CIS-ITSM Incident Management Practice Test 7 — 15 Questions

Question 1

What is the difference between 'Work Notes' and 'Comments' in an incident?

Accepted Answer

Work notes are internal; Comments are visible to the caller. In ServiceNow Incident records, 'Work Notes' are internal and visible only to users with appropriate roles (such as ITIL), while 'Comments' (also called Additional Comments) are visible to the caller and external parties. This distinction is fundamental to incident communication.

Answer

Work notes are mandatory; Comments are optional

Answer

Work notes are visible to the caller; Comments are internal

Answer

None

Answer

Both are visible to everyone

Question 2

An organization wants to capture 'Resolution Code' values that are specific to the 'Network' category. How is this achieved?

Accepted Answer

Dependent Values on the Choice field. Dependent Values on a Choice field is the standard ServiceNow mechanism for cascading choice lists, where the options in one field are filtered based on the value selected in another. To capture Resolution Codes specific to the 'Network' category, you configure the Resolution Code choice field with a dependent relationship to the Category field, so only Network-related codes appear when Category = Network.

Answer

ACLs

Answer

System Properties

Answer

Client Script

Question 3

What is the purpose of the 'Parent Incident' field?

Accepted Answer

To link child incidents to a master incident. The 'Parent Incident' field is used to link child incidents to a master incident, typically a major incident. When a major incident is created, related child incidents are associated with it via the Parent Incident field, creating a hierarchical relationship. This allows the major incident to serve as a coordination point, and child incidents inherit updates and share context with the parent.

Answer

To link an incident to a problem

Answer

To link an incident to a user

Answer

To define the SLA group

Question 4

What is the 'Service Desk' group's primary role in Incident Management?

Accepted Answer

Single Point of Contact for end users. The Service Desk is defined in ITIL as the Single Point of Contact (SPOC) between the IT organization and users, handling all incident reports, service requests, and communications. Its primary role in Incident Management is to log, categorize, prioritize, and route incidents, and to keep users informed — not to own SLAs or fix every issue itself.

Answer

Managing service level agreements

Answer

Developing new applications

Answer

Fixing all hardware issues

Question 5

When creating an Incident from a Service Portal, which component defines the fields displayed to the user?

Accepted Answer

Record Producer. A Record Producer is used to create records (like Incidents) from the Service Portal. It defines the fields that are displayed to the user by allowing you to select which variables to include and how they map to the target record. The Record Producer essentially acts as a form builder for record creation.

Answer

Incident Form

Answer

Catalog Item

Answer

Business Rule

Question 6

Which feature allows an agent to create a knowledge article directly from an Incident?

Accepted Answer

Create Knowledge UI Action. The 'Create Knowledge' UI Action on the Incident form allows an agent to generate a knowledge article pre-populated with incident details such as short description, description, and resolution notes. This native UI Action streamlines the knowledge creation process directly from the incident context.

Answer

Incident Template

Answer

Import Set

Answer

Knowledge Management Plugin

Question 7

Which role is the minimum required to read and update incident records?

Accepted Answer

itil. The itil role in ServiceNow is the minimum role that grants read and write access to incident, problem, and change records. It is designed for ITIL process users such as service desk agents who need to work on incidents daily. The user role alone cannot update incidents, and admin/itil_admin are higher-privileged than required.

Answer

user

Answer

admin

Answer

itil_admin

Question 8

What is the purpose of the 'Configuration Item' (CI) field on the Incident form?

Accepted Answer

To identify the affected asset. The Configuration Item (CI) field on the Incident form identifies the specific asset, service, or infrastructure element affected by the incident, linking the incident to the CMDB. This linkage enables impact analysis, SLA targeting based on the CI's criticality, and root-cause correlation across incidents affecting the same CI. It is not used for reporter identity, SLA grouping, or resolution notes.

Answer

To list the incident reporter

Answer

To define the SLA group

Answer

To store the resolution notes

Question 9

What happens when an incident 'Priority' is changed from 3 to 1?

