314 questions total · 5pages · All types, answers revealed
During pattern debugging, you notice that a specific step is failing to run on a MID Server. You want to see the exact input and output of that step. Where should you look?
The debugger captures step-by-step execution data.
Why this answer
The Debugging mode in Pattern Designer provides an 'Input/Output' tab that captures the raw data for every step executed.
Which THREE of the following are true about Discovery Behaviors?
Core functionality.
Why this answer
Behaviors can be assigned to multiple schedules, can use custom probe lists, and default behaviors are available.
If a pattern step fails due to a timeout, where should you investigate the specific output of the command that was executed just before the failure occurred?
The Pattern Debugger provides detailed step-by-step logs and outputs for every executed step.
Why this answer
The 'Debug' session output in the Pattern Designer records the output of every step, including those immediately preceding a failure.
If a MID Server is configured to use an encrypted credential but it is failing, what is the most likely cause?
Credentials must be properly aliased and mapped to be accessible.
Why this answer
The credential might be missing the appropriate scope or the MID server might not have the rights to use that specific credential alias.
Which THREE of the following are true about the MID Server?
Correct.
You need to ensure that Discovery data from a third-party integration does not overwrite manual updates made by the IT team in the CMDB. Which feature should you configure?
Reconciliation rules define the priority of data sources for specific attributes to prevent unauthorized overwrites.
Why this answer
Reconciliation Rules define which data sources are allowed to update specific attributes of a CI.
Which TWO issues might be discovered in the 'Correctness' category of the CMDB Health Dashboard?
The dashboard identifies records that map to the same entity based on identification rules.
Why this answer
Correctness metrics specifically identify duplicates and orphaned CIs that threaten CMDB data integrity.
Which of the following is NOT a phase of the Discovery process?
Verification is not a standard Discovery phase.
Why this answer
The four phases are Shazzam, Classification, Identification, and Exploration. 'Verification' is not one of them.
You have a PowerShell script step in your pattern that returns multiple key-value pairs separated by commas. What is the most efficient way to convert this output into a table format for further processing in the pattern?
The Parse Delimited Text step is specifically designed to convert flat string outputs into structured tables.
Why this answer
The 'Delimited Text' parser allows you to specify a delimiter (comma) and map the results directly into a table structure usable by subsequent pattern steps.
When a pattern step needs to run as root, where is this configuration set?
The 'Run as' field handles elevation of privileges for the command.
Why this answer
The 'Run as' field in the step properties allows you to specify the execution context (e.g., sudo/root).
Which THREE logs should you investigate when troubleshooting a failing discovery task?
Contains specific probe execution results.
Why this answer
Agent logs, wrapper logs, and discovery logs together provide a full picture of the execution path.
Which THREE things must be true for a pattern to successfully populate an attribute?
The CMDB class must support the attribute.
Why this answer
The data must be captured, mapped, and the target CI must be valid.
When using the Identification and Reconciliation Engine (IRE), what happens if a payload contains a CI that matches multiple existing CIs based on the identification rule?
The IRE will fail the operation if an identification rule matches multiple records to maintain data integrity.
Why this answer
IRE provides specific error codes to indicate when an identification rule is not unique, which must be resolved to avoid data corruption.
When using 'Parse JSON' for a complex structure, how do you access a nested property named 'id' inside an array 'servers'?
Standard array indexing is required for nested JSON paths.
Why this answer
You use dot-notation (or specific path syntax) to navigate the JSON structure.
Which field on the Discovery Schedule allows you to restrict the discovery to specific device types?
Behaviors dictate what is gathered.
Why this answer
The 'Behavior' field is used to select which probes/patterns run, effectively limiting what is discovered.
Which of the following is NOT a required part of a Discovery Schedule?
This is optional.
Why this answer
While many fields exist, an 'Excluded IP Range' is optional, whereas target IP ranges and MID servers are fundamental.
Which type of credential is primarily used by Discovery patterns to execute commands on a Linux-based target via SSH?
SSH credentials allow secure shell access for command execution on Linux systems.
Why this answer
SSH Private Key or SSH Password credentials are the standard methods for Discovery to authenticate to Linux environments.
A customer requires that a specific Discovery Schedule only executes during maintenance windows on weekends. Which configuration setting should be modified?
The 'Run' field, when set to Periodically, allows the use of a custom Schedule.
Why this answer
The Schedule field on the Discovery Schedule record defines the execution frequency using standard system schedules.
