272 questions total · 4 pages · All types, answers revealed
You need to troubleshoot why a specific WMI probe is failing. Which log should you check on the MID Server host?
The agent log contains detailed execution logs for probes.
Why this answer
The agent log captures the execution of probes and any errors encountered during the process.
What is the purpose of the 'MID Server' log?
The MID Server log captures diagnostic events generated by the MID Server process itself, including probe execution, connectivity and Java errors. This directly satisfies the stem's troubleshooting constraint, since it isolates issues within the MID Server rather than discovery results or target device data.
Why this answer
The MID Server log is specifically used to record events and errors related to the MID Server process itself. It is essential for troubleshooting issues such as connectivity, authentication, and job execution problems. The log is stored on the MID Server host and can be accessed for diagnostics.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the purpose of various logs, and candidates may confuse the MID Server log with other logs like the discovery log or system log, but the MID Server log is specifically for the MID Server process.
How to eliminate wrong answers
Option B is wrong because discovered CI data is stored in the CMDB, not in the MID Server log. Option C is wrong because credentials are stored in the ServiceNow instance's credential store, not in the MID Server log. Option D is wrong because user activity is tracked in audit logs on the instance, not in the MID Server log.
Which THREE of the following are components or features that are part of the 'Discovery' to 'CMDB' data pipeline?
Discovery Patterns are the probe definitions that instruct Discovery on which protocols, commands and credentials to use when querying devices. They sit at the collection stage of the Discovery-to-CMDB pipeline, translating raw device responses into structured attribute data before it reaches the CMDB.
Why this answer
Discovery Patterns (A) are the reusable, content-based definitions that tell Discovery how to classify and map data from a CI (e.g., by parsing commands, SNMP OIDs, or WMI queries) into the correct CMDB class and attributes, making them a core part of the Discovery-to-CMDB pipeline. Reconciliation Rules (B) are the configurable rules that determine how incoming discovered data is merged with existing CMDB records, including which fields to update, ignore, or prioritize, so they directly govern how Discovery results are written into the CMDB. The Identification and Reconciliation Engine (IRE) (C) is the ServiceNow engine that processes discovery payloads, applies identification and reconciliation logic, and creates or updates CIs in the CMDB, making it the central component of this pipeline.
Incident Management (D) is an ITIL process for handling service disruptions and is not part of the Discovery-to-CMDB data flow, and Knowledge Management (E) is a separate module for storing articles and knowledge bases, unrelated to populating the CMDB from Discovery.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests whether candidates can distinguish CMDB pipeline components from ITSM processes that merely consume CMDB data — Incident and Knowledge Management are distractors because they are familiar ServiceNow modules.
You are a ServiceNow Discovery administrator. A discovery pattern for a network device is failing to populate the 'Firmware Version' attribute. You have confirmed that the SNMP OID for firmware version is correctly queried and returns a value. However, the attribute remains empty in the CMDB. What is the most likely reason for this issue?
The discovery pattern must include a step that maps the SNMP OID value to the correct CI attribute. If the pattern lacks this mapping or the mapping is incorrect, the attribute will remain empty even if the OID is queried. This is the most likely reason because the OID is correctly queried but the data is not stored, indicating a mapping issue in the pattern.
Why this answer
The most likely reason is that the discovery pattern does not have the correct step to map the SNMP OID to the 'Firmware Version' attribute. Even if the OID is queried, without a mapping step, the value is not written to the CI. The other options are less likely: identification rules do not affect attribute population, the attribute likely exists, and the pattern is running if other data is collected.
Exam trap
The trap here is assuming that querying the OID is sufficient, but the pattern must explicitly map the OID result to the CI attribute.
What is the purpose of the 'discovery_id' in a discovery log?
Each Discovery run is assigned a discovery_id that labels every log entry it produces, letting administrators trace messages back to one specific scan execution. This distinguishes concurrent or historical scans when correlating errors and statuses across the MID Server logs.
Why this answer
The discovery_id (or status ID) is a unique identifier for a specific Discovery scan execution, used for troubleshooting.
You are a ServiceNow Discovery administrator. After a recent discovery run, you notice that a Linux server CI has an incorrect operating system version attribute. You want to manually correct this value in the CMDB. Which module should you use to edit the CI record?
The Configuration > CIs module provides a list of all CIs in the CMDB. From there, you can open a specific CI record and edit its attributes manually. This is the standard way to correct a CI's data. It allows you to update fields like operating system version directly on the CI form.
Why this answer
To manually edit a CI record in the CMDB, you use the Configuration > CIs module. This module lists all CIs and allows you to open and modify their attributes. The other options are not designed for editing individual CI records; they serve different purposes such as managing classes, scheduling discovery, or monitoring CMDB health.
Exam trap
The trap here is thinking that the CI Class Manager is used to edit CI records, but it is actually for managing class definitions and attributes, not individual CIs.
Why would you choose to use a 'Discovery Behavior' instead of the default behavior?
Discovery Behaviors let you attach a custom set of probes to a discovery schedule, overriding the default probe selection. This satisfies the stem's need to limit or extend probes for particular scenarios, such as excluding slow patterns or adding targeted ones.
Why this answer
A Discovery Behavior is a configuration record that defines which probes and patterns run during discovery, allowing you to tailor the discovery process to specific device types or scenarios. By creating a custom Discovery Behavior, you can limit or extend the probes used, overriding the default behavior that applies to all devices. This is useful when certain devices require specialized probes or when you want to avoid unnecessary probes that could cause issues.
Exam trap
The trap here is confusing Discovery Behaviors with other configuration elements like schedules or credentials. Candidates might think that behaviors control IP ranges or scheduling, but those are separate. The key is that behaviors control the probes and patterns used during discovery.
How to eliminate wrong answers
Option A is wrong because updating CMDB identification rules is done through the Identification and Reconciliation Engine (IRE) configuration, not through Discovery Behaviors. Option B is wrong because defining IP ranges is part of the Discovery Schedule configuration, not the behavior. Option D is wrong because changing the schedule is done by modifying the Discovery Schedule record, not the behavior.
What is the difference between 'Identification' and 'Connection' in terms of CI ownership?
Identification probes create or update the primary CI record itself, whereas Connection probes establish the relationship links between that CI and its dependent CIs. This division satisfies the stem's ownership question: identification owns the CI, connection owns its dependencies.
Why this answer
The Identification section identifies the 'primary' CI, while Connection links it to others.
Which TWO of the following steps are required when adding a new CI relationship in a pattern?
The 'Define Relationship' step specifies the relationship type and direction between the pattern's CIs, which is mandatory for the pattern to generate the correct CMDB relationship records during discovery. Without it, no relationship type is declared.
