CIS-ITSM Incident Management — All Questions With Answers

Question 1

An enterprise requires that when a Major Incident is declared, a dedicated Child Incident task is automatically created for each affected business service found in the Business Service CI relationship. Which out-of-the-box feature supports this specialized workflow?

Accepted Answer

Major Incident Management (MIM) Workbench. The Major Incident Management (MIM) Workbench is the out-of-the-box feature that supports specialized workflows for major incidents, including the automatic creation of child incident tasks for each affected business service. It provides a centralized console for managing major incidents and their related tasks.

Answer

Service Level Agreement Engine

Answer

Data Lookup Definitions

Answer

Incident Templates

Answer

Outbound REST Message

Question 2

An administrator needs to track how many times an incident has been reassigned between different assignment groups to measure process efficiency. Which feature or field type natively captures and displays this movement?

Accepted Answer

The Reassignment count field on the Task table.. The Reassignment count field on the Task table is a native, out-of-the-box integer field that increments each time the assignment group changes on a task record. It is automatically maintained by the platform and can be displayed on forms, lists, and reports without any custom scripting or configuration. This makes it the direct, purpose-built mechanism for measuring how often an incident bounces between groups.

Answer

Audit Log History (sys_audit)

Answer

Metric Definition (Metrics)

Answer

SLA Breach Counter

Question 3

An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?

Accepted Answer

UI Policy. UI Policies in ServiceNow are specifically designed to dynamically enforce field-level behavior on forms, such as making fields mandatory, read-only, or visible based on conditions. In this case, a UI Policy can be configured to trigger when the 'Resolve' button is clicked (via a UI Policy action or a client script) to ensure that 'Resolution code' and 'Resolution notes' are populated before allowing the incident to be resolved. This directly addresses the requirement to prevent closure without those fields.

Answer

Dictionary Overrides

Answer

Access Control Lists (ACLs)

Answer

Assignment Rules

Question 4

An incident is associated with a Parent incident. What behavior does ServiceNow exhibit regarding state changes between parent and child incidents out of the box?

Accepted Answer

Resolving the parent incident can automatically resolve child incidents via business rules.. In ServiceNow, parent-child incident relationships support automatic state propagation through out-of-the-box business rules. When a parent incident is resolved, the system can cascade that resolution to associated child incidents, ensuring consistent lifecycle management across related records. This behavior is governed by the 'Resolve Parent and Children' related link and associated business rules that synchronize state transitions.

Answer

Parent and child incidents must always have identical priority values.

Answer

Child incidents automatically inherit the assignment group of the parent upon creation only.

Answer

Child incidents must be manually closed one by one before the parent can close.

Question 5

A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?

Accepted Answer

It populates knowledge base articles with workarounds that agents can reference to resolve or workaround active incidents.. When a Known Error Article is created from a Problem record, it is published to the Knowledge Base and becomes available to Incident Management agents. Agents can search for and reference the article to find workarounds for active incidents that match the problem's symptoms, enabling faster resolution or workaround application while the permanent fix is pending. This is the core value of the Known Error Article in the ITIL problem-to-incident feedback loop.

Answer

It triggers an automatic change request to deploy the fix to production.

Answer

It removes the incident-to-problem relationship and creates a parent-child incident hierarchy.

Answer

It automatically closes all active incidents matching the problem category.

Question 6

Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)

Accepted Answer

Clicking the 'Promote to Major Incident' UI action on the Incident form.. Option A is correct because ServiceNow provides a 'Promote to Major Incident' UI action on the Incident form that, when clicked, creates a major incident record (typically on the Major Incident [mim] table or via the Major Incident Management plugin) and links it to the original incident. Option B is correct because Major Incident Candidate rules are configurable conditions evaluated on insert or update of an incident; when the criteria match, the system automatically flags the incident as a major incident candidate and can promote it, enabling automated escalation. Option C is wrong because deleting and recreating an incident on a different table breaks record continuity, loses audit history, and is not a supported escalation mechanism. Option D is wrong because Data Policies enforce field-level mandatory/read-only rules on task records and have nothing to do with major incident escalation. Option E is wrong because a dictionary override merely changes attribute behavior (such as default value or read-only) for a field on a child table and does not escalate incidents.

