SERVICENOW-CIS-DISCOVERY Multiple Select — 50 Questions

Question 1

Which THREE of the following are key components for configuring a successful Discovery?

Accepted Answer

MID Server. Schedules, MID Servers, and Credentials are the foundational blocks for any discovery project.

Answer

Knowledge Base

Answer

Incident Management

Question 2

Which THREE of the following are true about the MID Server?

Accepted Answer

It needs outbound access to the instance. It communicates via HTTPS, resides behind the firewall, and connects to the instance.

Answer

It requires a dedicated database

Answer

It replaces the ServiceNow instance

Question 3

Which TWO of the following are true about the 'Discovery Status' module?

Accepted Answer

It provides detailed phase-by-phase information. It provides a historical log of all discovery runs and detailed information about what occurred during each phase.

Answer

It is the only place to define IP ranges

Answer

It automatically fixes CMDB errors

Answer

It is used to manage credentials

Question 4

Which THREE components are involved in the Discovery process flow?

Accepted Answer

Discovery Patterns. Discovery utilizes the MID Server for execution, the ECC queue for communication, and Patterns for data collection.

Answer

Service Mapping

Answer

CI Class Manager

Question 5

Which TWO of the following are valid ways to debug a pattern?

Accepted Answer

Review the 'Pattern Log' in the Discovery Status. Option B is correct because the 'Pattern Log' in the Discovery Status provides the execution trace and error details generated when a pattern runs during discovery, making it the primary place to inspect what a pattern actually did and where it failed. Option D is correct because the 'Test' mode in the Pattern Designer lets you execute a pattern against a specific CI or host in a controlled, interactive environment, showing step-by-step results and allowing iterative debugging without running a full discovery. The other options do not belong: restarting the instance (A) is a generic troubleshooting action that does not expose pattern logic or execution details, modifying the MID Server source code (C) is unsupported and unrelated to pattern debugging, and running the pattern from the command line (E) is not a valid debugging method for patterns in this platform.

Answer

Restart the instance

Answer

Modify the MID Server source code

Answer

Run the pattern from the command line

Question 6

Which TWO types of discovery probes can a MID Server execute?

Accepted Answer

WMI probes. A MID Server in ServiceNow Discovery can execute WMI probes, which use Windows Management Instrumentation over DCOM/RPC to collect hardware, software, and configuration data from Windows hosts, making option A correct. It can also execute SSH probes, which connect to Linux/Unix and network devices over TCP port 22 to run commands and gather inventory data, making option E correct. Hardware replacement probes (B) are not a Discovery probe category—Discovery identifies and classifies CIs but does not perform hardware replacement actions. User creation probes (C) are likewise not a Discovery probe type; user provisioning is handled by orchestration/fulfillment workflows, not Discovery. SQL injection probes (D) are attack techniques, not legitimate Discovery probes, and have no place in the MID Server probe library.

Answer

Hardware replacement probes

Answer

User creation probes

Answer

SQL injection probes

Question 7

Which THREE pieces of information are required for a MID Server to communicate with the ServiceNow instance?

Accepted Answer

Instance URL. Option B (Instance URL) is required because the MID Server's config.xml must point to the ServiceNow instance endpoint (e.g., https://<instance>.service-now.com) so it knows where to establish its outbound connection. Option C (MID Server record validation) is required because the MID Server must be registered as a MID Server record in the instance and validate itself against that record (name/user/password) before it is authorized to pull and execute jobs. Option E (Network connectivity to the instance) is required because the MID Server initiates outbound HTTPS (port 443) connections to the instance; without reachable network/DNS/firewall paths, no communication can occur. Option A (Admin password for the host) is not required, since the MID Server runs as a service under a local service account and does not need host admin credentials for instance communication. Option D (Database credentials) is not required, because the MID Server never connects directly to the ServiceNow database; all interaction occurs through the instance's REST/SOAP APIs.

Answer

Admin password for the host

Answer

Database credentials

Question 8

Which TWO of the following actions help reduce 'Staleness' in the CMDB?

Accepted Answer

Ensuring all target devices are covered by a discovery schedule.. Staleness is reduced by ensuring scans run frequently enough and that every CI is targeted by a discovery scan.