Why this answer
You need to identify the related CI and then define the relationship between them.
Which THREE factors influence the successful identification of a CI in a pattern?
Rules determine how the CI is matched.
Why this answer
Identification rules, attribute mapping, and valid CMDB class structure are critical.
During the Shazzam phase, Discovery identifies that a port is open. If the port corresponds to a configured classifier but no trigger probe is defined, what is the default behavior?
When a port matches a configured classifier but lacks a trigger probe, Shazzam still passes it to classification, so the device is identified. Exploration, however, depends on trigger probes firing; without one, no further probing occurs, leaving the port classified but unexplored.
Why this answer
During the Shazzam phase, if a port is open and matches a classifier but no trigger probe is defined, the classification phase will still run (to classify the CI based on the classifier), but exploration cannot be triggered because exploration relies on trigger probes to launch additional probes. Thus, the CI may be classified but not fully explored.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the distinction between classification and exploration: candidates may think that without a trigger probe, classification fails, but actually classification succeeds and only exploration is skipped.
How to eliminate wrong answers
Option B is wrong because the CI is not ignored; classification can still occur, and the CI may be created or updated. Option C is wrong because Discovery does not guess the OS type; it relies on probes and classifiers to determine OS. Option D is wrong because the scan for that IP is not aborted; Discovery continues with other ports and IPs, but exploration for that specific CI is limited.
You are a ServiceNow Discovery administrator for a large enterprise. You have configured Discovery to populate the CMDB with data from multiple sources, including ServiceNow Discovery, SCCM, and a third-party asset management system. You need to ensure that the CMDB is not polluted with duplicate CIs and that the most authoritative data source wins when there are conflicts. Which feature should you use to achieve this?
The CMDB Identification and Reconciliation Engine (IRE) is designed to manage data from multiple sources. It uses identification rules to match incoming data to existing CIs and reconciliation rules to determine which source is authoritative for each attribute. This ensures that duplicates are minimized and the most trusted data is used. IRE is the correct feature to use in this scenario.
Why this answer
The CMDB Identification and Reconciliation Engine (IRE) is the correct feature because it provides the framework for identifying unique CIs and reconciling data from multiple sources. It allows you to define identification rules that specify which attributes to use for matching, and reconciliation rules that determine which source is authoritative for each attribute. This ensures data integrity and prevents duplicates.
Other options do not provide these capabilities.
Exam trap
The trap here is confusing the CMDB Health Dashboard with the IRE; the dashboard only reports on data quality, while the IRE actively enforces it.
When configuring an IP Range for a Discovery Schedule, what format must be used for a block of IPs?
ServiceNow's IP Range field accepts either CIDR notation or explicit start and end IP addresses, so both formats satisfy the schedule's address-block requirement. This flexibility lets you define contiguous ranges precisely, whether expressing a subnet as 192.168.1.0/24 or spanning 192.168.1.1 to 192.168.1.254, without converting between representations.
Why this answer
Exam trap
ServiceNow CIS-Discovery often tests the assumption that wildcard or comma-separated IP formats are accepted; the exam expects you to know that only CIDR or start/end address pairs define a valid IP Range.
How to eliminate wrong answers
Option A is wrong because wildcard notation like 10.10.*.* is not a valid IP range format in ServiceNow Discovery — the platform does not parse wildcards as address ranges. Option B is wrong because a decimal subnet mask alone does not define a range; Discovery expects CIDR or start/end addresses, not a bare mask. Option C is wrong because a comma-separated list of individual IPs is not how a block is defined; that would be inefficient and is not the supported range format.
A technician reports that Discovery is updating the 'Last discovered' field, but the 'Operational status' is not changing as expected. Where should you investigate the mapping of Discovery data to the CMDB?
IRE Data Source Rules govern how discovered data is mapped onto CMDB attributes during identification and reconciliation. If 'Last discovered' updates but 'Operational status' does not, the data source rule controlling that field's mapping is where the discrepancy originates.
Why this answer
The IRE Data Source Rules determine how Discovery data is mapped to CMDB fields, including operational status. When Discovery updates 'Last discovered' but not 'Operational status', the issue likely lies in the IRE Data Source Rules, which control which data source can update which attributes. Investigating these rules will reveal if operational status is excluded or mapped incorrectly.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the confusion between Discovery logs/dashboards and the IRE Data Source Rules, leading candidates to pick the log or dashboard for attribute mapping issues.
How to eliminate wrong answers
Option A is wrong because the Discovery Log records discovery activities and errors, but it does not control attribute mapping to the CMDB. Option C is wrong because CMDB Data Manager is used for data certification and lifecycle management, not for mapping Discovery data to CMDB fields. Option D is wrong because the Discovery Dashboard provides visual summaries of discovery status, not configuration of attribute mapping.
What is the purpose of the 'Identification' phase in Discovery?
Identification matches each discovered device or record against existing configuration items in the CMDB, determining whether it is already known or new. This reconciliation prevents duplicate CIs and is what allows later phases, such as reconciliation and update, to act on accurate records.
Why this answer
The Identification phase in Discovery matches discovered CIs to existing CIs in the CMDB using identification rules. It determines whether a discovered device is a new CI or an existing one that should be updated, ensuring data integrity and preventing duplicates. This is the core purpose of identification.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the distinction between Classification (what the device is) and Identification (matching to existing CI), causing candidates to confuse the two phases.
How to eliminate wrong answers
Option B is wrong because finding the IP address is part of the discovery/scanning phase, not identification. Option C is wrong because determining what the device is (classification) is the Classification phase, which precedes Identification. Option D is wrong because gathering hardware details is part of the exploration/probing phase, not identification.
Which THREE of the following are common reasons for a Discovery scan to fail?
Discovery relies on probing target devices across specific ports; a firewall blocking those ports silently drops probes, so classification fails and the scan returns incomplete or no results. This directly satisfies the stem's requirement of a common scan-failure cause.
Why this answer
A Discovery scan fails when a network firewall blocks the ports used for probing (for example SNMP 161, WMI 135/445, or SSH 22), so the scanner cannot reach the target and the scan returns no data. B is correct because if the IP range or subnet defined in the Discovery schedule is wrong, the scanner probes addresses where no managed devices exist, producing an empty or failed scan. D is correct because invalid or insufficient credentials (wrong SNMP community string, WMI/SSH username or password) prevent authentication and cause the scan to fail even when the network path is open.
C is not a typical cause of a Discovery scan failure, since a full instance database affects data storage rather than the scanning process itself, and E is unrelated because Discovery scans run from the mid server or scanner engine, not from a browser.
During discovery, a device is identified as 'Linux'. Which component is responsible for triggering the specific pattern to gather Linux-specific data?
