CIS-ITSM Incident Management — 25 Questions

Question 1

A service desk manager reports that priority is not updating automatically when Impact and Urgency are changed on an incident form. Where is the mapping between Impact, Urgency, and Priority configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Priority Lookup Rules. Priority is calculated using the Priority Lookup Rules table (sys_choice or Data Lookup Definitions depending on configuration), which maps impact and urgency combinations to a priority value.

Answer

Data Policies

Answer

UI Policies

Answer

Assignment Rules

Answer

Service Level Agreements (SLAs)

Question 2

A service desk analyst wants to assign an unassigned incident to themselves with a single click. Which UI Action provides this functionality out of the box?

Accepted Answer

Assign to me. The 'Assign to me' UI action sets the Assigned to field to the currently logged-in user and assigns the group if empty or matches group membership context.

Answer

Claim Incident

Answer

Self-Assign

Answer

Take Ownership

Question 3

A support agent needs to create a Problem record directly from an existing Incident while preserving the correlation between the two. Which related link or UI action should the agent use on the Incident form?

Accepted Answer

Create Problem. The 'Create Problem' UI action on the Incident form maps relevant incident details to a new problem record and establishes a baseline relationship.

Answer

Create Knowledge

Answer

Create Change Request

Answer

Create Major Incident

Question 4

An incident has been inactive in the 'Resolved' state for a specific number of days defined by system properties. Which out-of-the-box scheduled job automatically moves it to 'Closed'?

Accepted Answer

Autoclosed Incidents. The 'Autoclosed Incidents' scheduled job runs periodically to transition resolved incidents to closed status after a set duration.

Answer

Incident Escalation Job

Answer

Data Archival Job

Answer

SLA Generation Job

Question 5

An organization wants to ensure that when an incident is resolved, the Caller receives an email notification with a survey link. Which baseline module manages the triggering of this survey?

Accepted Answer

Assessment and Surveys (Assessment Metric Types). Surveys are triggered via Survey definitions attached to metric types or triggered by notifications/flows when an incident moves to Resolved or Closed state.

Answer

Incident Properties

Answer

Event Registry

Answer

SLA Definitions

Question 6

An administrator needs to configure the system so that when an incident is created from an inbound email, a specific Assignment Group is automatically populated based on the email subject. Which feature should be used to achieve this?

Accepted Answer

Inbound Email Actions. Inbound Actions evaluate incoming email content and can set field values, including the assignment group, on the target table such as incident.

Answer

Assignment Rules

Answer

Dictionary Overrides

Answer

Data Policies

Question 7

An administrator is configuring SLA Definitions for Incident Management. They need the SLA timer to pause whenever an incident is placed in the 'Awaiting Vendor' state. How should this be configured?

Accepted Answer

Set the Pause condition to State is Awaiting Vendor.. SLA Pause Conditions define when the SLA clock stops ticking, typically mapped to specific states such as 'Awaiting User' or 'Awaiting Vendor'.

Answer

Modify the Incident workflow to suspend timers.

Answer

Set the Stop condition to State is Awaiting Vendor.

Answer

Create a Business Rule to pause task_sla records.

Question 8

An enterprise requires that when a Major Incident is declared, a dedicated Child Incident task is automatically created for each affected business service found in the Business Service CI relationship. Which out-of-the-box feature supports this specialized workflow?

Accepted Answer

Major Incident Management (MIM) Workbench. Major Incident Management (MIM) includes specialized workflows and communication plans to handle major incidents, including child incident management.

Answer

Service Level Agreement Engine

Answer

Data Lookup Definitions

Answer

Incident Templates

Answer

Outbound REST Message

Question 9

An incident record has been closed, and a user calls in reporting the exact same issue is still occurring. What is the recommended ITIL and ServiceNow best practice?

Accepted Answer

Use the Reopen UI action if permitted by system properties and workflow.. Best practice recommends reopening the existing incident if within a short window, or creating a new incident and referencing the closed one, but ServiceNow's baseline configuration allows reopening or uses the Reopen UI action depending on properties.

Answer

Delete the closed incident and create a new one.

Answer

Convert the closed incident into a change request.

Answer

Modify the closed record state directly via database XML export.

