CIS-ITSM Hard Questions — 25 Difficult Questions

Question 1

An organization is implementing Change Management and needs to configure Maintenance and Blackout schedules. Which THREE characteristics apply to cmn_schedule records used in this context? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Schedules can be referenced by conflict detection to identify blackout violations. Option B is correct because cmn_schedule records are referenced by Change Management conflict detection to determine whether a change falls within a blackout window and thus violates it. Option C is correct because cmn_schedule supports recurring schedules, including repeating maintenance windows such as weekly or monthly intervals, via schedule entries and repeating spans. Option D is correct because cmn_schedule records store a time zone, allowing global organizations to define windows that are evaluated correctly across regions. Option A is not correct because schedules are not auto-generated by ITOM Discovery from server reboots; they are defined by administrators or processes. Option E is not correct because cmn_schedule entries can span multiple days and are not limited to single-day events.

Answer

Schedules are automatically generated by ITOM Discovery based on server reboots

Answer

Schedules are strictly limited to single-day events and cannot span multiple days

Question 2

A Problem task is assigned to a vendor group. The vendor updates the task via an inbound email action. The administrator wants to ensure that the inbound email sender is validated against the vendor company record before updating the task. Where should this validation be implemented?

Accepted Answer

In the script of the Inbound Email Action record. Inbound Email Actions in ServiceNow contain a script field where you can inspect the sender (email.from) and validate it against the vendor company record before allowing the task update. This is the correct place because the Inbound Email Action is the processing logic that runs when the email is received and decides whether to update the target record.

Answer

In a Client Script running on the Email form

Answer

In the Dictionary entry for email body

Answer

In a UI Policy Action

Question 3

A company wants to implement a multi-stage approval for Problem records where the total estimated financial impact exceeds $10,000. Which ServiceNow feature should be used to orchestrate this conditional approval routing?

Accepted Answer

Flow Designer with Approval activities and conditional branching based on financial impact. Flow Designer supports conditional branching and Approval activities, allowing a flow to evaluate the estimated financial impact and route through multi-stage approvals only when the amount exceeds $10,000. This is the platform's orchestration tool for conditional, multi-step approval routing on Problem records.

Answer

A Client Script validation check

Answer

An Email Notification template

Answer

A Dictionary Override on the Approval field

Question 4

An administrator is troubleshooting why conflict detection is not running when changes are updated via a REST API integration. Which condition in the conflict detection business rule might prevent execution during API calls?

Accepted Answer

The business rule checks if the update modifies schedule-related fields (like planned start/end or CI) and runs accordingly. The conflict detection business rule in ServiceNow checks whether the update modifies schedule-related fields such as planned start/end dates or CI relationships, and only runs conflict detection when those fields change. When updates come via REST API, if the payload does not modify those specific fields, the business rule condition evaluates false and conflict detection does not execute. This is the correct answer because it describes the actual conditional logic in the OOB conflict detection business rule.

Answer

Conflict detection requires an interactive web browser session

Answer

REST APIs inherently disable all database business rules globally

Answer

Integration accounts lack read access to the cmdb_ci table

Question 5

An organization defines a multi-attribute identification rule for the Linux Server class using 'serial_number' and 'ip_address'. During a payload execution, the IRE finds an existing CI matching the serial number, but the IP address has changed. How does the IRE process this payload?

Accepted Answer

It updates the existing CI's IP address and any other payload attributes, treating it as the same physical asset based on the matching rule entry.. The IRE uses multi-attribute identification rules to determine if a payload matches an existing CI. When multiple attributes are defined, the rule is satisfied if any one of the attributes matches (OR logic). Here, the serial number matches an existing CI, so the IRE treats the payload as the same CI and updates the CI's attributes—including the changed IP address—with the new values from the payload. This ensures the CMDB reflects the current state of the asset without creating duplicates.

Answer

It flags the payload in the IRE Error Dashboard as an identification conflict requiring manual resolution.

Answer

It creates a new CI record because the IP address attribute does not match the historical value.

Answer

It deletes the existing CI and inserts a new one with the updated attributes.

Question 6

An administrator creates a custom identification rule for a new class. The rule has two entries: Entry 1 uses 'serial_number' (weight 100), and Entry 2 uses 'mac_address' (weight 50). When a payload arrives containing both attributes, how does the IRE evaluate the rule entries?

Accepted Answer

The IRE evaluates Entry 1 first. If a match is found, it uses that CI; if no match is found, it proceeds to evaluate Entry 2.. IRE evaluates identification rule entries in order of their priority or weight, or matches using the first matching entry based on configuration criteria.

Answer

The IRE averages the weights and creates a new CI if the combined score is below 75.

Answer

The IRE rejects the payload because conflicting matching criteria are defined within the same rule.

Question 7

A change request is currently in the 'New' state. You want to automate the transition to 'Assess'. Where do you define this logic in a Change Model?

Accepted Answer

Change Model Flow. In ServiceNow Change Management, the Change Model Flow (also called Change Model workflow) defines the states and transitions for a change request, including automated transitions like moving from 'New' to 'Assess'. This is where you configure the logic that drives the state model.