Discovery Patterns are the reusable, OS-specific definitions that Discovery runs against a classified device. Once the device is identified as Linux, the Linux pattern executes its probes and commands to collect Linux-specific attributes, so it is the component that triggers the data gathering.
Why this answer
Discovery triggers a pattern based on the classification result, which matches the Linux classifier.
During a Discovery run, a Windows server is discovered and its hostname matches an existing CI in the CMDB, but the serial number differs. The CI Class Manager shows that the class uses a CI Identification rule with 'Hostname' as the only identifier. What is the most likely outcome for this CI?
Because the CI Identification rule for the class uses Hostname as the sole identifier, a match on hostname is sufficient to identify the existing CI. Discovery will then update the CI's attributes, including the serial number, with the newly discovered value. This ensures the CMDB reflects the current state without creating duplicates.
Why this answer
The CI Identification rule defines which attributes are used to match discovered data to existing CIs. When Hostname is the only identifier, a match on hostname is sufficient to identify the CI, regardless of other attribute differences. Discovery then updates the CI's attributes, including serial number, to reflect the discovered state.
This prevents duplicate CIs and maintains CMDB accuracy.
Exam trap
The trap here is assuming that any attribute mismatch, such as serial number, will cause a new CI to be created, when in fact only the attributes defined in the identification rule are used for matching.
A discovery administrator has created a new Discovery Schedule for a data center subnet and wants the MID Server to begin scanning immediately without waiting for the next scheduled interval. Which action should the administrator take on the Discovery Schedule record?
The Discover Now related link on a Discovery Schedule record launches the schedule immediately, independent of its configured interval. This is the supported way to start an on-demand discovery run for the defined IP ranges and MID Server selection. It satisfies the requirement to begin scanning without waiting for the next scheduled interval.
Why this answer
The Discover Now related link on a Discovery Schedule record is the supported mechanism for launching a discovery run immediately. It uses the schedule's existing IP ranges, MID Server selection, and behavior settings, so no other configuration changes are needed. This directly meets the requirement to scan the new subnet without waiting for the next scheduled interval.
Exam trap
The trap here is assuming that enabling a schedule or changing its run type causes immediate execution, when those actions only affect future scheduling and not the current run.
You are configuring a Discovery CI identification rule for Linux servers and notice that multiple CIs are being created for the same physical device. Which component should you verify to ensure the Identification Engine correctly links the incoming data to an existing CI?
Identification rules define the criteria and identifier attributes the Identification Engine uses to match incoming discovery data against existing CIs. Verifying them ensures records are correlated to the same physical device rather than spawning duplicate CIs for each discovery run.
Why this answer
The Identification Engine uses Identification Rules to compare attributes to determine if a CI exists. If these rules are misconfigured, duplicates occur.
During a Discovery run in a large data center, the same Windows server is being discovered by two separate MID Servers that both have network access to the server's subnet. The server appears as a single CI, but its 'Last discovered' timestamp and certain network adapter attributes keep flipping between values from each MID Server on every run. Which configuration should you review first to understand and control this behavior?
In ServiceNow Discovery, each MID Server is configured with IP ranges and behaviors that define which network segments it is allowed to discover. When two MID Servers overlap on the same subnet, both can discover the same host, causing attribute values to alternate. Reviewing and correcting the MID Server IP range assignments so only one MID Server is authoritative for the subnet resolves the flipping.
Why this answer
The behavior described is caused by two MID Servers both being permitted to discover the same IP range, so each run overwrites the other's data for the shared CI. ServiceNow Discovery uses MID Server IP range and behavior configuration to determine which MID Server is responsible for a subnet. Ensuring only one MID Server covers the server's subnet stops the oscillation and yields consistent discovery results.
Exam trap
The trap here is assuming that CI identification or reconciliation rules resolve attribute flipping between two MID Servers, when the real control is MID Server IP range and behavior assignment.
A customer needs to restrict a MID Server to only perform discovery on specific IP ranges. Which mechanism should be used to accomplish this?
The MID Server IP Ranges related list constrains discovery to the specified address ranges, satisfying the requirement to limit scanning to particular subnets. Entries added there act as an inclusion filter, so the MID Server only probes those ranges and ignores everything else, directly enforcing the customer's scope restriction.
Why this answer
MID Server IP Ranges are used to define the boundaries of what a specific MID Server is allowed to scan.
A CMDB manager must reduce duplicate server CIs that are being created because two discovery sources report slightly different values for the same hostname. Which TWO actions should be taken to improve matching and reduce duplicate creation? (Choose two.)
Precedence ensures a single source wins for each attribute when both report values. This stabilizes the stored values so subsequent discovery runs match the existing CI instead of triggering re-identification and creating duplicates due to fluctuating attribute values.
Why this answer
Duplicates from multiple sources are caused by inconsistent identifying attributes and by conflicting values flapping between sources. A robust identification rule using stable attributes ensures both sources match the same CI, and precedence ensures the stored values stop fluctuating, so subsequent reconciliations match instead of inserting new records.
Exam trap
The trap here is treating duplicate CIs as a cleanup problem, when the real fix is correcting identification attributes and precedence so duplicates stop being created.
A CMDB administrator notices that a business application CI's relationships to its supporting servers are correct, but the application's 'Environment' attribute is blank even though Discovery populates it on the servers. Which concept explains why the application CI lacks the value and what should be done?
Discovery patterns are written for specific classes and populate only the attributes they are designed to map. Business application CIs are typically created by Service Mapping or manually, so if no pattern or integration writes Environment, the attribute stays blank until populated by another source.
Why this answer
Discovery populates only the classes and attributes its patterns are designed for. Business application CIs are usually created by Service Mapping or manual entry, and unless a source writes the Environment attribute, it remains blank. The correct action is to populate it through the appropriate integration or update process rather than expecting inheritance or reconciliation to fill it.
Exam trap
The trap here is assuming that because a related CI has a value, the parent application will inherit it automatically through reconciliation or relationships.
A CMDB administrator is troubleshooting why a Linux server CI keeps losing its correct 'CPU count' value after each nightly discovery run. The discovery source correctly reports 8 CPUs, but the stored value reverts to 2. Which configuration should be inspected first to explain the reversion?
A reverting value almost always points to a precedence conflict where another source is listed above Discovery for that attribute. Inspecting the precedence list for CPU count on the Linux Server class reveals whether a second integration is overwriting Discovery's correct value during reconciliation.
Why this answer
When Discovery reports the correct value but the stored CI reverts, the most likely cause is a competing data source with higher precedence for that attribute. Reviewing the reconciliation precedence list for CPU count on the Linux Server class identifies the source that is winning and allows the administrator to correct the ordering.