Answer

Reducing the number of attributes collected.

Answer

Hardcoding CI attributes manually.

Answer

Adding more classes to the dashboard.

Question 9

Which TWO actions can be triggered from the MID Server record's related links?

Accepted Answer

Restart the MID server. Option C (Restart the MID server) is correct because the MID Server record's related links include a Restart action that lets an administrator remotely restart the MID Server service on its host, which is essential for applying configuration changes or recovering a stuck MID Server. Option E (Validate the MID server) is correct because the related links also provide a Validate action that runs a diagnostic check against the MID Server to confirm connectivity, credentials, and capability status with the ServiceNow instance. Option A (Upgrade the database) is not a MID Server related link, as database upgrades are handled through instance upgrade processes, not from a MID Server record. Option B (View the CMDB records) is not a MID Server related link; CMDB data is accessed through CMDB modules and CI records, not the MID Server record's related links. Option D (Delete the instance) is not a MID Server related link, since deleting an instance is an administrative action performed from the instance management console, not from a MID Server record.

Answer

Upgrade the database

Answer

View the CMDB records

Answer

Delete the instance

Question 10

Which TWO of the following are true about Discovery Credentials?

Accepted Answer

They are referenced via Credential Aliases. They are stored securely and associated with aliases for use in schedules.

Answer

They are not required for Discovery

Answer

They are stored in the MID Server locally

Answer

They are passed as plain text in the ECC queue

Question 11

Which TWO settings can be managed via the MID Server 'Capabilities' feature?

Accepted Answer

Filtering scan types (e.g., WMI, SNMP). Option B (Filtering scan types such as WMI and SNMP) is correct because MID Server capabilities are used to control which discovery/scanning probes and protocols a MID Server is allowed to run, so you can restrict a MID Server to specific scan types like WMI or SNMP. Option D (Restricting discovery work) is correct because capabilities determine what kinds of discovery and orchestration jobs a MID Server is eligible to execute, effectively limiting the discovery workload it can be assigned. Options A, C, and E are not managed through the Capabilities feature: user access is governed by roles/ACLs, proxy connections are configured in MID Server properties, and memory limits are set via the MID Server's wrapper/JVM configuration, not capabilities.

Answer

Managing user access

Answer

Configuring proxy connections

Answer

Setting the memory limit

Question 12

Which TWO of the following are valid ways to define the scope of a Discovery scan?

Accepted Answer

IP Address ranges. A Discovery scan scope can be defined by specifying one or more IP address ranges (for example, 10.0.0.1-10.0.0.254) that Discovery will probe for live devices. Option C (IP Network addresses) is also correct because scope can be defined using IP network/subnet addresses in CIDR notation (for example, 192.168.1.0/24), which Discovery uses to determine which hosts to scan. Schedule Behaviors (B) control when and how often a Discovery schedule runs, not which devices are in scope. MID Server Capability (D) determines which MID Server is eligible to execute the Discovery based on its assigned capabilities, but it does not define the target scope. Credential profiles (E) supply the authentication credentials used during Discovery, not the set of IP addresses or networks to be scanned.

Answer

Schedule Behaviors

Answer

MID Server Capability

Answer

Credential profiles

Question 13

Which THREE of the following are necessary to successfully discover a Windows server?

Accepted Answer

Network connectivity to the server. You need a reachable network, a credential with access, and a valid classifier for Windows.

Answer

An active Incident Management module

Answer

A manual CI creation

Question 14

Which TWO of the following are valid parsing strategies available in the Pattern Designer when processing data retrieved from a device?

Accepted Answer

JSON. The Pattern Designer supports various parsers including 'Delimited' (for tables) and 'JSON' (for object data).

Answer

SQL Query

Answer

SOAP Envelope

Answer

Binary Stream

Question 15

Which THREE factors should be considered when planning a MID Server installation?

