CIS-ITSM Incident Management Practice Test 6 — 15 Questions

Question 1

You are troubleshooting a scenario where an Incident SLA is not attaching to a ticket. What is the first place you should investigate?

Accepted Answer

SLA Definition Conditions. The first place to investigate when an Incident SLA is not attaching is the SLA Definition Conditions. SLA definitions in ServiceNow use start conditions, stop conditions, and pause conditions to determine when an SLA attaches to a task. If the conditions do not match the incident's field values (e.g., priority, category, assignment group), the SLA will not attach. Checking the SLA Definition Conditions first confirms whether the incident meets the criteria for the SLA to be applied.

Answer

Incident State

Answer

System Dictionary

Answer

User Preferences

Question 2

An ITIL user complains they cannot see the 'Major Incident' tab on an incident record. What is the most likely cause?

Accepted Answer

The 'Major Incident Management' plugin is not active.. The 'Major Incident' tab on an incident record is added by the Major Incident Management (MIM) plugin. If the plugin is not active, the tab and its related UI actions, fields, and workflows are not present on the form. Without the plugin, even users with the correct roles and group memberships will not see the tab. Therefore, the most likely cause is that the plugin is not active.

Answer

The user does not have the 'itil' role.

Answer

The incident is not in the 'In Progress' state.

Answer

The user needs to be a member of the 'Major Incident Management' group.

Question 3

Which role is specifically required to create or modify 'SLA Definitions'?

Accepted Answer

sla_admin. The 'sla_admin' role is specifically designed to create and modify SLA Definitions in ServiceNow. This role grants the necessary permissions to manage SLA records and their associated configurations. Other roles like 'admin' have broad privileges but are not specifically tailored for SLA management, and 'itil' or 'incident_manager' do not have the required rights to modify SLA definitions.

Answer

itil

Answer

admin

Answer

incident_manager

Question 4

What is the primary function of the 'Incident State' field choices?

Accepted Answer

To track the lifecycle stage of an incident. The Incident State field tracks the lifecycle stage of an incident — values like New, In Progress, On Hold, Resolved, and Closed represent where the incident is in its workflow. It is the primary indicator of progress and drives reporting, SLA pause logic, and closure requirements. It does not itself set priority or assignment.

Answer

To determine SLA priority

Answer

To define user visibility

Answer

To trigger the assignment rule

Question 5

Which tab on the Incident form is typically used to track communication with the caller?

Accepted Answer

Activity. The Activity tab on the Incident form is the standard location for tracking all communication with the caller, including outbound emails, inbound replies, comments, and work notes. It provides a chronological feed of all interactions, making it the primary tab for reviewing the communication history with the user.

Answer

Notes

Answer

SLA

Answer

Related Records

Question 6

What is the purpose of the 'Incident Task' table?

Accepted Answer

To break down a complex incident into smaller tasks. The Incident Task table in ServiceNow is used to break down a complex incident into smaller, assignable tasks. It allows multiple people or groups to work on different parts of a large incident, providing granular tracking and assignment.

Answer

To replace the Incident table

Answer

To store SLA definitions

Answer

To act as a parent for multiple incidents

Question 7

When using the 'On-Hold' state, which sub-field is typically used to explain why the incident is waiting?

Accepted Answer

On-Hold Reason. The 'On-Hold' state in ServiceNow incident management requires a mandatory sub-field called 'On-Hold Reason' to specify why the incident is paused. This field provides a structured, reportable reason (e.g., 'Awaiting Caller', 'Awaiting Change', 'Awaiting Problem') that distinguishes it from free-form notes. It ensures consistency and enables metrics like hold duration by reason. Therefore, C is correct.

Answer

Assignment Group

Answer

Work Notes

Answer

Resolution Code

Question 8

If an organization wants to prevent an Incident from being closed unless certain fields are populated, which feature should be used?

Accepted Answer

Data Policy. Data Policies in ServiceNow enforce mandatory field requirements at the database level regardless of how a record is saved (UI, import, script, or API). They are the correct feature to prevent an Incident from being closed unless specified fields are populated, because they apply consistently across all entry points.

Answer

Client Script

Answer

Assignment Rule

Answer

System Property

Question 9

When a Major Incident is created, what happens to the linked child incidents?

Accepted Answer

They are automatically updated with major incident information. When a Major Incident is created in ServiceNow, linked child incidents are automatically updated with major incident information. This ensures that all related incidents share the major incident context, including the major incident number, state, and communication updates. The system propagates key fields from the parent major incident to the child incidents so that support teams and users have consistent information across all linked records.

Answer

They are ignored by the system

Answer

They are deleted

Answer

They are closed immediately

Question 10

Which form component is used to quickly search the Knowledge Base based on incident short description?

Accepted Answer

Knowledge Sidebar. The Knowledge Sidebar is a contextual component embedded in incident records that automatically searches the Knowledge Base using the incident's short description. It surfaces relevant articles in real time, allowing agents to resolve issues faster without manually navigating to the Knowledge Base. This is a core feature of ServiceNow ITSM designed to integrate knowledge directly into the incident management workflow.

Answer

Incident History

Answer

Catalog

Answer

Service Portal

Question 11

Which field must be populated to allow the 'Resolution' tab to be visible or actionable?

Accepted Answer

Incident State. In ServiceNow Incident Management, the Resolution tab (or Resolution Information section) becomes visible and actionable only when the Incident State is set to 'Resolved' (or 'Closed'). The State field drives the form's UI behavior, so it must be populated correctly to expose resolution fields like Resolution code and Resolution notes.

Answer

Caller

Answer

Assignment Group

Answer

Category

Question 12

What is the correct order of operations when an incident meets criteria for both a standard SLA and an SLA pause condition?

Accepted Answer

Conditions are evaluated based on defined order. When an incident qualifies for multiple SLAs, ServiceNow evaluates SLA definitions in a defined order (typically the order field on the SLA definition, or the order in which they are processed). Pause conditions are evaluated as part of the SLA lifecycle, but the overall processing follows the configured order rather than a fixed rule like 'pause always wins'.

Answer

The latest SLA created always takes priority

Answer

Only one SLA can be active at a time

Answer

Pause conditions take precedence over start conditions

Question 13

What does the 'Caller' field on the Incident form reference?

Accepted Answer

The sys_user table. The 'Caller' field on the Incident form is a reference field that points to the sys_user table, identifying the user who reported the incident. It stores the sys_id of the user record and displays the user's name.

Answer

The incident table

Answer

The groups table

Answer

The cmn_department table

Question 14

Where do you configure the email notification that is sent to the 'Caller' when an incident is resolved?

Accepted Answer

System Notification > Email > Notifications. Email notifications in ServiceNow are configured in System Notification > Email > Notifications, where you define the notification trigger (e.g., incident resolved), recipients (e.g., Caller), and email template. This is the baseline module for all outbound notification rules.

Answer

Business Rule > Email

Answer

Incident Form Layout

Answer

Service Portal Configuration

Question 15

When an incident is moved to 'Resolved', what happens to the SLA timer?

Accepted Answer

The SLA timer stops. The [CORRECT] answer is C. In ServiceNow, when an incident is moved to the 'Resolved' state, the SLA timer stops because the resolution effectively ends the active work period. The SLA engine records the time spent up to resolution and marks the SLA as completed or met/missed based on the elapsed duration. The timer does not continue to run after resolution.

Answer

The SLA timer pauses indefinitely

Answer

The SLA timer continues

Answer

The SLA timer resets to zero