Exam trap
The trap here is blaming the discovery pattern or probe, when a value that is reported correctly but stored incorrectly points to reconciliation precedence.
Parse JSON extracts values from nested JSON structures using path expressions, so an attribute at the third index of a nested array can be targeted precisely. Other step types, such as REST or JDBC, retrieve data but cannot navigate array indices within the returned payload.
Why this answer
The Parse JSON step type is most appropriate to extract a specific attribute from an object located at the third index of a nested JSON array. This step is designed to parse JSON data and allows you to navigate through arrays and objects using JSONPath expressions.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the choice between Parse JSON and Regex Extraction, causing candidates to pick regex for structured data when Parse JSON is more appropriate.
How to eliminate wrong answers
Option A is wrong because Table Transformation is used to transform data into a table format, not to extract specific attributes from JSON. Option C is wrong because Set Variable is used to assign values to variables, not to parse JSON. Option D is wrong because Regex Extraction is used for pattern matching in text, not for structured JSON parsing.
During a Discovery run, a Linux server is identified, but the CMDB record is not updated with the latest memory information. Which log should be inspected to troubleshoot the Identification and Reconciliation engine (IRE) process?
The Identification and Reconciliation Engine logs record how discovered data is matched, merged and written to the CMDB, including why attributes such as memory are rejected or skipped. Inspecting them reveals the reconciliation failure preventing the record update.
Why this answer
The Identification and Reconciliation Engine (IRE) processes discovery data to identify CIs and reconcile them into the CMDB. When IRE fails to update CI attributes such as memory information, the IRE log is the correct place to inspect for identification errors, reconciliation rule mismatches, or payload issues. This log is accessed via System Logs > Identification and Reconciliation Engine Logs.
Exam trap
The trap is that candidates pick Pattern Logs or Discovery Logs because they associate 'Discovery run' with those logs, missing that IRE-specific identification and reconciliation issues require the dedicated IRE log.
How to eliminate wrong answers
Option A is wrong because Node Logs contain MID Server node-level activity and are not specific to IRE processing. Option B is wrong because Pattern Logs show pattern execution details during discovery, which is useful for collection issues but not for IRE identification and reconciliation failures. Option C is wrong because Discovery Logs capture the overall discovery run status and probe/sensor activity, but not the IRE-specific identification and reconciliation steps that determine whether CI attributes are updated.
When a discovery pattern finishes, it creates an 'Identification' payload. Where is this payload processed?
The Identification payload is sent to the Identification and Reconciliation Engine, which applies identification rules, reconciliation rules and CI class precedence to decide whether the discovered data creates a new CI, updates an existing one, or is discarded as duplicate.
Why this answer
The payload is sent to the Identification and Reconciliation Engine (IRE) for processing against the CMDB.
Which TWO of the following are valid ways to define the scope of a Discovery scan?
Discovery scope accepts IP address ranges, letting administrators enumerate contiguous host addresses to probe. This constrains the scan to specific targets, satisfying the requirement to define scope by address boundaries rather than by credentials or schedules.
Why this answer
Option A (IP Address ranges) is correct because a Discovery scan scope can be defined by specifying one or more IP address ranges (for example, 10.0.0.1-10.0.0.254) that Discovery will probe for live devices. Option C (IP Network addresses) is also correct because scope can be defined using IP network/subnet addresses in CIDR notation (for example, 192.168.1.0/24), which Discovery uses to determine which hosts to scan. Schedule Behaviors (B) control when and how often a Discovery schedule runs, not which devices are in scope.
MID Server Capability (D) determines which MID Server is eligible to execute the Discovery based on its assigned capabilities, but it does not define the target scope. Credential profiles (E) supply the authentication credentials used during Discovery, not the set of IP addresses or networks to be scanned.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the confusion between scope (IP ranges/networks) and execution logic (behaviors) or authentication (credentials), causing candidates to pick the wrong category of configuration.
An administrator wants to ensure that data imported from an external asset system does not overwrite data collected by Discovery. How should this be configured?
Reconciliation Rules resolve conflicts by comparing attribute values against a priority hierarchy, so assigning Discovery a higher precedence ensures its collected values prevail over imported external data. This directly satisfies the requirement that external asset imports must not overwrite Discovery-sourced attributes during reconciliation.
Why this answer
Reconciliation rules allow you to specify which data sources are authoritative for specific CI attributes.
Which THREE components are involved in the Discovery process flow?
Discovery Patterns are the reusable definitions that specify which probes, sensors and commands run against a device class, translating raw scan results into CIs. They form one of the core components orchestrating the Discovery process flow.
Why this answer
Discovery utilizes the MID Server for execution, the ECC queue for communication, and Patterns for data collection.
Which of the following describes the purpose of the 'CI Class Manager'?
The CI Class Manager defines and maintains the class hierarchy and the CI identification and reconciliation rules that govern how discovered items are classified. This satisfies the requirement to manage both class structure and the rules applied to configuration items.
Why this answer
It provides a centralized interface for managing the configuration of all CI classes, including identification and reconciliation rules.
You are designing a Discovery pattern for a network switch. You need to create a CI Relationship between the switch and its connected devices. In the Pattern Designer, which step type should you use to create this relationship?
The Create Relation step is specifically designed to establish relationships between CIs in the CMDB. In this scenario, you would use it to define the connection between the switch and its connected devices, specifying the relationship type and the two CIs involved. This step ensures the relationship is recorded properly in the CMDB.
Why this answer
To create a CI Relationship during Discovery, you must use the Create Relation step. This step allows you to define the relationship type and link the two CIs. Other steps like Create CI, Parse Variable, and Identification serve different purposes and cannot establish relationships.
Exam trap
The trap here is confusing the Create CI step with the Create Relation step, assuming that creating a CI automatically creates its relationships.
You need to upgrade a large number of MID Servers. Which feature should you use to avoid manual updates?
MID Server Auto-Upgrade lets the instance distribute new MID Server builds automatically to all eligible MID Servers, removing the need to touch each host manually. This directly satisfies the requirement to upgrade a large number of MID Servers without manual updates.
Why this answer
MID Server Auto-Upgrade is the built-in feature that automatically upgrades MID Servers to match the instance version, eliminating manual patching across a large fleet. When enabled, the instance pushes the upgrade package to each MID Server, which then updates itself and restarts. This is the standard approach for managing many MID Servers at scale.
Exam trap
The trap is that 'Update Sets' sounds like a legitimate ServiceNow mechanism, but update sets apply to instance configuration, not MID Server software, so candidates who conflate the two pick the wrong answer.
