CIS-ITSM Incident Management — 15 Questions

Question 1

An enterprise requires that when a Major Incident is declared, a dedicated Child Incident task is automatically created for each affected business service found in the Business Service CI relationship. Which out-of-the-box feature supports this specialized workflow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Major Incident Management (MIM) Workbench. The Major Incident Management (MIM) Workbench is the out-of-the-box feature that supports specialized workflows for major incidents, including the automatic creation of child incident tasks for each affected business service. It provides a centralized console for managing major incidents and their related tasks.

Answer

Service Level Agreement Engine

Answer

Data Lookup Definitions

Answer

Incident Templates

Answer

Outbound REST Message

Question 2

An administrator needs to track how many times an incident has been reassigned between different assignment groups to measure process efficiency. Which feature or field type natively captures and displays this movement?

Accepted Answer

The Reassignment count field on the Task table.. The Reassignment count field on the Task table is a native, out-of-the-box integer field that increments each time the assignment group changes on a task record. It is automatically maintained by the platform and can be displayed on forms, lists, and reports without any custom scripting or configuration. This makes it the direct, purpose-built mechanism for measuring how often an incident bounces between groups.

Answer

Audit Log History (sys_audit)

Answer

Metric Definition (Metrics)

Answer

SLA Breach Counter

Question 3

An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?

Accepted Answer

UI Policy. UI Policies in ServiceNow are specifically designed to dynamically enforce field-level behavior on forms, such as making fields mandatory, read-only, or visible based on conditions. In this case, a UI Policy can be configured to trigger when the 'Resolve' button is clicked (via a UI Policy action or a client script) to ensure that 'Resolution code' and 'Resolution notes' are populated before allowing the incident to be resolved. This directly addresses the requirement to prevent closure without those fields.

Answer

Dictionary Overrides

Answer

Access Control Lists (ACLs)

Answer

Assignment Rules

Question 4

An incident is associated with a Parent incident. What behavior does ServiceNow exhibit regarding state changes between parent and child incidents out of the box?

Accepted Answer

Resolving the parent incident can automatically resolve child incidents via business rules.. In ServiceNow, parent-child incident relationships support automatic state propagation through out-of-the-box business rules. When a parent incident is resolved, the system can cascade that resolution to associated child incidents, ensuring consistent lifecycle management across related records. This behavior is governed by the 'Resolve Parent and Children' related link and associated business rules that synchronize state transitions.

Answer

Parent and child incidents must always have identical priority values.

Answer

Child incidents automatically inherit the assignment group of the parent upon creation only.

Answer

Child incidents must be manually closed one by one before the parent can close.

Question 5

A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?

Accepted Answer

It populates knowledge base articles with workarounds that agents can reference to resolve or workaround active incidents.. When a Known Error Article is created from a Problem record, it is published to the Knowledge Base and becomes available to Incident Management agents. Agents can search for and reference the article to find workarounds for active incidents that match the problem's symptoms, enabling faster resolution or workaround application while the permanent fix is pending. This is the core value of the Known Error Article in the ITIL problem-to-incident feedback loop.

Answer

It triggers an automatic change request to deploy the fix to production.

Answer

It removes the incident-to-problem relationship and creates a parent-child incident hierarchy.

Answer

It automatically closes all active incidents matching the problem category.

Question 6

Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)

Accepted Answer

Clicking the 'Promote to Major Incident' UI action on the Incident form.. Option A is correct because ServiceNow provides a 'Promote to Major Incident' UI action on the Incident form that, when clicked, creates a major incident record (typically on the Major Incident [mim] table or via the Major Incident Management plugin) and links it to the original incident. Option B is correct because Major Incident Candidate rules are configurable conditions evaluated on insert or update of an incident; when the criteria match, the system automatically flags the incident as a major incident candidate and can promote it, enabling automated escalation. Option C is wrong because deleting and recreating an incident on a different table breaks record continuity, loses audit history, and is not a supported escalation mechanism. Option D is wrong because Data Policies enforce field-level mandatory/read-only rules on task records and have nothing to do with major incident escalation. Option E is wrong because a dictionary override merely changes attribute behavior (such as default value or read-only) for a field on a child table and does not escalate incidents.

Answer

Deleting the original incident and recreating it on the Major Incident table.

Answer

Modifying the Data Policy table definitions.

Answer

Modifying the dictionary override for the priority field.

Question 7

Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)

Accepted Answer

Short description. Option D (Short description) is mandatory because ServiceNow's out-of-the-box Incident form requires a brief summary of the issue before the record can be saved, and it is enforced by the dictionary attribute mandatory=true on the short_description field. Option E (Caller) is also mandatory out of the box, since the incident must be associated with the user reporting or affected by the issue, and the caller_id field carries the mandatory flag by default. Option A (Configuration item) is not required at creation—it can be left empty and populated later during investigation. Option B (Work notes) is optional free-text documentation and is never enforced as mandatory. Option C (Assignment group) is not mandatory on the base form; incidents can be created unassigned and routed afterward.

Answer

Configuration item

Answer

Work notes

Answer

Assignment group

Question 8

An administrator needs to modify the priority lookup rules to ensure that incidents created with an Impact of 2 (Medium) and Urgency of 2 (Medium) automatically result in a Priority of 3 (Moderate). Where should the administrator navigate to configure this matrix in ServiceNow?

Accepted Answer

System Policy > Data Lookup Definitions > Priority Data Lookup Rules. Priority in ServiceNow is derived from the Impact/Urgency matrix, which is implemented as a Data Lookup Rule (a lookup table keyed on Impact and Urgency). To change the resulting Priority value, the administrator must edit the priority data lookup definition found under System Policy > Data Lookup Definitions. This is where the Impact=2/Urgency=2 combination maps to Priority=3.