Question 10

An administrator needs to track how many times an incident has been reassigned between different assignment groups to measure process efficiency. Which feature or field type natively captures and displays this movement?

Accepted Answer

The Reassignment count field on the Task table.. The Incident table inherits from Task, which includes the Reassignment count field, incremented automatically by business rules whenever the assignment group changes.

Answer

Audit Log History (sys_audit)

Answer

Metric Definition (Metrics)

Answer

SLA Breach Counter

Question 11

Which user role is required by default to create, manage, and close incident records within the standard ServiceNow IT Service Management application?

Accepted Answer

itil. The ITIL role grants standard fulfillment permissions for incident, problem, and change management modules.

Answer

snc_read

Answer

sn_incident_write

Answer

admin

Question 12

An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?

Accepted Answer

UI Policy. Client Scripts or UI Policies can enforce mandatory fields on form submission or state transition, but Data Policies or UI Policies specifically manage mandatory field states.

Answer

Dictionary Overrides

Answer

Access Control Lists (ACLs)

Answer

Assignment Rules

Question 13

An incident is associated with a Parent incident. What behavior does ServiceNow exhibit regarding state changes between parent and child incidents out of the box?

Accepted Answer

Resolving the parent incident can automatically resolve child incidents via business rules.. Out of the box, when a parent incident is resolved or closed, business rules can automatically resolve or close associated active child incidents.

Answer

Parent and child incidents must always have identical priority values.

Answer

Child incidents automatically inherit the assignment group of the parent upon creation only.

Answer

Child incidents must be manually closed one by one before the parent can close.

Question 14

When configuring Assignment Rules for incidents, what occurs if multiple assignment rules match the criteria of an incoming or updated incident record?

Accepted Answer

The rule with the lowest Order value executes first, and evaluation stops.. Assignment rules are evaluated based on their Order field; the first rule that matches the criteria (lowest order number) is applied, and subsequent rules are ignored.

Answer

The rule with the highest Order value takes precedence.

Answer

All matching assignment rules execute sequentially, overwriting the assignment group.

Answer

An error is logged indicating conflicting assignment parameters.

Question 15

A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?

Accepted Answer

It populates knowledge base articles with workarounds that agents can reference to resolve or workaround active incidents.. Known error articles published from problems appear in knowledge searches for service desk agents, allowing them to attach workarounds to active incidents.

Answer

It triggers an automatic change request to deploy the fix to production.

Answer

It removes the incident-to-problem relationship and creates a parent-child incident hierarchy.

Answer

It automatically closes all active incidents matching the problem category.

Question 16

An analyst opens an incident and needs to populate several fields quickly with predefined standard text for a VPN connectivity issue. Which ServiceNow feature should the analyst use?

Accepted Answer

Incident Templates. Templates allow users to apply predefined sets of field values to a form quickly.

Answer

Quick Messages

Answer

Data Policies

Answer

Catalog Client Scripts

Question 17

Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)

Accepted Answer

Clicking the 'Promote to Major Incident' UI action on the Incident form.. Major incidents can be promoted via UI actions on the incident form or automatically triggered via configured rules and thresholds.

Answer

Deleting the original incident and recreating it on the Major Incident table.

Answer

Modifying the Data Policy table definitions.

Answer

Modifying the dictionary override for the priority field.

Question 18

Which THREE components are configured when setting up a Service Level Agreement (SLA) Definition for Incident Management? (Choose three.)

Accepted Answer

Start condition. An SLA definition requires specifying the target table, duration/schedule, and workflow conditions (Start, Stop, Pause).

Answer

Assignment rule mapping

Answer

Data policy rule

Question 19

Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)

Accepted Answer

Short description. Out of the box, Caller and Short description are mandatory fields when creating an incident.

Answer

Configuration item

Answer

Work notes

Answer

Assignment group

Question 20

Which THREE actions can be performed when utilizing the incident-to-problem workflow in ITSM? (Choose three.)

Accepted Answer

Associate multiple active incidents to a single Problem record.. Problems can be created from incidents, incidents can be attached to existing problems, and related incidents can be resolved when the problem is fixed.

Answer

Convert the incident table class directly into a problem table class via schema map manipulation.

Answer

Automatically generate a hardware purchase order from the problem investigation.