What is the purpose of an 'IP Service' in Discovery?
Services group port info.
Why this answer
IP Services group ports and protocols together for use in port scanning, making it easier to define what to scan.
A Discovery run is successfully finding CIs, but the 'CMDB Health Dashboard' shows 'Staleness' errors. What is the primary cause of staleness in the CMDB?
The staleness metric is calculated based on the difference between the current time and the 'Last discovered' timestamp.
Why this answer
Staleness occurs when a CI's 'Last discovered' date is older than the threshold defined in the CMDB Health configuration.
Which of the following is the correct order of operations in a horizontal pattern?
Identification identifies the host, Connection links it, Extensions provide modular capability.
Why this answer
The standard flow is Identification, then Connection, then Extension sections.
Which THREE features are provided by the Pattern Designer to facilitate troubleshooting?
This allows seeing the state of variables at any point.
Why this answer
The Pattern Designer provides tools to inspect data, validate logic, and trace executions.
In the Pattern Designer, what is the primary purpose of the 'Connection' section?
Connections define the topology relationships.
Why this answer
The connection section establishes the links and relationships between discovered CIs.
You need to add a new port to be scanned by Discovery. Which record do you update?
IP Services define ports.
Why this answer
You update the 'IP Service' record to include the new port.
Which action must you perform before a pattern can be used in Discovery?
Publishing moves the pattern from 'Draft' to 'Active' state.
Why this answer
Patterns must be published to be active in the production environment.
Which of the following would be the best reason to create a custom Discovery Behavior?
This is the primary function of a behavior.
Why this answer
Custom behaviors are often used to exclude specific, resource-intensive patterns or include only relevant probes for specialized equipment.
You are troubleshooting a scenario where Discovery is creating duplicate CIs for the same server. Which table should you inspect to verify the Identification Rule settings for the specific CI class?
This table stores the specific attributes that the Identification Engine uses to match incoming data to existing CIs.
Why this answer
The cmdb_identifier_entry table defines the attributes used to uniquely identify a CI, which prevents duplicates.
Which TWO ways can you view MID Server logs?
This is the primary way to view raw logs.
Why this answer
You can view them via the agent directory on the host or through the MID Server record in the instance if configured.
Which THREE types of metrics are tracked by the CMDB Health Dashboard?
Checks if CIs meet defined security or configuration policies.
Why this answer
The CMDB Health Dashboard tracks metrics across three categories: Completeness, Correctness, and Compliance.
When a MID server is part of a cluster, what happens if one node fails during a discovery scan?
Cluster nodes provide high availability.
Why this answer
If configured, the cluster manages the failure and can distribute tasks to other nodes in the cluster.
What is the purpose of the 'MID Server User' assigned to a MID Server record?
The MID Server uses this account to establish a secure connection to the instance.
Why this answer
The MID Server user is the account the MID Server service uses to authenticate with the ServiceNow instance to pull and push ECC Queue records.
Which of the following is the most effective way to monitor the health of your discovery process on a daily basis?
The CMDB Health Dashboard is designed to provide visibility into the data quality and health metrics of the CMDB.
Why this answer
The CMDB Health Dashboard provides automated, configurable health metrics for the CMDB.
You need to troubleshoot why a specific WMI probe is failing. Which log should you check on the MID Server host?
The agent log contains detailed execution logs for probes.
Why this answer
The agent log captures the execution of probes and any errors encountered during the process.
What is the purpose of the 'MID Server' log?
These are essential for diagnosing connectivity or binary issues.
Why this answer
It logs errors and status updates relevant to the MID Server process.
Which THREE of the following are components or features that are part of the 'Discovery' to 'CMDB' data pipeline?
Patterns collect the raw data.
Why this answer
The pipeline includes data collection (Discovery), processing (IRE), and governance (Reconciliation).
What is the purpose of the 'discovery_id' in a discovery log?
It allows admins to filter logs and find results for one specific scan run.
Why this answer
The discovery_id (or status ID) is a unique identifier for a specific Discovery scan execution, used for troubleshooting.
Why would you choose to use a 'Discovery Behavior' instead of the default behavior?
Behaviors dictate probe execution logic.
Why this answer
Custom behaviors are used when you need to run a specific, non-default set of probes or patterns for a target.
What is the difference between 'Identification' and 'Connection' in terms of CI ownership?
The primary CI is the subject of the pattern, connections extend the topology.