Answer

Deleting the original incident and recreating it on the Major Incident table.

Answer

Modifying the Data Policy table definitions.

Answer

Modifying the dictionary override for the priority field.

Question 7

Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)

Accepted Answer

Short description. Option D (Short description) is mandatory because ServiceNow's out-of-the-box Incident form requires a brief summary of the issue before the record can be saved, and it is enforced by the dictionary attribute mandatory=true on the short_description field. Option E (Caller) is also mandatory out of the box, since the incident must be associated with the user reporting or affected by the issue, and the caller_id field carries the mandatory flag by default. Option A (Configuration item) is not required at creation—it can be left empty and populated later during investigation. Option B (Work notes) is optional free-text documentation and is never enforced as mandatory. Option C (Assignment group) is not mandatory on the base form; incidents can be created unassigned and routed afterward.

Answer

Configuration item

Answer

Work notes

Answer

Assignment group

Question 8

An administrator needs to modify the priority lookup rules to ensure that incidents created with an Impact of 2 (Medium) and Urgency of 2 (Medium) automatically result in a Priority of 3 (Moderate). Where should the administrator navigate to configure this matrix in ServiceNow?

Accepted Answer

System Policy > Data Lookup Definitions > Priority Data Lookup Rules. Priority in ServiceNow is derived from the Impact/Urgency matrix, which is implemented as a Data Lookup Rule (a lookup table keyed on Impact and Urgency). To change the resulting Priority value, the administrator must edit the priority data lookup definition found under System Policy > Data Lookup Definitions. This is where the Impact=2/Urgency=2 combination maps to Priority=3.

Answer

System Definition > Dictionary > Incident > Priority

Answer

Incident > Administration > Priority Matrix

Answer

Service Level Management > SLA > Priority Calculation

Question 9

A service desk manager wants to ensure that when an incident is assigned to the Hardware group, the Assignment group field automatically populates the Assigned to field with a specific default handler if left empty, or dynamically limits the list of assignees. Which core ServiceNow feature should be configured to automatically populate or route incident assignment within a specific group?

Accepted Answer

Assignment Rules. Assignment Rules in ServiceNow are designed to automatically populate the 'Assigned to' field or limit the assignee list based on conditions such as assignment group. They are specifically configured to route incidents to the appropriate handler when a group is selected. This feature ensures that incidents are assigned efficiently without manual intervention.

Answer

Data Lookup Definitions

Answer

SLas definition conditions

Answer

Business Services Management

Question 10

A service desk technician attempts to close an incident, but the system prevents the closure and displays a mandatory error message requiring the 'Close code' and 'Close notes' fields to be populated. Which component of the Incident Management application enforces these fields upon state change to Closed?

Accepted Answer

Out-of-the-box UI Policy or Client Script. Out-of-the-box UI Policies and Client Scripts on the Incident table enforce mandatory fields like 'Close code' and 'Close notes' when the state changes to Closed or Resolved. These client-side components make fields mandatory and display the error message before the record is submitted, which matches the described behavior.

Answer

Access Control Lists (ACLs)

Answer

Workflow Engine

Answer

Dictionary Overrides

Question 11

A problem coordinator wants to create a new Problem record directly from an existing major Incident while retaining a bi-directional link so that updates to the Incident's workaround are automatically copied to the related Problem. How should the administrator achieve this relationship natively?

Accepted Answer

Use the 'Create Problem' UI Action on the Incident form. The 'Create Problem' UI Action on the Incident form is the native ServiceNow mechanism that creates a Problem record and automatically establishes a bi-directional relationship between the Incident and the Problem. It populates the Problem's 'Parent incident' field and creates the task relationship so that workaround updates flow between records. This is the out-of-box (OOB) approach designed specifically for this scenario.