Accepted Answer

SLA target dates are recalculated. When an incident's Priority is changed from 3 to 1, the SLA target dates are recalculated based on the new priority's SLA definitions. This is because SLAs are attached based on priority, and a change in priority triggers the SLA engine to re-evaluate and adjust the target times for response and resolution.

Answer

The incident is deleted

Answer

The caller is notified via email

Answer

The incident is automatically closed

Question 10

Which field on the Incident form indicates the urgency of the issue from the user's perspective?

Accepted Answer

Urgency. The Urgency field on the Incident form captures how quickly the user believes the issue needs to be resolved from their perspective. In ServiceNow, Urgency is a user-supplied value (typically High, Medium, Low) that reflects the business or personal need for speed, independent of technical severity. It is a core input to the Priority calculation, which combines Urgency and Impact to determine the overall priority of the incident.

Answer

Priority

Answer

Severity

Answer

Impact

Question 11

Which mechanism ensures that if an Incident is not updated for 24 hours, an email is sent to the manager?

Accepted Answer

Inactivity Monitor. The Inactivity Monitor is a ServiceNow feature that sends notifications when a record has not been updated for a specified period. It is configured to monitor the Incident table and trigger an email to the manager after 24 hours of inactivity.

Answer

Workflow

Answer

Business Rule

Answer

Client Script

Question 12

You want to hide the 'Impact' field for users who do not have the 'itil' role. Where is the most appropriate place to configure this?

Accepted Answer

UI Policy. A UI Policy is the correct place to hide the 'Impact' field for users without the 'itil' role, because UI Policies control field visibility, mandatory, and read-only behavior on the client side based on conditions like role or field values. They are the standard ServiceNow mechanism for role-based form field display.

Answer

ACL

Answer

Data Policy

Answer

Client Script

Question 13

Which TWO components can be used to notify a user about an incident update?

Accepted Answer

Customer Comments. Customer Comments (A) are correct because they are visible to the caller/end user on the incident record and, when added, can trigger outbound communication such as an email notification to the user, thereby notifying them of an update. Email Notification (E) is correct because it is the mechanism that actually sends an email to the user (for example, via a notification configured on the incident table when a comment is added or the record is updated). Assignment Rule (B) is not correct because it only automatically sets fields such as assignment group or assigned user during insert/update and does not notify users. Work Notes (C) are not correct because they are internal-only and are not visible to the end user. UI Policy (D) is not correct because it only dynamically changes form field behavior (visible, mandatory, read-only) on the client side and does not send notifications.

Answer

Assignment Rule

Answer

Work Notes

Answer

UI Policy

Question 14

Which TWO fields are commonly used to categorize an incident?

Accepted Answer

Category. Category (C) is correct because it is the primary classification field used to group incidents into broad types such as hardware, software, or network, enabling reporting and routing. Subcategory (D) is correct because it refines the Category into a more specific classification (for example, under Hardware: Printer or Laptop), which is the standard two-level categorization model in ITSM tools like ServiceNow. Together, Category and Subcategory are the fields commonly used to categorize an incident. SLA Definition (A) defines the service-level target applied to the ticket, not its classification. Resolution Code (B) records how the incident was resolved and is used for closure analysis, not categorization. Assignment Group (E) identifies the team responsible for working the incident, which is routing/ownership rather than categorization.

Answer

SLA Definition

Answer

Resolution Code

Answer

Assignment Group

Question 15

Which THREE fields are auto-populated when an incident is created via email?

Accepted Answer

Description. When an incident is created via email, the email body is auto-populated into the Description field (B), since the message content becomes the detailed incident text. The email subject line is auto-populated into the Short Description field (C), providing the incident's summary/title. The sender's email address is matched against user records to auto-populate the Caller field (E), identifying who reported the incident. Priority (A) is not auto-populated from email because it is typically assigned by the system based on impact/urgency rules or set manually, and SLA (D) is not a field populated at creation but rather a derived/attached record calculated from the assignment and priority, so neither belongs among the auto-populated fields.

Answer

Priority

Answer

SLA