Why this answer
The Identification section identifies the 'primary' CI, while Connection links it to others.
Which TWO of the following steps are required when adding a new CI relationship in a pattern?
This step specifies the relationship type and direction.
Why this answer
You need to identify the related CI and then define the relationship between them.
Which THREE factors influence the successful identification of a CI in a pattern?
Rules determine how the CI is matched.
Why this answer
Identification rules, attribute mapping, and valid CMDB class structure are critical.
During the Shazzam phase, Discovery identifies that a port is open. If the port corresponds to a configured classifier but no trigger probe is defined, what is the default behavior?
Classification happens, but exploration needs a probe to continue.
Why this answer
The classification phase will proceed, but without a trigger probe, the classification will likely fail to move to the exploration phase.
Which THREE of the following are true regarding Discovery IP Ranges?
Correct configuration point.
Why this answer
Ranges define target IPs, can be excluded, and are configured in the schedule.
When configuring an IP Range for a Discovery Schedule, what format must be used for a block of IPs?
These are the two standard supported formats.
Why this answer
Discovery supports CIDR notation (e.g., 10.10.10.0/24) or range start/end formats.
A technician reports that Discovery is updating the 'Last discovered' field, but the 'Operational status' is not changing as expected. Where should you investigate the mapping of Discovery data to the CMDB?
IRE rules manage how different data sources (including Discovery) populate attributes in the CMDB.
Why this answer
The CMDB CI Class Models and the mapping configuration in the pattern or identification rule define how attributes are populated.
Which THREE of the following are potential outcomes for an IP in a Discovery scan?
Identification error.
Why this answer
An IP can be identified as a device, it might be unreachable, or it might be classified but fail during exploration.
What is the purpose of the 'Identification' phase in Discovery?
This is the core purpose of identification.
Why this answer
The Identification phase reconciles discovered data with existing CIs in the CMDB using defined Identification Rules.
You have a MID Server that must connect through an authenticated proxy. Where do you configure the proxy credentials?
Proxy configuration is strictly handled in the local config.xml.
Why this answer
Proxy settings, including credentials, are configured in the config.xml file on the MID server host.
Which THREE of the following are common reasons for a Discovery scan to fail?
Very common issue.
Why this answer
Missing credentials, network connectivity issues, and incorrect IP range definitions are the most frequent causes.
During discovery, a device is identified as 'Linux'. Which component is responsible for triggering the specific pattern to gather Linux-specific data?
Patterns are the exploration tools for specific O/S.
Why this answer
Discovery triggers a pattern based on the classification result, which matches the Linux classifier.
Which parameter in the 'agent.config' file specifies the interval the MID Server uses to check the ECC Queue?
This controls the frequency of polling the ECC Queue for work.
Why this answer
The mid.poll.time parameter dictates how frequently the MID Server polls the instance for new tasks.
Which THREE of the following are valid sources for the Identification and Reconciliation Engine (IRE)?
These are standard integrations for the IRE.
Why this answer
The IRE is agnostic to the source, and data can come from Discovery, Service Graph Connectors, or manual imports.
You are configuring a Discovery CI identification rule for Linux servers and notice that multiple CIs are being created for the same physical device. Which component should you verify to ensure the Identification Engine correctly links the incoming data to an existing CI?
Identification rules define the criteria used to uniquely identify a CI and match it to existing records.
Why this answer
The Identification Engine uses Identification Rules to compare attributes to determine if a CI exists. If these rules are misconfigured, duplicates occur.
You need to ensure that a specific attribute is NOT updated by any source except a manual update from a specific user group. How can this be done?
By explicitly allowing only one source (or none), you control updates.
Why this answer
Reconciliation rules allow you to specify data sources, but for non-Discovery sources, ACLs or Data Policies might be used; however, in terms of reconciliation, you can define a 'None' rule or manage it via source priority.
A customer needs to restrict a MID Server to only perform discovery on specific IP ranges. Which mechanism should be used to accomplish this?
This feature restricts the MID Server to scan only the defined IP ranges.
Why this answer
MID Server IP Ranges are used to define the boundaries of what a specific MID Server is allowed to scan.
Which THREE of the following are true about Shazzam?
Correct order.
Why this answer
It scans ports, is the first phase, and identifies active IPs.
What happens if a device is discovered that matches two different Classification records?
Priority determines the winner.
Why this answer
Discovery uses priority values on classifiers to decide which one to apply when multiple match.
