CIS-ITSM Incident Management — 10 Questions

Question 1

An enterprise requires that when a Major Incident is declared, a dedicated Child Incident task is automatically created for each affected business service found in the Business Service CI relationship. Which out-of-the-box feature supports this specialized workflow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Major Incident Management (MIM) Workbench. The Major Incident Management (MIM) Workbench is the out-of-the-box feature that supports specialized workflows for major incidents, including the automatic creation of child incident tasks for each affected business service. It provides a centralized console for managing major incidents and their related tasks.

Answer

Service Level Agreement Engine

Answer

Data Lookup Definitions

Answer

Incident Templates

Answer

Outbound REST Message

Question 2

An administrator needs to track how many times an incident has been reassigned between different assignment groups to measure process efficiency. Which feature or field type natively captures and displays this movement?

Accepted Answer

The Reassignment count field on the Task table.. The Reassignment count field on the Task table is a native, out-of-the-box integer field that increments each time the assignment group changes on a task record. It is automatically maintained by the platform and can be displayed on forms, lists, and reports without any custom scripting or configuration. This makes it the direct, purpose-built mechanism for measuring how often an incident bounces between groups.

Answer

Audit Log History (sys_audit)

Answer

Metric Definition (Metrics)

Answer

SLA Breach Counter

Question 3

An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?

Accepted Answer

UI Policy. UI Policies in ServiceNow are specifically designed to dynamically enforce field-level behavior on forms, such as making fields mandatory, read-only, or visible based on conditions. In this case, a UI Policy can be configured to trigger when the 'Resolve' button is clicked (via a UI Policy action or a client script) to ensure that 'Resolution code' and 'Resolution notes' are populated before allowing the incident to be resolved. This directly addresses the requirement to prevent closure without those fields.

Answer

Dictionary Overrides

Answer

Access Control Lists (ACLs)

Answer

Assignment Rules

Question 4

An incident is associated with a Parent incident. What behavior does ServiceNow exhibit regarding state changes between parent and child incidents out of the box?

Accepted Answer

Resolving the parent incident can automatically resolve child incidents via business rules.. In ServiceNow, parent-child incident relationships support automatic state propagation through out-of-the-box business rules. When a parent incident is resolved, the system can cascade that resolution to associated child incidents, ensuring consistent lifecycle management across related records. This behavior is governed by the 'Resolve Parent and Children' related link and associated business rules that synchronize state transitions.

Answer

Parent and child incidents must always have identical priority values.

Answer

Child incidents automatically inherit the assignment group of the parent upon creation only.

Answer

Child incidents must be manually closed one by one before the parent can close.

Question 5

A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?

Accepted Answer

It populates knowledge base articles with workarounds that agents can reference to resolve or workaround active incidents.. When a Known Error Article is created from a Problem record, it is published to the Knowledge Base and becomes available to Incident Management agents. Agents can search for and reference the article to find workarounds for active incidents that match the problem's symptoms, enabling faster resolution or workaround application while the permanent fix is pending. This is the core value of the Known Error Article in the ITIL problem-to-incident feedback loop.

Answer

It triggers an automatic change request to deploy the fix to production.

Answer

It removes the incident-to-problem relationship and creates a parent-child incident hierarchy.

Answer

It automatically closes all active incidents matching the problem category.

Question 6

Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)

Accepted Answer

Clicking the 'Promote to Major Incident' UI action on the Incident form.. Option A is correct because ServiceNow provides a 'Promote to Major Incident' UI action on the Incident form that, when clicked, creates a major incident record (typically on the Major Incident [mim] table or via the Major Incident Management plugin) and links it to the original incident. Option B is correct because Major Incident Candidate rules are configurable conditions evaluated on insert or update of an incident; when the criteria match, the system automatically flags the incident as a major incident candidate and can promote it, enabling automated escalation. Option C is wrong because deleting and recreating an incident on a different table breaks record continuity, loses audit history, and is not a supported escalation mechanism. Option D is wrong because Data Policies enforce field-level mandatory/read-only rules on task records and have nothing to do with major incident escalation. Option E is wrong because a dictionary override merely changes attribute behavior (such as default value or read-only) for a field on a child table and does not escalate incidents.

Answer

Deleting the original incident and recreating it on the Major Incident table.

Answer

Modifying the Data Policy table definitions.

Answer

Modifying the dictionary override for the priority field.

Question 7

Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)

Accepted Answer

Short description. Option D (Short description) is mandatory because ServiceNow's out-of-the-box Incident form requires a brief summary of the issue before the record can be saved, and it is enforced by the dictionary attribute mandatory=true on the short_description field. Option E (Caller) is also mandatory out of the box, since the incident must be associated with the user reporting or affected by the issue, and the caller_id field carries the mandatory flag by default. Option A (Configuration item) is not required at creation—it can be left empty and populated later during investigation. Option B (Work notes) is optional free-text documentation and is never enforced as mandatory. Option C (Assignment group) is not mandatory on the base form; incidents can be created unassigned and routed afterward.

Answer

Configuration item

Answer

Work notes

Answer

Assignment group

Question 8

An administrator needs to modify the priority lookup rules to ensure that incidents created with an Impact of 2 (Medium) and Urgency of 2 (Medium) automatically result in a Priority of 3 (Moderate). Where should the administrator navigate to configure this matrix in ServiceNow?

Accepted Answer

System Policy > Data Lookup Definitions > Priority Data Lookup Rules. Priority in ServiceNow is derived from the Impact/Urgency matrix, which is implemented as a Data Lookup Rule (a lookup table keyed on Impact and Urgency). To change the resulting Priority value, the administrator must edit the priority data lookup definition found under System Policy > Data Lookup Definitions. This is where the Impact=2/Urgency=2 combination maps to Priority=3.

Answer

System Definition > Dictionary > Incident > Priority

Answer

Incident > Administration > Priority Matrix

Answer

Service Level Management > SLA > Priority Calculation

Question 9

A service desk manager wants to ensure that when an incident is assigned to the Hardware group, the Assignment group field automatically populates the Assigned to field with a specific default handler if left empty, or dynamically limits the list of assignees. Which core ServiceNow feature should be configured to automatically populate or route incident assignment within a specific group?

Accepted Answer

Assignment Rules. Assignment Rules in ServiceNow are designed to automatically populate the 'Assigned to' field or limit the assignee list based on conditions such as assignment group. They are specifically configured to route incidents to the appropriate handler when a group is selected. This feature ensures that incidents are assigned efficiently without manual intervention.

Answer

Data Lookup Definitions

Answer

SLas definition conditions

Answer

Business Services Management

Question 10

A service desk technician attempts to close an incident, but the system prevents the closure and displays a mandatory error message requiring the 'Close code' and 'Close notes' fields to be populated. Which component of the Incident Management application enforces these fields upon state change to Closed?

Accepted Answer

Out-of-the-box UI Policy or Client Script. Out-of-the-box UI Policies and Client Scripts on the Incident table enforce mandatory fields like 'Close code' and 'Close notes' when the state changes to Closed or Resolved. These client-side components make fields mandatory and display the error message before the record is submitted, which matches the described behavior.

Answer

Access Control Lists (ACLs)

Answer

Workflow Engine

Answer

Dictionary Overrides