How to eliminate wrong answers
Option A is wrong because MID Server Update Sets do not exist; update sets are for moving configuration between instances, not for upgrading MID Server binaries. Option B is wrong because MID Server Cluster Overrides control cluster behavior (e.g., which node handles which capability), not software upgrades. Option D is wrong because Scheduled Jobs to restart services only restart the MID Server process; they do not install new versions, so the fleet would remain on the old build.
Which THREE of the following are common parsing strategies used in pattern design?
Regex is a core parsing strategy in pattern design, matching event fields against defined regular-expression patterns to extract values. It complements other strategies such as delimiters and key-value pairs, and is essential where field content follows predictable textual structures.
Why this answer
Regex (A) is a common parsing strategy because regular expressions define character-level patterns that are matched against input text to extract or validate fields. JSON (C) is a common parsing strategy because its structured key-value and array syntax is parsed by dedicated JSON parsers to navigate and extract data reliably. Delimited text (E) is a common parsing strategy because records and fields separated by delimiters such as commas, tabs, or pipes are split and tokenized to obtain individual values.
SQL Queries (B) are a data retrieval and manipulation language, not a parsing strategy for pattern design, and Java Class (D) is a programming construct or data model, not a parsing approach.
When a pattern step executes an external script (e.g., Python), how can you ensure the pattern waits for the script to finish before proceeding to the next step?
The pattern engine blocks on the step process and resumes only when that process returns, so no explicit polling or sleep is needed. This satisfies the requirement that execution pauses until the external script finishes before the next step runs.
Why this answer
ServiceNow patterns are synchronous by default; the pattern engine waits for each step to return a status (Success/Failure) before moving to the next step.
A MID Server Cluster is configured with two nodes. One node goes down. How does the MID Server Cluster handle the failover?
A ServiceNow MID Server Cluster uses an active/active design, so both nodes continuously poll the instance for jobs. When one node fails, the healthy node simply continues collecting the remaining scheduled work; no manual intervention or configuration change is required. This satisfies the stem's automatic failover requirement.
Why this answer
MID Server clusters automatically distribute work, and if one node fails, the cluster manager ensures tasks are re-queued or picked up by the remaining node.
Which THREE of the following are necessary to successfully discover a Windows server?
Network connectivity to the server is required so the MID Server can reach the target over the necessary ports for probing and command execution. Without reachability, neither classification nor credential-based exploration can occur, regardless of how correct the credentials are.
Why this answer
You need a reachable network, a credential with access, and a valid classifier for Windows.
What is the benefit of using an Extension section in a pattern?
Extension sections let common parsing or identification logic be defined once and called from multiple patterns, so changes propagate rather than being duplicated. This satisfies the stem's modularity requirement by promoting reuse of shared logic across patterns.
Why this answer
Extension sections promote code reusability across multiple patterns.
A discovery administrator is troubleshooting a Linux server that is not being discovered despite correct credentials and network connectivity. The administrator runs a horizontal discovery and notices that the 'SSH' probe fails with a 'Command not found' error. Which step should the administrator take to resolve this?
Discovery patterns for Linux often rely on specific command-line utilities to gather hardware and software details. If a required utility is missing, the probe fails with 'Command not found'. Ensuring utilities like 'dmidecode' and 'lspci' are installed allows the pattern to execute successfully and collect the necessary data.
Why this answer
The 'Command not found' error during an SSH probe indicates that a command executed by the discovery pattern is not available on the target Linux server. Common culprits are utilities like 'dmidecode' or 'lspci' that may not be installed by default on minimal installations. Installing these utilities enables the pattern to complete successfully and gather the required data.
Exam trap
The trap here is misinterpreting the error as a connectivity or credential issue, when it actually points to a missing binary on the target system.
When a Discovery pattern step fails due to a timeout, what is the best approach to fix it?
A pattern step timeout means the operation exceeded its configured limit, so raising that step's timeout value lets the longer-running command complete. This directly addresses the timeout constraint without altering the underlying discovery logic or credentials.
Why this answer
Timeouts often occur because the command is too slow. You can increase the timeout setting in the specific pattern step or optimize the command.
What should you check to see if a MID Server has successfully completed a job?
The ECC Queue list records every probe and job dispatched to a MID Server, showing output, state and completion status. Reviewing it confirms whether the MID Server executed and returned results for a discovery job.
Why this answer
The ECC Queue list is the primary place to check whether a MID Server has successfully completed a job. The ECC Queue (External Communication Channel) records all inbound and outbound messages between the ServiceNow instance and MID Servers, including job status, payloads, and any errors. A completed job will show a corresponding ECC Queue record with a 'Processed' state and output payload.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the specific tool for verifying job completion, tricking candidates into choosing the Discovery Dashboard or MID Server log instead of the ECC Queue.
How to eliminate wrong answers
Option B is wrong because the Discovery Dashboard provides a high-level view of discovery status and results, but not the granular job completion details found in the ECC Queue. Option C is wrong because the MID Server log is on the MID Server itself and shows local execution details, but the authoritative record of job completion is in the ECC Queue. Option D is wrong because MID Server Properties are configuration settings, not job execution records.
When a MID Server is part of a cluster, what happens to the ECC queue items if one MID Server goes down?
Clusters allow for automatic failover of queued work.
Why this answer
If load balancing is configured, the other nodes in the cluster take over the work.
Which TWO of the following are potential side effects of an improperly configured Reconciliation Rule?
Reconciliation rules decide which source's attributes win when the same CI is discovered by multiple sources. Misconfigured precedence causes the engine to discard incoming values it should accept, so legitimate updates from valid sources are rejected and the CMDB goes stale.
Why this answer
Improper rules lead to data flip-flopping or legitimate updates being rejected.
You need to ensure that Discovery ignores a specific range of IP addresses within a larger CIDR block that is already configured. What is the most efficient configuration approach?
The Excluded IP Ranges related list lets you carve out specific addresses from an already-configured CIDR block without editing or splitting that range. This is the most efficient approach because Discovery skips those addresses during scanning while the parent range remains intact.
Why this answer
ServiceNow Discovery provides an Excluded IP Ranges related list on the Discovery Schedule (and on IP Range records) specifically to carve out addresses from a larger CIDR block without altering the parent range. Adding the target IPs to this list is the least disruptive and most efficient approach because it preserves the existing schedule and range configuration while preventing Shazzam from scanning those addresses.
Exam trap
ServiceNow CIS-Discovery often tests the misconception that Discovery Behaviors or ACLs control scan scope; in reality, scan scope is governed by IP ranges and the Excluded IP Ranges related list, while Behaviors govern post-discovery processing.