Answer

UI Action on change_request

Answer

State transition table

Answer

Business Rule on change_request

Answer

Workflow properties

Question 8

If you need to ensure that an incident cannot be resolved unless the 'Work Notes' field is not empty, which method is most effective?

Accepted Answer

Data Policy. A Data Policy in ServiceNow enforces field-level constraints at the database layer, regardless of how the record is saved (form, import, API, or workflow). Setting a Data Policy rule that makes 'Work Notes' mandatory when the incident state is 'Resolved' ensures the incident cannot be resolved with an empty Work Notes field. This is the most effective method because it applies universally.

Answer

Catalog Client Script

Answer

UI Policy

Answer

Workflow

Question 9

An administrator created a Multi-Row Variable Set (MRVS) and wants to populate a field on the target task using the data collected in the MRVS rows. Since MRVS stores data as a JSON string, what is the best way to extract and process this data in a workflow script?

Accepted Answer

Parse the JSON string using JSON.parse(current.variables.mrvs_name) in a Run Script activity and iterate through the resulting array.. The MRVS stores its collected row data as a JSON string in the variable value, so the only reliable way to access individual columns is to parse that string into a JavaScript object/array. JSON.parse(current.variables.mrvs_name) converts the serialized rows into an array of objects, which a Run Script workflow activity can then iterate over to read each row's column values and write them to the target task fields. Direct dot-walking (Option A) does not work because the MRVS is not a true related list of child records — it is a single variable holding a JSON payload, so there are no column-level fields to traverse.

Answer

Dot-walk directly to current.variables.mrvs_name.column_name in the task activity.

Answer

Use a Record Producer script to flatten the MRVS into custom table rows automatically.

Answer

Configure a Catalog UI Policy to export MRVS rows to the sys_variable_value table.

Question 10

An administrator needs to write an onSubmit Catalog Client Script that validates whether at least one checkbox in a group of ten checkboxes is checked before the item can be added to the cart. Which approach should be used?

Accepted Answer

Iterate through the checkbox variable names using g_form.getValue() and return false if none are true, preventing submission.. An onSubmit Catalog Client Script runs before the item is added to the cart, allowing validation logic to execute. Using g_form.getValue() to iterate through each checkbox variable and checking if at least one is true, then returning false if none are checked, prevents submission and displays an error message. This is the standard client-side validation approach for catalog items.

Answer

Write a Client Script on the sc_cart table to intercept the checkout action.

Answer

Configure a Dictionary Override on the sc_req_item table to enforce mandatory checkboxes.

Answer

Use document.getElementsByClassName() to count checked elements directly from the DOM.

Question 11

An administrator is troubleshooting a failing Catalog Client Script. Which THREE of the following practices should be followed to ensure the script works correctly in Service Portal? (Choose three.)

Accepted Answer

Avoid direct DOM manipulation (e.g., document.getElementById) and use g_form APIs instead.. Option A is correct because Service Portal renders forms with AngularJS-based widgets rather than the classic Jelly UI, so direct DOM manipulation like document.getElementById can break; the supported approach is to use g_form APIs (e.g., g_form.getValue, g_form.setValue, g_form.setMandatory) which abstract the rendering layer. Option D is correct because a Catalog Client Script's UI Type field must be set to 'Mobile / Service Portal' or 'All' for the script to execute in the Service Portal; leaving it as 'Desktop' or 'Both' (legacy) prevents it from running in the portal. Option E is correct because testing with g_form methods that are supported in both desktop and portal ensures cross-interface compatibility, since some legacy methods (e.g., g_form.getControl) behave differently or are unavailable in the portal. Option B is incorrect because synchronous GlideRecord queries in client-side OnChange scripts block the UI and are discouraged; asynchronous callbacks (getReference, GlideAjax) should be used instead. Option C is incorrect because jQuery selector syntax is not the supported way to write client scripts and is unreliable in Service Portal's AngularJS environment; g_form APIs should be used instead.

Answer

Use synchronous GlideRecord queries inside client-side OnChange scripts for instant validation.

Answer

Write all client scripts using jQuery selector syntax for broad browser support.

Question 12

An implementation specialist needs to validate that a multi-line text variable on a catalog item contains at least 50 characters before the form can be submitted. Which approach should be used?

Accepted Answer

Create an onSubmit Catalog Client Script that checks the string length using g_form.getValue() and cancels submission if invalid.. A Catalog Client Script with an onSubmit script is the correct approach because it runs in the browser when the user submits the catalog item, allowing you to read the multi-line text variable via g_form.getValue(), check its length, and call g_form.addErrorMessage() plus return false to cancel submission if the length is less than 50. This provides immediate client-side validation before the record is created.

Answer

Write a Data Policy targeting the Requested Item table.

Answer

Configure a Catalog UI Policy Action with a script condition checking character count.

Answer

Define a variable attribute with the parameter 'min_length=50'.

Question 13

An administrator is configuring Data Archiving rules for closed Problem records. Which TWO criteria or settings must be defined in an archiving rule? (Choose two.)

Accepted Answer

The physical shipping address for archive backup tapes. Archiving rules require specifying the target table (e.g., problem) and age/condition criteria (such as closed and older than X months).

