not a standard phase; it is part of the overall discovery cycle but not a named phase. Therefore, Verification is NOT a phase.

Answer

Identification

Answer

Shazzam

Answer

Exploration

Question 5

Which record type is used to associate a credential with a specific Discovery Schedule, allowing for secure and automated credential selection?

Accepted Answer

Credential Alias. A Credential Alias is used to associate a credential with a specific Discovery Schedule. It allows for secure and automated credential selection by mapping an alias to one or more credentials, which are then used during Discovery. The schedule references the alias, and the MID Server selects the appropriate credential based on the alias and target.

Answer

Discovery Range

Answer

Discovery Behavior

Answer

MID Server Cluster

Question 6

A Discovery Schedule is configured but not running. Where is the first place you should look for errors?

Accepted Answer

Discovery Log. The Discovery Log is the primary diagnostic tool for Discovery schedules. It records the execution status of each phase (e.g., Scanning, Identification, Exploration) and captures errors such as authentication failures, probe timeouts, or pattern issues. When a schedule is not running, the Discovery Log will show whether the schedule was triggered, if it failed to start, or if it encountered an error during execution. This is the first place to check because it provides a timeline of events specific to the Discovery process, unlike system or MID Server logs which are more general.

Answer

System Logs

Answer

MID Server Logs

Answer

CMDB Health Dashboard

Question 7

What happens if a device is discovered that matches two different Classification records?

Accepted Answer

It uses the classifier with the highest priority.. When a discovered device matches multiple Classification records, ServiceNow Discovery evaluates all matching classifiers and applies the one with the highest priority value. Priority is a numeric field on the Classification record, and the classifier with the highest priority (lowest numeric value depending on configuration, but conceptually the top-ranked one) wins. This deterministic tie-break prevents ambiguity and ensures consistent CI classification across the environment.

Answer

It errors out and stops discovery.

Answer

It asks the user to choose.

Answer

It applies both classifiers.

Question 8

Which of the following is a valid method to trigger a Discovery scan manually?

Accepted Answer

Click 'Discover Now' on the Discovery Schedule record.. You can click the 'Discover Now' button on a Discovery Schedule record.

Answer

Edit the ECC Queue.

Answer

Restart the MID Server.

Answer

Run a Business Rule.

Question 9

Which field on the Discovery Schedule allows you to restrict the discovery to specific device types?

Accepted Answer

Behavior. The 'Behavior' field is used to select which probes/patterns run, effectively limiting what is discovered.

Answer

Schedule

Answer

MID Server

Answer

IP Range

Question 10

Which phase comes immediately after the Identification phase?

Accepted Answer

Exploration. The phases are Shazzam -> Classification -> Identification -> Exploration.

Answer

Reconciliation

Answer

Classification

Answer

Shazzam

Question 11

When configuring a custom probe, what is the best practice for ensuring that the probe executes only on relevant devices?

Accepted Answer

Associate the probe with a specific Classifier.. Linking the probe to a specific 'Classifier' or 'Pattern' ensures it only runs when the device type matches.

Answer

Include logic in the probe script.

Answer

Add the IP address to the probe.

Answer

Assign the probe to all schedules.

Question 12

When a MID server is part of a cluster, what happens if one node fails during a discovery scan?

Accepted Answer

The task is re-assigned to another available node in the cluster.. In a ServiceNow MID Server cluster, discovery tasks are distributed across available nodes. If a node fails mid-scan, the MID Server cluster's heartbeat and task reassignment mechanism detects the failure and automatically reassigns the in-progress discovery task to another healthy node in the cluster. This ensures high availability and resilience for discovery operations without manual intervention.

Answer

The scan is marked as 'Partial'.

Answer

The scan restarts from the beginning.

Answer

The scan fails completely.

Question 13

Which TWO of the following are primary functions of a Discovery Behavior?

Accepted Answer

Assigning specific probes to a schedule. A Discovery Behavior's core purpose is to bind specific probes (and probe parameters) to a schedule, determining when and how those probes run against discovered devices. Option C is also correct because the behavior defines what data to collect for particular device types by selecting the appropriate probes and their parameters for those classifications. Option A is not a behavior function; target IP ranges are defined in a Discovery Schedule's IP range or in a Discovery Range Set. Option D is not part of a behavior; MID Server credentials are managed via Credentials and MID Server configuration records. Option E is not a behavior function; the discovery job timing is controlled by the Discovery Schedule, not the behavior itself.

Answer

Defining the target IP address range

Answer

Managing MID Server credentials

Answer

Scheduling the discovery job

Question 14

Which THREE of the following are valid states for a MID Server?

Accepted Answer

Up. In ServiceNow, a MID Server's valid operational states are Up, Down, and Paused. Option A (Up) is correct because it indicates the MID Server is running and actively able to execute jobs and probes for its instance. Option C (Down) is correct because it represents a MID Server that is not currently running or reachable, so it cannot process work. Option D (Paused) is correct because an administrator can pause a MID Server to temporarily stop it from accepting new jobs while keeping it registered. Option B (Deleted) is not a state; deletion removes the MID Server record entirely rather than being a status value. Option E (Pending Update) is not a valid MID Server state; upgrade-related conditions are handled through the upgrade/version fields and processes, not as a MID Server status.

Answer

Deleted

Answer

Pending Update

Question 15

Which THREE of the following are potential outcomes for an IP in a Discovery scan?

Accepted Answer

Classification failed. An IP can be identified as a device, it might be unreachable, or it might be classified but fail during exploration.

Answer

Automatically moved to a different subnet

Answer

Automatically created as a user