How to eliminate wrong answers
Option B is wrong because Discovery Behaviors control how discovered CIs are processed (e.g., CI creation, field population), not which IPs are scanned — they cannot exclude IPs from a scan. Option C is wrong because deleting and recreating schedules is disruptive, error-prone, and unnecessary when an exclusion list exists; it also loses schedule history and related configuration. Option D is wrong because ACLs govern record-level access in the ServiceNow platform, not network scanning behavior, so they have no effect on which IPs Discovery probes.
If you need to define a new CI attribute that should be populated by Discovery, which task is mandatory?
Without the correct permissions in the reconciliation rule, the Discovery data source cannot update the attribute.
Why this answer
If Discovery is to populate the attribute, you must add it to the pattern and ensure that no Reconciliation Rule prevents the 'Discovery' data source from writing to it.
What is the purpose of the 'Table' attribute in the 'Identification' step?
The Table attribute names the CMDB table that discovery populates, so the Identification step knows which class to query for matching records. It satisfies the stem's requirement by defining the target CMDB class, ensuring identification rules and reconciliation run against the correct table rather than a default or unrelated class.
Why this answer
The 'Table' attribute defines which CMDB class the identified CI belongs to.
What happens to the ECC Queue if the MID Server is unable to connect to the ServiceNow instance?
Without a MID Server connection, no ECC Queue record can be claimed or processed, so each remains in the 'ready' state rather than moving to 'processing' or 'error'. The queue simply accumulates work until the MID Server reconnects and resumes polling.
Why this answer
If the MID is down, the ECC Queue records remain in the 'ready' state on the instance and wait until the MID reconnects to process them.
A MID Server is failing to upgrade. What should you check first?
The upgrade log files on the MID Server host record the precise failure point, whether a checksum mismatch, Java version conflict or blocked download. Since the stem gives no error detail, reading these logs is the only way to identify the actual cause before changing configuration or restarting services.
Why this answer
When a MID Server upgrade fails, the first diagnostic step is to review the upgrade log files on the MID Server host itself. These logs (typically found under the agent's log directory, e.g., agent.log and wrapper.log) capture the exact failure point — whether it's a Java version mismatch, connectivity issue to the instance, or a failed file extraction. The MID Server record status in the instance only shows the current state (Up, Down, Upgrading) and won't reveal the underlying cause of the upgrade failure.
Exam trap
The trap here is assuming the MID Server record status in the instance will show the upgrade failure reason, when in fact the diagnostic detail lives only in the local log files on the MID Server host.
How to eliminate wrong answers
Option B is wrong because the Discovery Schedule controls when and what discoveries run, and has no bearing on the MID Server upgrade process. Option C is wrong because the System Property list governs instance-level configuration values, not the local upgrade execution on the MID Server host. Option D is wrong because the MID Server record status only reflects the current operational state (e.g., Up, Down, Upgrading) and does not contain the diagnostic detail needed to troubleshoot why an upgrade failed.
A pattern you authored is producing CI records, but a required attribute named 'serial_number' is sometimes populated and sometimes left blank depending on the device model. You want the pattern to attempt one command and, if it yields no serial number, automatically try a fallback command before finalizing the CI. Which pattern design construct should you use?
Conditional logic within a pattern allows branching based on a variable's value, so the pattern can run a fallback command only when the primary result is empty. This keeps a single pattern handling multiple device behaviors without duplicating the entire pattern, and it ensures the CI receives a serial number when any supported command succeeds.
Why this answer
Handling model-specific attribute availability is done with conditional branching inside the pattern: evaluate whether the parsed variable is empty and, if so, run an alternate command. Continue-on-error, separate patterns, and nonexistent dependent-attribute retries do not provide the required fallback behavior for a blank but successful result.
Exam trap
The trap here is confusing 'Continue on error' (step failure handling) with conditional branching for empty but successful command results.
When a CI record is 'Orphaned' according to the CMDB Health Dashboard, what does this mean?
Orphaned CIs are those lacking any relationship to other configuration items, which is precisely the CMDB Health Dashboard's orphan metric. The dashboard flags records with zero inbound or outbound relations, indicating broken dependency mapping. This satisfies the stem's constraint: the CI exists but sits isolated, so no relationship records reference it.
Why this answer
An Orphan CI is a CI that has no incoming or outgoing relationships, which is often unexpected for core infrastructure components.
What is the primary way to check if a MID Server is communicating correctly with the ServiceNow instance?
The MID Server list shows each MID Server's status, such as Up or Down, reflecting heartbeat communication with the instance. Checking it confirms whether the MID Server is connecting correctly, which is the primary validation method.
Why this answer
The MID Server status on the 'MID Server' list view shows 'Up' if it is connected.
A discovery administrator needs to ensure that a MID Server can discover devices in a remote subnet that is not directly routable from the ServiceNow instance. The MID Server is already installed and validated in the remote network. What is the next step to enable discovery of that subnet?
Discovery Schedules define the IP ranges to scan and the MID Server to use. By creating a schedule for the remote subnet and assigning it to the MID Server located in that network, the MID Server can perform the discovery locally. This is the standard approach for discovering non-routable subnets, as the MID Server acts as a proxy within the remote network.
Why this answer
To discover a non-routable subnet, a MID Server must be deployed within that network. The administrator should create a Discovery Schedule targeting the remote subnet and assign it to the MID Server already installed there. This allows the MID Server to scan the subnet locally.
Other options do not directly enable the discovery of the remote subnet.
Exam trap
The trap here is thinking that network connectivity or MID Server properties alone can enable discovery; the actual trigger is a Discovery Schedule assigned to the appropriate MID Server.
What is the purpose of the 'Pre-sensor' script?
The Pre-sensor script executes custom JavaScript before the payload is processed, allowing manipulation or enrichment of collected data prior to pattern evaluation. This satisfies the requirement to run custom logic ahead of processing, so downstream steps receive adjusted input.
Why this answer
Pre-sensor scripts allow developers to manipulate data before it is processed by the identification engine.
You notice a MID Server has the status 'Down' in the ServiceNow instance, but the service is running on the host. What is the first step to troubleshoot?
The agent log records connection attempts, authentication failures and MID Server communication errors, so it reveals why the instance reports 'Down' despite the service running. This satisfies the requirement to identify the connection fault first before restarting or reconfiguring anything.
Why this answer
Checking the agent log is the standard first step for identifying why the MID Server is failing to heartbeat or authenticate.
When a Discovery scan completes, how can you view the status of all individual IP addresses scanned by that schedule?
The Discovery Status record aggregates results for the entire schedule run, listing each scanned IP with its state, such as active, unreachable or error. Opening it shows per-address outcomes, which individual device records cannot provide.