Answer

The social media platform handle for public announcements

Answer

The airline frequent flyer account for the archivist

Question 14

Which THREE of the following are benefits of using CI Class Manager? (Choose three.)

Accepted Answer

Centralized viewing and editing of class-specific identification rules.. Option C is correct because CI Class Manager provides a single, centralized console where administrators can view and edit the identification rules that determine how CIs of a given class are uniquely identified and matched during discovery and import. Option D is correct because CI Class Manager allows you to add, modify, and delete attributes on specific CI classes within the CMDB class hierarchy, extending the schema without direct table manipulation. Option E is correct because CI Class Manager centralizes the management of reconciliation rules at both the class and attribute level, controlling how duplicate or conflicting CI records are merged. Option A is not a CI Class Manager benefit; incident triage workflows for failed discoveries are handled through Discovery/Service Mapping health and error handling, not class administration. Option B is not correct because CI Class Manager does not provide direct editing of system-level Java source code for Discovery patterns; pattern customization is done through the Pattern Designer and related tooling.

Answer

Automatic execution of incident management triage workflows for failed discoveries.

Answer

Direct editing of system-level Java source code for Discovery patterns.

Question 15

An enterprise uses custom change states. Where must an administrator define these new states to ensure proper integration with the Change State Model framework?

Accepted Answer

Change State Model records and state transition rules. Custom change states must be defined in the Change State Model records along with the state transition rules, because the Change State Model framework governs which states exist and how a change can move between them. Defining states only in the dictionary or UI does not integrate with the model's transition logic.

Answer

Workflow Designer transition lines only

Answer

System Dictionary choices on the state field only

Answer

UI Actions script bodies

Question 16

A team uses Problem Tasks to divide root cause investigations. A requirement states that a Problem record cannot be moved to 'Fix In Progress' until all child Problem Tasks are in either 'Closed Complete' or 'Closed Skipped' state. How should an administrator configure this validation?

Accepted Answer

A Before Update Business Rule on the Problem table checking active child task counts. A Before Update Business Rule on the Problem table is the correct approach because it can query the child Problem Tasks via the task relationship and block the state transition when any task is not in 'Closed Complete' or 'Closed Skipped'. Business Rules execute server-side on the database operation, so they enforce the rule regardless of whether the update comes from the UI, an import, or a REST API call. The script can use GlideAggregate to count active child tasks and call current.setAbortAction(true) with a message when the count is greater than zero.

Answer

An Access Control List (ACL) with script execution

Answer

A Dictionary Override on the State field

Answer

A UI Policy with an advanced script condition

Question 17

You are designing an integration where incidents are created via an API. How do you ensure that 'Assignment Rules' are triggered?

Accepted Answer

Leave the assignment fields empty in the API payload.. Assignment Rules in ServiceNow run automatically on incident insert/update only when the assignment fields (assignment_group, assigned_to) are empty. If the API payload leaves these fields blank, the rules execute and assign the incident. If the payload sets them, the rules are skipped.

Answer

Ensure the API user has the 'itil' role.

Answer

Set the 'auto_assignment' flag to true.

Answer

Enable the 'Run Assignment Rules' checkbox in the API call.

Question 18

An organization wants to ensure that whenever a Normal Change is set to 'Assess', an automatic risk assessment questionnaire is sent to the change assignee. Which mechanism triggers this assessment out of the box?

Accepted Answer

Assessment trigger rules (asmt_metric_type / risk assessment triggers). Out of the box, ServiceNow uses Assessment trigger rules (configured on the asmt_metric_type and related trigger condition records) to automatically generate assessment instances when a record meets defined conditions — such as a Normal Change entering the 'Assess' state. These trigger rules evaluate the change record and, when matched, create an asmt_assessment_instance that sends the questionnaire to the designated recipient (the assignee). This is the native, declarative mechanism for assessment automation.

Answer

Scheduled jobs running nightly

Answer

Email notifications with mail scripts

Answer

Client scripts on the change request form

Question 19

You want to hide the 'Impact' field from all users except those with the 'admin' role. What is the most secure way to do this?

Accepted Answer

Use an ACL.. An ACL (Access Control List) is the most secure way to restrict field-level visibility to a specific role because ACLs are enforced server-side and apply to all access paths, including UI, API, and background scripts. By creating a field-level read ACL on the Impact field that requires the 'admin' role, you ensure that only admins can see the field's value regardless of how the data is accessed. This is the recommended security mechanism in ServiceNow for role-based field restrictions.

Answer

Update the Dictionary entry.

Answer

Use a Data Policy.

Answer

Use a UI Policy.

Question 20

Which table stores the relationship between a Change Request and its associated tasks?

Accepted Answer

Change Task [change_task]. The Change Task [change_task] table is specifically designed to store tasks that are directly associated with a Change Request. It extends the Task [task] table and includes a reference field (change_request) that links each task to its parent Change Request. This table is the standard location for managing implementation, review, and other tasks that are part of the change process.

Answer

CAB Meeting [cab_meeting]

Answer

Change Request [change_request]

Answer

Task Rel [task_rel]

Answer

Task [task]