Answer

Configure a Data Policy from Problem to Incident

Answer

Write a custom database trigger

Answer

Manually populate the Parent incident field on the Problem form

Question 12

An IT support team member needs to quickly communicate a known workaround to all active incidents related to a specific active Problem record. Which related link or related list on the Problem form enables the propagation of the workaround to all associated incidents?

Accepted Answer

Communicate Workaround UI Action. The 'Communicate Workaround' UI Action on the Problem form is the related link that pushes the workaround text to all incidents associated with that Problem record. It updates the work notes or workaround field on each linked incident so agents see the fix immediately. This is the built-in mechanism for propagating a workaround from Problem to its related Incidents.

Answer

Global Incident Synchronizer

Answer

Push Updates Business Rule

Answer

Broadcast Incident Action

Question 13

An administrator is configuring Service Level Agreements (SLAs) for the Incident table. Which THREE elements are required components of a standard SLA definition (contract_sla) record in ServiceNow? (Choose three.)

Accepted Answer

Duration. In a ServiceNow contract_sla record, the Duration field (B) is a required component because it defines the total elapsed time allowed for the SLA to be met, expressed as a duration value such as 4 hours or 2 business days. The Start condition (D) is required because it determines the trigger that begins the SLA timer, for example when the Incident is created or when it enters a specific state. The Target (E) is also required because it specifies the goal field and value that must be reached to satisfy the SLA, such as resolving the incident before the duration expires. The Assigned to user mandatory script (A) is not a standard required element of an SLA definition, and Workflow (C) is not a mandatory component of a contract_sla record, as SLAs can operate without attaching a workflow.

Answer

Assigned to user mandatory script

Answer

Workflow

Question 14

Which TWO actions occur automatically when a Major Incident Candidate is promoted to a Major Incident using the Major Incident Management workbench? (Choose two.)

Accepted Answer

A dedicated Major Incident Workbench is populated with relevant timeline and stakeholder tasks.. Option C is correct because promoting a Major Incident Candidate in the Major Incident Management workbench automatically populates the dedicated Major Incident Workbench with the relevant timeline entries and stakeholder tasks, giving responders a centralized view for coordination and communication. Option E is correct because the promotion drives the incident through the configured state model, automatically moving it to 'In Progress' or a custom major incident state flow defined in the configuration. Options A, B, and D are incorrect: promotion never grants the caller admin access, does not automatically close associated child incidents (they remain linked and are managed separately), and does not downgrade priority to Low—major incidents typically retain or raise priority.

Answer

The caller of the incident is automatically granted admin access.

Answer

All associated child incidents are automatically closed.

Answer

The priority of the incident is automatically downgraded to Low.

Question 15

A Major Incident is declared. Which THREE of the following actions are automatically performed or enabled by the Major Incident Management plugin?

Accepted Answer

Access to the Major Incident Workbench.. Option A is correct because the Major Incident Management plugin provides the Major Incident Workbench, a dedicated console that gives responders a consolidated view of the major incident, its child incidents, affected services, and communication status. Option C is correct because the plugin automatically generates communication plan tasks, which drive the notifications and updates that must be sent to stakeholders during a major incident. Option D is correct because the plugin creates a Major Incident Candidate record when a candidate is promoted, allowing the incident to be managed through the major incident lifecycle. Option B is not correct because the plugin does not automatically assign the major incident to the Service Desk manager; assignment is driven by configured assignment rules or manual action. Option E is not correct because the plugin does not automatically close all related incidents; related incidents are linked and managed, but closure remains a controlled process.

Answer

Automatic assignment to the Service Desk manager.

Answer

Automatic closure of all related incidents.

Question 16

An incident is created via email. The system identifies a matching CI, but the 'Incident State' remains 'New' instead of 'In Progress' despite the assignment group being populated. What is the most likely cause?