Why this answer
The Discovery Status record is the central log for a Discovery run. It contains a related list called 'Discovery Device History' (or 'Devices') that lists every IP address targeted by the schedule, along with its individual status (e.g., Completed, Unreachable, Timed Out, Skipped). This provides a per-IP view of the scan outcome without needing to dig into raw queues or logs.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the distinction between the Discovery Status record (which provides per-IP status) and the ECC Queue (which holds raw probe payloads), causing candidates to overcomplicate the answer by choosing the ECC Queue.
How to eliminate wrong answers
Option A is wrong because the ECC Queue holds raw XML probe and result payloads; while it contains the underlying data, it is not organized by IP address or schedule and is impractical for status viewing. Option B is wrong because the CMDB only stores successfully discovered CIs; it does not show IPs that failed, were skipped, or are pending, so it cannot provide a complete status of all scanned addresses. Option C is wrong because MID Server logs are text-based diagnostic files on the MID Server host; they are not structured for per-IP status reporting and require log parsing.
During the Identification phase, you notice that multiple CI records are being created for the same physical server. Which component should you verify to ensure the Identification engine correctly merges these attributes?
Identification Rules define the attribute criteria the Identification engine uses to match incoming discovery data against existing CIs. Verifying these rules ensures duplicate server records are merged rather than created anew, directly resolving the duplicate CI creation observed during the Identification phase.
Why this answer
Identification Rules are the component that determines how CIs are uniquely identified and merged during the Identification phase. They define the attributes that must match for two CI records to be considered the same, ensuring that multiple records for the same physical server are merged correctly.
Exam trap
The trap is assuming that Discovery Patterns or Probes handle identification, but they only collect data; the Identification Rules are responsible for merging and deduplication.
How to eliminate wrong answers
Option A is wrong because Classification Criteria determine the class of a CI, not its uniqueness. Option B is wrong because Discovery Patterns define how data is collected, not how CIs are identified. Option D is wrong because Discovery Probes are used to collect data, not to identify or merge CIs.
Which of the following correctly describes the use of the 'Pattern Designer's' 'Search' feature?
The Search feature queries pattern contents by step name, variable, or activity, letting developers jump directly to a specific element rather than scrolling the canvas. This satisfies the need to locate particular steps or variables quickly within large, complex patterns during debugging or editing.
Why this answer
The search feature allows you to find specific steps or configurations within a large, complex pattern.
Which TWO of the following are key components of the Pattern Designer?
The Debug panel runs a pattern against a target CI and displays each step's raw output, errors and parsed results. This satisfies the stem's requirement for a key Pattern Designer component by enabling step-level troubleshooting during pattern development and validation.
Why this answer
The designer consists of the step palette and the execution/debug environment.
You are troubleshooting a MID Server that is stuck in the 'Validated' state but not picking up jobs. You notice the 'MID Server Issues' list reports a 'Clock drift' error. What is the recommended resolution?
Clock drift breaks the MID Server's authenticated handshake with the instance, so it stays validated but cannot accept jobs. Aligning the host clock to a reliable NTP source removes the drift and restores job polling.
Why this answer
Clock drift indicates that the MID Server host's time is not synchronized with the ServiceNow instance's time, causing authentication and job processing failures. The recommended resolution is to synchronize the host time with an NTP server to ensure accurate time alignment.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests troubleshooting steps for MID Server issues, and candidates may choose to restart the MID Server instead of addressing the root cause of clock drift, which requires NTP synchronization.
How to eliminate wrong answers
Option A is wrong because toggling the MID Server status does not fix the underlying clock drift issue. Option B is wrong because increasing the ECC Queue timeout does not address time synchronization. Option C is wrong because restarting the MID Server service will not correct the clock drift; it may temporarily reconnect but the drift will persist.
When using the 'Parse Delimited' step, what is the 'Separator' attribute used for?
The Separator attribute specifies the delimiter character, such as a comma or pipe, that marks boundaries between fields in the delimited input. The Parse Delimited step uses it to split each row into individual field values for downstream mapping.
Why this answer
The separator defines the character (e.g., comma, pipe) that splits the columns in the text.
Which action should you perform before modifying a default Discovery Pattern?
Copying the default pattern preserves the original as a read-only baseline, letting you edit the duplicate without affecting out-of-box behaviour or breaking future upgrades. This satisfies the stem's requirement to prepare safely before modification, since ServiceNow overwrites customised defaults during patching, whereas a copied pattern remains untouched.
Why this answer
Default Discovery Patterns are shipped as read-only records that are overwritten during ServiceNow upgrades, so any direct modification would be lost. The supported practice is to create a copy of the pattern, modify the copy, and then activate it so the customized logic is preserved across upgrades. This also allows the original to remain available as a fallback if the custom pattern fails.
Exam trap
The trap here is assuming that editing a default pattern directly is acceptable because the UI allows it — candidates forget that base-system records are overwritten on upgrade, so the correct answer is always to clone first.
How to eliminate wrong answers
Option A is wrong because exporting a pattern to XML is a backup/portability action, not a prerequisite for editing — it does not prevent the default pattern from being overwritten on upgrade. Option B is wrong because rebooting the MID server has no bearing on pattern editability and would only disrupt discovery execution. Option D is wrong because deleting the original pattern removes the baseline logic and can break other schedules or probes that reference it, and it is not a supported customization approach.
What is the maximum number of times a Discovery Schedule can run?
Discovery Schedules have no hard-coded run limit; execution frequency is governed entirely by the schedule interval and the instance's system configuration. This satisfies the stem's constraint on maximum runs, since ServiceNow imposes no fixed cap — administrators control repetition through interval settings and MID Server capacity rather than an inherent ceiling.
Why this answer
Discovery schedules can be configured to run as often as required by the system capability.
A discovery administrator is troubleshooting a server that was discovered but shows no installed software in the CMDB. The horizontal discovery status shows the device completed successfully and the classification matched the correct Linux Server class. Which configuration element should the administrator verify to ensure application and package data is collected for this device?
Software and package collection on Linux is performed by specific probes and pattern steps within the Linux Server pattern, such as those that read package manager data and installed application listings. If those probes or steps are disabled, fail silently, or are not included in the active pattern version, the device still classifies and completes but returns no software data. Verifying these steps is the direct way to resolve the symptom.
Why this answer
Software and package data on Linux is gathered by dedicated probes and pattern steps inside the Linux Server pattern. Since classification succeeded, the pattern already ran far enough to identify the device; the missing software means the specific steps that enumerate packages and applications did not return usable data. Reviewing and correcting those probes and steps is the targeted fix for a completed discovery that lacks software records.
Exam trap
The trap here is assuming that a successful classification and completed status means every pattern step ran correctly, when individual probes within the pattern can fail or be disabled without failing the overall discovery.
