CIS-ITSM Incident Management Practice Test 3 — 15 Questions

Question 1

Which TWO of the following can trigger the creation of a 'Problem' record from an 'Incident'?

Accepted Answer

Create Problem UI Action. The 'Create Problem' UI Action is a correct answer because it is a form button on the Incident record that, when clicked, opens a new Problem record and links it back to the originating Incident via the 'Created from Incident' relationship. Flow Designer is also correct because a flow can be configured with an Incident trigger (e.g., record created or updated) and a Create Problem action, allowing automated Problem creation based on conditions such as priority or category. A Business Rule is not correct here because, while it can run server-side logic on Incident insert/update, it does not natively create a Problem record without custom scripting, and it is not the standard mechanism for this action. An Assignment Rule only sets the assignment group and assigned user on a record and cannot create a Problem. A Catalog Item is a requestable item in the Service Catalog and has no role in generating Problem records from Incidents.

Answer

Business Rule

Answer

Assignment Rule

Answer

Catalog Item

Question 2

An organization wants to ensure that when an incident is assigned to a specific assignment group, the 'Assigned to' field automatically populates with the manager of that group. Which configuration is best for this requirement?

Accepted Answer

Create a Business Rule on the Incident table that runs before insert or update.. A Business Rule on the Incident table that runs before insert or update is the best configuration because it allows the system to automatically set the 'Assigned to' field to the manager of the assignment group when the incident is assigned to that group. This ensures the field is populated correctly at the time of assignment, and the before rule can modify the record before it is saved to the database.

Answer

Configure an Assignment Rule on the Incident table.

Answer

Set a Default Value on the 'Assigned to' field dictionary entry.

Answer

Create an OnLoad Client Script.

Question 3

Which role is required to manage incident SLAs?

Accepted Answer

sla_admin. The 'sla_admin' role is specifically designed to manage SLA definitions and related configurations in ServiceNow. This role grants the necessary permissions to create, modify, and delete SLA records, as well as manage SLA breakdowns and schedules. It is the least privileged role that can perform these tasks.

Answer

itil

Answer

admin

Answer

incident_manager

Question 4

A Major Incident has been promoted. The Incident manager needs to ensure that all child incidents are updated when the parent incident state changes to Resolved. How should this be achieved?

Accepted Answer

Use the 'Major Incident' state flow configuration.. ServiceNow's Major Incident Management includes a built-in 'Major Incident' state flow configuration that propagates state changes from the parent major incident to all linked child incidents. When the parent is moved to Resolved, this configuration automatically updates the child incidents' states, ensuring consistency without custom code. This is the standard, supported mechanism for parent-child state synchronization.

Answer

Configure a Data Policy.

Answer

Create a Scheduled Job to sync states.

Answer

Write a Client Script on the child incident table.

Question 5

You are configuring a new Incident Record Producer. You want to map the 'Urgency' variable to the Incident 'Urgency' field. How do you map this dynamically?

Accepted Answer

Use the 'Map to field' attribute on the variable.. In ServiceNow Catalog variables, the 'Map to field' attribute (configured on the variable's 'Advanced' or 'Type' settings, or via the Variable's 'Map to field' related list) dynamically maps a variable value to a field on the target record (e.g., Incident.Urgency). This is the standard, declarative way to pass catalog variable data to the record created by the Record Producer.

Answer

Use a Business Rule on the sc_req_item table.

Answer

Use a Flow Designer action.

Answer

Use a Catalog Client Script to set the field value.

Question 6

Which module allows an administrator to define how incidents are escalated?

Accepted Answer

Incident > Escalation. The escalation configuration in ServiceNow is found under 'Incident > Escalation', where administrators define escalation rules that trigger based on conditions like time open, priority, or state. This is the module path used to set up how incidents are escalated to higher tiers or managers. It is the standard navigation location for incident escalation setup.

Answer

System Definition > Escalations

Answer

Service Management > Escalations

Answer

SLA > Escalation

Question 7

What is the purpose of the 'Incident Task' table?

Accepted Answer

To allow multiple groups to work on an Incident simultaneously.. The Incident Task table allows an incident to be broken into multiple child tasks that can be assigned to different groups or individuals and worked in parallel, enabling coordinated multi-team response. It does not replace the Incident table, track problem SLAs, or automate closure. Each task has its own state, assignment, and SLA, while the parent incident remains the single point of accountability.

Answer

To replace the Incident table.

Answer

To track SLA metrics for problems.

Answer

To automate incident closure.

Question 8

A user complains that they can see 'Incident' but not 'Problem'. What is the most likely reason?

Accepted Answer

The user lacks the 'problem' role.. In ServiceNow, access to the Problem module is governed by the 'problem' role, which is separate from the 'itil' role. The 'itil' role grants access to Incident, Problem, Change, and Request modules by default in many configurations, but the specific 'problem' role is required to see and work with Problem records. Without the 'problem' role, the user will not see the Problem application module or be able to access Problem records, even if they have 'itil'.

Answer

The user is not in the correct assignment group.

Answer

The user has the 'itil' role which excludes Problem access.

Answer

The 'Problem' module is deactivated.

Question 9

An organization requires that incidents created from a specific catalog item are automatically assigned to the 'Service Desk' group. What is the best way to implement this?