Answer

System Definition > Dictionary > Incident > Priority

Answer

Incident > Administration > Priority Matrix

Answer

Service Level Management > SLA > Priority Calculation

Question 9

A service desk manager wants to ensure that when an incident is assigned to the Hardware group, the Assignment group field automatically populates the Assigned to field with a specific default handler if left empty, or dynamically limits the list of assignees. Which core ServiceNow feature should be configured to automatically populate or route incident assignment within a specific group?

Accepted Answer

Assignment Rules. Assignment Rules in ServiceNow are designed to automatically populate the 'Assigned to' field or limit the assignee list based on conditions such as assignment group. They are specifically configured to route incidents to the appropriate handler when a group is selected. This feature ensures that incidents are assigned efficiently without manual intervention.

Answer

Data Lookup Definitions

Answer

SLas definition conditions

Answer

Business Services Management

Question 10

A service desk technician attempts to close an incident, but the system prevents the closure and displays a mandatory error message requiring the 'Close code' and 'Close notes' fields to be populated. Which component of the Incident Management application enforces these fields upon state change to Closed?

Accepted Answer

Out-of-the-box UI Policy or Client Script. Out-of-the-box UI Policies and Client Scripts on the Incident table enforce mandatory fields like 'Close code' and 'Close notes' when the state changes to Closed or Resolved. These client-side components make fields mandatory and display the error message before the record is submitted, which matches the described behavior.

Answer

Access Control Lists (ACLs)

Answer

Workflow Engine

Answer

Dictionary Overrides

Question 11

A problem coordinator wants to create a new Problem record directly from an existing major Incident while retaining a bi-directional link so that updates to the Incident's workaround are automatically copied to the related Problem. How should the administrator achieve this relationship natively?

Accepted Answer

Use the 'Create Problem' UI Action on the Incident form. The 'Create Problem' UI Action on the Incident form is the native ServiceNow mechanism that creates a Problem record and automatically establishes a bi-directional relationship between the Incident and the Problem. It populates the Problem's 'Parent incident' field and creates the task relationship so that workaround updates flow between records. This is the out-of-box (OOB) approach designed specifically for this scenario.

Answer

Configure a Data Policy from Problem to Incident

Answer

Write a custom database trigger

Answer

Manually populate the Parent incident field on the Problem form

Question 12

An IT support team member needs to quickly communicate a known workaround to all active incidents related to a specific active Problem record. Which related link or related list on the Problem form enables the propagation of the workaround to all associated incidents?

Accepted Answer

Communicate Workaround UI Action. The 'Communicate Workaround' UI Action on the Problem form is the related link that pushes the workaround text to all incidents associated with that Problem record. It updates the work notes or workaround field on each linked incident so agents see the fix immediately. This is the built-in mechanism for propagating a workaround from Problem to its related Incidents.

Answer

Global Incident Synchronizer

Answer

Push Updates Business Rule

Answer

Broadcast Incident Action

Question 13

An administrator is configuring Service Level Agreements (SLAs) for the Incident table. Which THREE elements are required components of a standard SLA definition (contract_sla) record in ServiceNow? (Choose three.)

Accepted Answer

Duration. In a ServiceNow contract_sla record, the Duration field (B) is a required component because it defines the total elapsed time allowed for the SLA to be met, expressed as a duration value such as 4 hours or 2 business days. The Start condition (D) is required because it determines the trigger that begins the SLA timer, for example when the Incident is created or when it enters a specific state. The Target (E) is also required because it specifies the goal field and value that must be reached to satisfy the SLA, such as resolving the incident before the duration expires. The Assigned to user mandatory script (A) is not a standard required element of an SLA definition, and Workflow (C) is not a mandatory component of a contract_sla record, as SLAs can operate without attaching a workflow.

Answer

Assigned to user mandatory script

Answer

Workflow

Question 14

Which TWO actions occur automatically when a Major Incident Candidate is promoted to a Major Incident using the Major Incident Management workbench? (Choose two.)

Accepted Answer

A dedicated Major Incident Workbench is populated with relevant timeline and stakeholder tasks.. Option C is correct because promoting a Major Incident Candidate in the Major Incident Management workbench automatically populates the dedicated Major Incident Workbench with the relevant timeline entries and stakeholder tasks, giving responders a centralized view for coordination and communication. Option E is correct because the promotion drives the incident through the configured state model, automatically moving it to 'In Progress' or a custom major incident state flow defined in the configuration. Options A, B, and D are incorrect: promotion never grants the caller admin access, does not automatically close associated child incidents (they remain linked and are managed separately), and does not downgrade priority to Low—major incidents typically retain or raise priority.

Answer

The caller of the incident is automatically granted admin access.

Answer

All associated child incidents are automatically closed.

Answer

The priority of the incident is automatically downgraded to Low.

Question 15

A Major Incident is declared. Which THREE of the following actions are automatically performed or enabled by the Major Incident Management plugin?

Accepted Answer

Access to the Major Incident Workbench.. Option A is correct because the Major Incident Management plugin provides the Major Incident Workbench, a dedicated console that gives responders a consolidated view of the major incident, its child incidents, affected services, and communication status. Option C is correct because the plugin automatically generates communication plan tasks, which drive the notifications and updates that must be sent to stakeholders during a major incident. Option D is correct because the plugin creates a Major Incident Candidate record when a candidate is promoted, allowing the incident to be managed through the major incident lifecycle. Option B is not correct because the plugin does not automatically assign the major incident to the Service Desk manager; assignment is driven by configured assignment rules or manual action. Option E is not correct because the plugin does not automatically close all related incidents; related incidents are linked and managed, but closure remains a controlled process.

Answer

Automatic assignment to the Service Desk manager.

Answer

Automatic closure of all related incidents.