Accepted Answer

The business rule or email action lacks a script to trigger the 'In Progress' state transition.. When an incident is created via email, the inbound email action or a business rule is responsible for parsing the email, matching the CI, and setting fields like assignment group and state. If the assignment group is populated but the state remains 'New', the most likely cause is that the script responsible for the state transition to 'In Progress' is missing or not executing — the OOB inbound action sets the state, but a custom or modified action may omit that step.

Answer

The CI record lacks an 'Assigned To' field.

Answer

The 'Incident State' field does not have an 'In Progress' choice.

Answer

The incident state is read-only for the system user.

Question 17

You need to ensure that an incident automatically moves to 'Resolved' state when all associated tasks are closed. Which approach utilizes the native ServiceNow engine?

Accepted Answer

Use an Incident Business Rule to query related tasks and set the state to Resolved.. A Business Rule on the Incident table is the native server-side engine that can query related task records (via GlideRecord on the task table filtered by the parent incident) and set the incident state to Resolved when all tasks are closed. Business Rules execute on database operations and are the standard ServiceNow mechanism for enforcing conditional state transitions based on related records.

Answer

Create an Assignment Rule to update the state.

Answer

Configure a SLA Definition to trigger resolution.

Answer

Set up a Flow Designer flow to execute a client-side script.

Question 18

Which THREE of the following are valid ways to trigger the Major Incident Management workflow?

Accepted Answer

Clicking the 'Propose Major Incident' button on an incident record.. Option A is correct because the 'Propose Major Incident' UI action on an incident record is a supported manual trigger that initiates the Major Incident Management workflow. Option B is correct because Major Incident Trigger Rules evaluate incident conditions and can automatically start the workflow when predefined criteria are met. Option D is correct because promoting a child incident to a major incident is a valid trigger path that launches the Major Incident Management workflow. Option C is not correct because a scheduled job checking incident volume is not a defined trigger mechanism for this workflow. Option E is not correct because a direct CMDB integration is not a supported trigger for the Major Incident Management workflow.

Answer

A scheduled job that checks for incident volume.

Answer

Via a direct integration with the CMDB.

Question 19

An Incident is related to a Problem record. When the Problem is resolved, the related Incidents should be updated automatically. How is this typically managed?

Accepted Answer

UI Action on the Problem table. A UI Action on the Problem table is the correct mechanism because when a Problem is resolved, the action of resolving it is a user-initiated event on the Problem record. A UI Action can be configured to run on the Problem form (e.g., when the 'Resolve' button is clicked) and include a script that updates all related Incident records. This directly ties the update of Incidents to the resolution action of the Problem, ensuring automatic synchronization. Other options like Business Rules or Flow Designer triggers on the Incident table would not be triggered by a change on the Problem record, and a Scheduled Job would not be event-driven.

Answer

Business Rule on the Incident table

Answer

Flow Designer trigger on Incident table

Answer

Scheduled Job

Question 20

When configuring an 'Incident Record Producer', what is the purpose of the 'Script' field?

Accepted Answer

To map variables to fields on the target record. In an Incident Record Producer, the 'Script' field is used to map variables from the record producer to fields on the target Incident record. This script runs when the record is submitted and determines how the data entered by the user is transferred to the incident fields.

Answer

To hide fields from the end user

Answer

To trigger an email notification

Answer

To define the Incident assignment group

CIS-ITSM Incident Management — All Questions With Answers

An enterprise requires that when a Major Incident is declared, a dedicated Child Incident task is automatically created for each affected business service found in the Business Service CI relationship. Which out-of-the-box feature supports this specialized workflow?

An administrator needs to track how many times an incident has been reassigned between different assignment groups to measure process efficiency. Which feature or field type natively captures and displays this movement?

An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?

An incident is associated with a Parent incident. What behavior does ServiceNow exhibit regarding state changes between parent and child incidents out of the box?

A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?

Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)

Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)

An administrator needs to modify the priority lookup rules to ensure that incidents created with an Impact of 2 (Medium) and Urgency of 2 (Medium) automatically result in a Priority of 3 (Moderate). Where should the administrator navigate to configure this matrix in ServiceNow?

A problem coordinator wants to create a new Problem record directly from an existing major Incident while retaining a bi-directional link so that updates to the Incident's workaround are automatically copied to the related Problem. How should the administrator achieve this relationship natively?

An IT support team member needs to quickly communicate a known workaround to all active incidents related to a specific active Problem record. Which related link or related list on the Problem form enables the propagation of the workaround to all associated incidents?

An administrator is configuring Service Level Agreements (SLAs) for the Incident table. Which THREE elements are required components of a standard SLA definition (contract_sla) record in ServiceNow? (Choose three.)

Which TWO actions occur automatically when a Major Incident Candidate is promoted to a Major Incident using the Major Incident Management workbench? (Choose two.)

A Major Incident is declared. Which THREE of the following actions are automatically performed or enabled by the Major Incident Management plugin?

An incident is created via email. The system identifies a matching CI, but the 'Incident State' remains 'New' instead of 'In Progress' despite the assignment group being populated. What is the most likely cause?

You need to ensure that an incident automatically moves to 'Resolved' state when all associated tasks are closed. Which approach utilizes the native ServiceNow engine?

Which THREE of the following are valid ways to trigger the Major Incident Management workflow?

An Incident is related to a Problem record. When the Problem is resolved, the related Incidents should be updated automatically. How is this typically managed?

When configuring an 'Incident Record Producer', what is the purpose of the 'Script' field?

How can an agent escalate an incident that is currently 'In Progress'?

If you need to ensure that an incident cannot be resolved unless the 'Work Notes' field is not empty, which method is most effective?

When an incident is set to 'On Hold', the 'On Hold' timer should begin. How is this configured?

Which THREE are valid stages in the standard Incident lifecycle?

Which THREE factors influence the Priority calculation in the default ITSM Incident Management?

Which THREE items are required to properly define an SLA?

Which THREE actions can be performed via the Incident 'Related Links'?

Which THREE are standard 'Resolution Codes' in ServiceNow?

Which TWO methods are used to restrict visibility of Incident fields?

Which TWO fields are essential for the 'Incident - Resolve' business rule to function correctly?

Which TWO of the following can trigger the creation of a 'Problem' record from an 'Incident'?

An organization wants to ensure that when an incident is assigned to a specific assignment group, the 'Assigned to' field automatically populates with the manager of that group. Which configuration is best for this requirement?

Which role is required to manage incident SLAs?

A Major Incident has been promoted. The Incident manager needs to ensure that all child incidents are updated when the parent incident state changes to Resolved. How should this be achieved?

You are configuring a new Incident Record Producer. You want to map the 'Urgency' variable to the Incident 'Urgency' field. How do you map this dynamically?

Which module allows an administrator to define how incidents are escalated?

What is the purpose of the 'Incident Task' table?

A user complains that they can see 'Incident' but not 'Problem'. What is the most likely reason?

An organization requires that incidents created from a specific catalog item are automatically assigned to the 'Service Desk' group. What is the best way to implement this?

When resolving an incident, the system automatically checks for related resolved incidents. What feature provides this functionality?

Which THREE items can be added to an incident using the 'Related Records' section?

Which TWO ways can you restrict who can resolve an incident?

Which THREE fields are mandatory by default in the Incident module?

Which THREE components must be configured to use the Major Incident Management features?

Which TWO of the following are common methods to populate the 'Affected CI' on an incident?

Which TWO steps are involved in the Incident-to-Problem workflow?

An incident manager needs to ensure that when a critical server goes down, the incident record automatically displays an alert banner at the top of the form to notify all agents. The banner must appear only for incidents where the 'Impact' field is set to 'High'. Which configuration should be used?

A service desk manager wants to ensure that when an incident is reassigned to a different assignment group, the previous assignee is automatically cleared and a work note is added documenting the change. Which approach should be used to meet this requirement?