Accepted Answer

Record Producer script.. The [CORRECT] answer is C. A Record Producer is a Service Catalog feature that lets you define a catalog item which, when ordered, creates a record (such as an Incident) on a specified table. Within the Record Producer's script field, you can set the assignment group directly on the generated record before it is inserted, ensuring incidents from that specific catalog item are automatically routed to the 'Service Desk' group. This is the most targeted, item-specific method.

Answer

Assignment Rule.

Answer

Business Rule on the Catalog Task table.

Answer

UI Policy.

Question 10

When resolving an incident, the system automatically checks for related resolved incidents. What feature provides this functionality?

Accepted Answer

Related Incidents logic.. The 'Related Incidents' logic in ServiceNow automatically searches for and displays incidents that are related to the current incident, including those that have been resolved. This feature helps agents identify similar past issues and their resolutions, potentially speeding up the current incident's resolution. It is a built-in functionality within the Incident Management module that leverages fields like caller, category, or configuration item to suggest relationships.

Answer

Knowledge Management.

Answer

Incident Deflection.

Answer

Problem Management.

Question 11

Which THREE items can be added to an incident using the 'Related Records' section?

Accepted Answer

Parent Incident. In the 'Related Records' section of an incident, you can link other ITSM records that have a meaningful relationship to the incident. Option B (Parent Incident) is correct because incidents can be linked in a parent-child hierarchy to group related incidents under a single parent for consolidated management. Option C (Change Request) is correct because a change request can be associated with an incident when the incident's resolution depends on or results from a change. Option E (Problem) is correct because incidents are commonly linked to a problem record when multiple incidents share a common root cause, enabling problem management to investigate. Options A (System User) and D (Knowledge Article) are not added via the 'Related Records' section: users are associated through caller/assignment fields or the Affected User/Opened By fields, and knowledge articles are linked through the Knowledge section or 'Attach Knowledge' functionality rather than the Related Records related list.

Answer

System User

Answer

Knowledge Article

Question 12

Which TWO ways can you restrict who can resolve an incident?

Accepted Answer

UI Policy to hide the 'Resolve' button.. Option C is correct because a UI Policy can be configured with a condition (e.g., based on role, assignment group, or user) that hides or disables the 'Resolve' button on the incident form, effectively preventing unauthorized users from resolving the incident through the UI. Option D is correct because a Write ACL on the 'State' field can restrict which users are allowed to write the value that transitions an incident to Resolved (state 6), enforcing the restriction at the database/API level regardless of UI. Option A is incorrect because Incident Properties are system-wide configuration settings (e.g., defaults, behaviors) and do not control per-user resolution permissions. Option B is incorrect because a dictionary override changes field-level attributes like default values or read-only behavior on a table/field, not who is authorized to resolve incidents. Option E is incorrect because a Business Rule on the User table operates on user records and does not govern incident resolution permissions.

Answer

Update the Incident Properties.

Answer

Dictionary override.

Answer

Business Rule on the User table.

Question 13

Which THREE fields are mandatory by default in the Incident module?

Accepted Answer

Category. In the ServiceNow Incident module, the three fields that are mandatory by default are Category (A), Caller (B), and Short Description (C). Category (A) is required because it drives incident classification, routing, and reporting, and the base system marks it mandatory on the incident form. Caller (B) is mandatory because an incident must be associated with the user reporting or affected by the issue, enabling communication and SLA tracking. Short Description (C) is mandatory as the concise summary of the incident that identifies the issue at a glance. Location (D) is not mandatory by default; it is optional and often auto-populated from the caller's record. Resolution Notes (E) is not mandatory at creation; it is typically required only when resolving or closing an incident, not as a default mandatory field on the form.

Answer

Location

Answer

Resolution Notes

Question 14

Which THREE components must be configured to use the Major Incident Management features?

Accepted Answer

Incident State transition definition.. The Major Incident Management (MIM) feature set in ServiceNow requires the Major Incident Management plugin (E) to be activated, since it installs the core tables, roles, and UI actions that power the promote/demote workflow. Incident State transition definition (B) is required because MIM relies on defined state transitions (for example, moving an incident to the Major Incident state) to trigger promotion and demotion logic. Communication plan definitions (D) are also required so that notifications, tasks, and stakeholder communications are generated automatically when a major incident is declared. The CMDB Health dashboard (A) is unrelated to MIM configuration, as it only reports on CMDB data quality, and Service Portal configuration (C) is not mandatory for MIM because major incidents can be managed from the platform UI without portal customization.

Answer

CMDB Health dashboard.

Answer

Service Portal configuration.

Question 15

Which TWO of the following are common methods to populate the 'Affected CI' on an incident?

Accepted Answer

Manual selection from the CI list.. Option B (Manual selection from the CI list) is correct because users can directly pick the affected CI from the Configuration Item reference field on the incident form, which is a standard out-of-box method for populating that field. Option D (Automatic population from the Caller's record) is correct because when a caller is selected, the system can auto-fill the Affected CI based on the caller's associated CI (e.g., via the caller's user record or related asset), which is a common configuration in ITSM platforms. Option A (Incident Business Rules) is not a standard population method by itself; business rules can set values but are not a recognized 'method' for populating Affected CI in the context of this question. Option C (Email Subject parsing) is not a typical mechanism for setting Affected CI, as inbound email parsing usually handles description or caller, not CI identification. Option E (System property configuration) is incorrect because system properties control global behavior, not the population of a specific incident field like Affected CI.

Answer

Incident Business Rules.

Answer

Email Subject parsing.

Answer

System property configuration.