Accepted Answer

Network access to the instance. When planning a MID Server installation, network access to the instance (B) is essential because the MID Server must be able to reach the ServiceNow instance over the required outbound ports (typically HTTPS/443) to register, receive jobs, and return results. Hardware resource availability (C) must be evaluated because the MID Server host needs sufficient CPU, memory, and disk to run the Java-based MID Server process and handle the discovery/integration workloads assigned to it. Operating system compatibility (D) is also required since the MID Server is only supported on specific OS versions (for example, certain Windows Server and Linux distributions) and must match the supported Java runtime. Database version (A) is not a MID Server installation factor because the MID Server does not host or require a local database, and user browser settings (E) are irrelevant since the MID Server runs as a background service without a browser interface.

Answer

Database version

Answer

User browser settings

Question 16

When debugging a pattern that fails during the identification phase, which TWO areas should you inspect in the Pattern Designer?

Accepted Answer

Identification section. In the Pattern Designer, the identification phase is driven by the Identification section (option C), which defines what data the pattern collects and how it maps to the application model, so inspecting it reveals whether the pattern is gathering the right attributes to recognize the target. The Identification rules (option D) are equally essential because they specify the exact conditions (e.g., process name, file path, registry key, or command-line arguments) that must match for the pattern to positively identify the application; a faulty or overly strict rule is a common cause of identification failure. Options A (Credentials) and B (Schedule) relate to authentication and execution timing, which affect discovery or execution phases rather than the identification logic itself. Option E (Discovery log) is an output artifact used for troubleshooting discovery runs, not a configuration area within the Pattern Designer that defines identification behavior.

Answer

Credentials

Answer

Schedule

Answer

Discovery log

Question 17

Which THREE common challenges arise when using Regex to extract data from command outputs in patterns?

Accepted Answer

Potential for catastrophic backtracking on large strings. Option A is correct because certain regex patterns with nested quantifiers can trigger catastrophic backtracking, causing exponential runtime on large command outputs. Option C is correct because command output formats can change across software versions or configurations, silently breaking patterns that were tightly coupled to the old layout. Option E is correct because long, complex regex strings are hard to read, document, and maintain, especially when they encode many assumptions about output structure. Option B is wrong because regex engines widely support capture groups (e.g., parentheses in PCRE, Python re, and .NET). Option D is wrong because regex is a pattern-matching language and is never automatically converted to JSON.

Answer

Regex does not support capture groups

Answer

Regex is automatically converted to JSON

Question 18

Which THREE of the following are common reasons for a Discovery scan to fail?

Accepted Answer

Network firewall blocking ports. A Discovery scan fails when a network firewall blocks the ports used for probing (for example SNMP 161, WMI 135/445, or SSH 22), so the scanner cannot reach the target and the scan returns no data. B is correct because if the IP range or subnet defined in the Discovery schedule is wrong, the scanner probes addresses where no managed devices exist, producing an empty or failed scan. D is correct because invalid or insufficient credentials (wrong SNMP community string, WMI/SSH username or password) prevent authentication and cause the scan to fail even when the network path is open. C is not a typical cause of a Discovery scan failure, since a full instance database affects data storage rather than the scanning process itself, and E is unrelated because Discovery scans run from the mid server or scanner engine, not from a browser.

Answer

The instance database is full

Answer

The browser is out of date

Question 19

Which TWO steps are essential for parsing a command output that contains key-value pairs formatted as 'key = value'?

Accepted Answer

Define the Line Delimiter. For key-value parsing, identifying the line delimiter and the key-value separator is essential.

Answer

Execute an external shell script

Answer

Convert the output to XML

Answer

Apply a JSON Path

Question 20

Which THREE conditions must be met for a MID Server to be considered 'Up'?

Accepted Answer

The MID Server is not paused. A MID Server is reported as 'Up' in ServiceNow when three conditions are satisfied: the MID Server is not paused (B), meaning an administrator has not manually set its status to Paused, which would suppress its availability; the MID Server service is running (C), i.e., the Windows service or Linux daemon process is active and executing; and the heartbeat is within the allowed interval (E), meaning the MID Server has checked in with the instance within the configured heartbeat threshold (typically around 60 seconds, with a missed-heartbeat tolerance) so the instance considers it reachable. Options A and D are not requirements: a MID Server does not need 100% free CPU (it only needs adequate resources to run), and it can run on either Windows or Linux, so the operating system is irrelevant to the 'Up' status.

Answer

The MID Server has 100% CPU free

Answer

The MID Server is running on Linux