A service desk agent is working on an incident and needs to see all other incidents that are related to the same configuration item (CI). Which feature should the agent use to view these related incidents directly from the incident record?

A service desk manager reports that priority is not updating automatically when Impact and Urgency are changed on an incident form. Where is the mapping between Impact, Urgency, and Priority configured?

A service desk analyst wants to assign an unassigned incident to themselves with a single click. Which UI Action provides this functionality out of the box?

A support agent needs to create a Problem record directly from an existing Incident while preserving the correlation between the two. Which related link or UI action should the agent use on the Incident form?

An incident has been inactive in the 'Resolved' state for a specific number of days defined by system properties. Which out-of-the-box scheduled job automatically moves it to 'Closed'?

An organization wants to ensure that when an incident is resolved, the Caller receives an email notification with a survey link. Which baseline module manages the triggering of this survey?

An administrator needs to configure the system so that when an incident is created from an inbound email, a specific Assignment Group is automatically populated based on the email subject. Which feature should be used to achieve this?

An administrator is configuring SLA Definitions for Incident Management. They need the SLA timer to pause whenever an incident is placed in the 'Awaiting Vendor' state. How should this be configured?

An incident record has been closed, and a user calls in reporting the exact same issue is still occurring. What is the recommended ITIL and ServiceNow best practice?

Which user role is required by default to create, manage, and close incident records within the standard ServiceNow IT Service Management application?

When configuring Assignment Rules for incidents, what occurs if multiple assignment rules match the criteria of an incoming or updated incident record?

An analyst opens an incident and needs to populate several fields quickly with predefined standard text for a VPN connectivity issue. Which ServiceNow feature should the analyst use?

Which THREE components are configured when setting up a Service Level Agreement (SLA) Definition for Incident Management? (Choose three.)

Which THREE actions can be performed when utilizing the incident-to-problem workflow in ITSM? (Choose three.)

When viewing an Incident record, where can an agent see a chronological audit trail of all field updates, comments, and work notes added by users and system processes?

Which TWO states are typically included in the baseline Incident lifecycle state model? (Choose two.)

Which TWO options represent valid ways an end user (caller) can check the status of their submitted incident? (Choose two.)

Which TWO considerations are important when designing Assignment Rules for Incident Management? (Choose two.)

Which THREE types of metrics can be tracked using the baseline Incident Management SLA and Metric definitions? (Choose three.)

An IT organization defines a Service Level Agreement (SLA) for Incident Resolution that must pause its timer whenever an incident moves to the 'Awaiting User Info' state. Where must this pause condition be configured within the SLA definition record?

A company requires that when an incident is assigned to a specific group, the 'Assigned to' field must be mandatory. Which configuration change accomplishes this using the most efficient ServiceNow best practice?

When configuring Incident Management properties (Incident > Administration > Properties), which TWO behaviors can an administrator control globally? (Choose two.)

A service desk manager needs to ensure that Incidents assigned to the 'Hardware' group are automatically routed to a specific sub-group based on the 'Category' field. Which configuration should be used?

An organization requires that when an Incident priority is set to '1 - Critical', a 'Major Incident' candidate record is created. What is the best practice approach?

Which field on the Incident form is calculated automatically based on the 'Impact' and 'Urgency' fields using the Priority Lookup Rules?

You are troubleshooting a scenario where an Incident SLA is not attaching to a ticket. What is the first place you should investigate?

An ITIL user complains they cannot see the 'Major Incident' tab on an incident record. What is the most likely cause?

Which role is specifically required to create or modify 'SLA Definitions'?

What is the primary function of the 'Incident State' field choices?

Which tab on the Incident form is typically used to track communication with the caller?

What is the purpose of the 'Incident Task' table?

When using the 'On-Hold' state, which sub-field is typically used to explain why the incident is waiting?

If an organization wants to prevent an Incident from being closed unless certain fields are populated, which feature should be used?