Which THREE pieces of information are required for a MID Server to communicate with the ServiceNow instance?
The MID Server needs the instance URL to know which ServiceNow endpoint to connect to over HTTPS. Without this address, the MID Server cannot locate or authenticate against the correct instance, so communication fails entirely.
Why this answer
Option B (Instance URL) is required because the MID Server's config.xml must point to the ServiceNow instance endpoint (e.g., https://<instance>.service-now.com) so it knows where to establish its outbound connection. Option C (MID Server record validation) is required because the MID Server must be registered as a MID Server record in the instance and validate itself against that record (name/user/password) before it is authorized to pull and execute jobs. Option E (Network connectivity to the instance) is required because the MID Server initiates outbound HTTPS (port 443) connections to the instance; without reachable network/DNS/firewall paths, no communication can occur.
Option A (Admin password for the host) is not required, since the MID Server runs as a service under a local service account and does not need host admin credentials for instance communication. Option D (Database credentials) is not required, because the MID Server never connects directly to the ServiceNow database; all interaction occurs through the instance's REST/SOAP APIs.
What does the 'Debug' mode in the Pattern Designer require to function?
Debug mode runs against a specific Discovery status record, so a node must be selected for the pattern's execution trace to display. Without that selected status record, the debugger has no active discovery context to step through.
Why this answer
Debug mode requires a target node to execute the pattern against, which is provided by a Discovery status record.
Which THREE of the following items are stored in the Credential record?
A Password field is stored directly on the Credential record, satisfying the requirement for authentication data held within the credential itself. Discovery uses this stored secret when probing target devices, so it belongs among the three items. Credentials reference the password rather than retrieving it externally, confirming it as a stored attribute.
Why this answer
Credential records typically store Usernames, Passwords, and SSH keys/certificates.
A MID Server named MID-LON-01 must be dedicated exclusively to Discovery for the London data center, and it must not receive any other type of MID Server job. Where do you configure this restriction?
The Capabilities field on the MID Server record declares which job types the instance may dispatch to that MID Server. Setting it to Discovery only removes all other capabilities, so the instance will never send unrelated work to MID-LON-01 while Discovery tasks continue to be routed there as expected.
Why this answer
Capabilities on the MID Server record act as the contract for what work the instance may send to that MID Server. To dedicate MID-LON-01 to Discovery, the Capabilities field must list only Discovery, which excludes all other job types. Clusters, validation state, and MID Server user permissions influence routing and access, but none of them restrict the MID Server to a single job category.
Exam trap
The trap here is assuming that cluster membership or MID Server validation controls which job types a MID Server receives, when the Capabilities field is what actually restricts job routing.
What is the result of using a 'Delimiter' of '\n' in a 'Parse Delimited' step?
The delimiter defines the character marking each field boundary. Specifying the newline escape sequence '\n' makes the parser treat every line break as a row separator, so the input text is split into individual lines, each becoming a distinct row.
Why this answer
The '\n' (newline) delimiter splits the text into separate rows.
When configuring a Discovery Behavior, what is the primary purpose of defining 'Probes' within the behavior?
Probes within a Discovery Behavior define which probe activities are launched against particular device types, letting administrators tailor discovery to the target classification. This controls probe selection per device type rather than scheduling or credential handling.
Why this answer
Probes within a Discovery Behavior define which probes are launched for specific device types. This allows customization of the discovery process for different classes of devices, ensuring appropriate probes are used.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the confusion between Probes and other Discovery components like credentials or IP ranges.
How to eliminate wrong answers
Option A is wrong because IP address ranges are defined in Discovery schedules, not in Probes. Option B is wrong because credentials are defined in Credential records and attached to Discovery schedules or MID Server capabilities. Option C is wrong because MID Server selection is determined by MID Server selection criteria or capabilities, not by Probes.
What does 'Discovery' in ServiceNow primarily populate?
Discovery probes the network, identifies configuration items and their relationships, then writes those records into the CMDB, which is the authoritative store ServiceNow uses for asset and service context. Other tables reference the CMDB rather than being its primary target.
Why this answer
Discovery in ServiceNow primarily populates the Configuration Management Database (CMDB) by discovering and updating configuration items (CIs) and their relationships. It scans the infrastructure, classifies devices, identifies existing CIs, and populates the CMDB with accurate data.
Exam trap
SERVICENOW-CIS-DISCOVERY often tests the fundamental purpose of Discovery, but candidates may confuse it with other data repositories like the knowledge base or user database.
How to eliminate wrong answers
Option A is wrong because the knowledge base stores articles and documentation, not discovered IT assets. Option C is wrong because the user database (sys_user) contains user records, which Discovery does not populate. Option D is wrong because the incident table stores incident records, not discovered configuration items.
During a CMDB health check, an administrator notices that a Windows server CI has a stale record in the CMDB even though the server was decommissioned three months ago. The administrator wants to ensure that decommissioned CIs are automatically marked as retired. Which CMDB feature should be configured to achieve this?
CMDB Data Manager allows you to create policies that automatically retire or delete CIs based on conditions such as last discovered date or operational status. It can be scheduled to run periodically, ensuring that stale CIs are marked as retired without manual intervention. This directly addresses the requirement to automatically retire decommissioned CIs.
Why this answer
CMDB Data Manager is designed to automate the lifecycle management of CIs, including retirement and deletion based on defined policies. By configuring a policy that targets CIs with a last discovered date older than a threshold, the administrator can ensure decommissioned CIs are retired automatically. This reduces manual effort and maintains CMDB accuracy.
Exam trap
The trap here is confusing the CMDB Health Dashboard's reporting capabilities with the automated remediation actions provided by CMDB Data Manager.
You want to run a command only if a previous step was successful. How is this configured?
Step conditions allow for logic-based execution flow.
Why this answer
You can use the 'Condition' field on a step to check the state of previous steps.
A new device type is not being discovered correctly. Where should you look to ensure the classification process is prepared to handle it?
Discovery Classifiers hold the criteria that map discovered devices to the correct class and table, so a new device type needs a matching classifier entry before it can be classified properly. Without it, the device falls through to an unknown or default classification.
Why this answer
The 'Discovery Classifiers' table contains the rules used to identify and classify devices.
Which THREE of the following are key components for configuring a successful Discovery?
The MID Server is the on-premises execution engine that performs the actual horizontal and vertical discovery probes against target devices, then relays results back to the ServiceNow instance. Without a running MID Server with valid credentials and network reachability, Discovery cannot collect any configuration data.
Why this answer
Schedules, MID Servers, and Credentials are the foundational blocks for any discovery project.
Practice SERVICENOW-CIS-DISCOVERY by domain
Target a specific domain to shore up weak areas.