Parse JSON supports JSONPath for specific attribute extraction from arrays and objects.
Why this answer
The 'Parse JSON' step allows for the use of JSONPath, which is the standard way to traverse complex, nested JSON structures in ServiceNow patterns.
During a Discovery run, a Linux server is identified, but the CMDB record is not updated with the latest memory information. Which log should be inspected to troubleshoot the Identification and Reconciliation engine (IRE) process?
IRE logs are the authoritative source for debugging why an attribute update failed during the CMDB integration phase.
Why this answer
The IRE logs all interactions between Discovery and the CMDB, including validation failures and attribute update denials.
When a discovery pattern finishes, it creates an 'Identification' payload. Where is this payload processed?
The IRE processes all payloads to update or create CIs.
Why this answer
The payload is sent to the Identification and Reconciliation Engine (IRE) for processing against the CMDB.
Which TWO of the following are valid ways to define the scope of a Discovery scan?
This is a standard way to define scope.
Why this answer
Discovery ranges can be defined by specific IP address ranges or by using individual IP addresses.
An administrator wants to ensure that data imported from an external asset system does not overwrite data collected by Discovery. How should this be configured?
Reconciliation rules prioritize data sources; higher priority sources win conflicts.
Why this answer
Reconciliation rules allow you to specify which data sources are authoritative for specific CI attributes.
Which phase comes immediately after the Identification phase?
Final phase.
Why this answer
The phases are Shazzam -> Classification -> Identification -> Exploration.
Which THREE components are involved in the Discovery process flow?
Patterns are used to collect data during exploration.
Why this answer
Discovery utilizes the MID Server for execution, the ECC queue for communication, and Patterns for data collection.
Which of the following describes the purpose of the 'CI Class Manager'?
It is the primary tool for managing CI class definitions and their associated identification/reconciliation rules.
Why this answer
It provides a centralized interface for managing the configuration of all CI classes, including identification and reconciliation rules.
You need to upgrade a large number of MID Servers. Which feature should you use to avoid manual updates?
Auto-Upgrade manages version alignment across MID Servers.
Why this answer
The MID Server Auto-Upgrade feature allows the instance to push updates to the agents automatically.
Which THREE of the following are common parsing strategies used in pattern design?
Standard for text extraction.
Why this answer
Common strategies include Regex, JSON, and Delimited text parsing.
Which THREE actions occur when a pattern is published?
The status changes to indicate readiness.
Why this answer
Publication makes the pattern active, allows it to be used by discovery, and saves a version.
When a pattern step executes an external script (e.g., Python), how can you ensure the pattern waits for the script to finish before proceeding to the next step?
The pattern engine execution is synchronous, ensuring the step completes before continuing.
Why this answer
ServiceNow patterns are synchronous by default; the pattern engine waits for each step to return a status (Success/Failure) before moving to the next step.
A MID Server Cluster is configured with two nodes. One node goes down. How does the MID Server Cluster handle the failover?
This is the primary purpose of clustering.
Why this answer
MID Server clusters automatically distribute work, and if one node fails, the cluster manager ensures tasks are re-queued or picked up by the remaining node.
Which THREE of the following are necessary to successfully discover a Windows server?
Basic connectivity.
Why this answer
You need a reachable network, a credential with access, and a valid classifier for Windows.
What is the benefit of using an Extension section in a pattern?
Extensions act as sub-routines that can be called by multiple patterns.
Why this answer
Extension sections promote code reusability across multiple patterns.
Which THREE parsing methods are available in the 'Parse' step?
Supported by the Parse step.
Why this answer
The Parse step supports several formats including JSON, XML, and Regex.
When a Discovery pattern step fails due to a timeout, what is the best approach to fix it?
Increasing the timeout allows slow commands to complete if the delay is expected.
Why this answer
Timeouts often occur because the command is too slow. You can increase the timeout setting in the specific pattern step or optimize the command.
Which THREE of the following are valid methods for upgrading MID Servers?
Manual installation of a newer version will upgrade the existing agent.
Why this answer
MID Servers can be upgraded via the instance, manually using installers, or through automated update sets/schedules.
What should you check to see if a MID Server has successfully completed a job?
The ECC queue tracks every request and response.
Why this answer
The ECC Queue output and input messages for that job will show status and returned data.
Practice SERVICENOW-CIS-DISCOVERY by domain
Target a specific domain to shore up weak areas.