75 of 125 questions · Page 1/2 · Incident Management · Answers revealed
Which THREE items can be added to an incident using the 'Related Records' section?
Parent-child incident relationships are supported.
Why this answer
The Related Records section supports linking to Problems, Changes, and parent incidents.
Which TWO steps are involved in the Incident-to-Problem workflow?
This is the primary method to start the workflow.
Why this answer
A problem can be created from an incident, and then the incident can be linked as the cause or related record.
An administrator is configuring SLA Definitions for Incident Management. They need the SLA timer to pause whenever an incident is placed in the 'Awaiting Vendor' state. How should this be configured?
The Pause condition halts the SLA timer until the pause condition becomes false (e.g., state changes back to In Progress).
Why this answer
SLA Pause Conditions define when the SLA clock stops ticking, typically mapped to specific states such as 'Awaiting User' or 'Awaiting Vendor'.
When using 'Incident Communication Plans', what happens when a major incident is updated?
Communication plans manage the automated outreach process.
Why this answer
Communication plans automatically trigger notifications or create tasks for defined stakeholders based on the incident state or updates.
Which THREE are valid stages in the standard Incident lifecycle?
New is the initial state of an incident.
Why this answer
The standard lifecycle includes New, In Progress, On Hold, Resolved, and Closed.
Which THREE fields are auto-populated when an incident is created via email?
Typically extracted from the email body.
Why this answer
Common fields populated via Inbound Email Actions include Caller, Short Description, and Description.
An ITIL user complains they cannot see the 'Major Incident' tab on an incident record. What is the most likely cause?
The Major Incident Management module requires the specific plugin to be activated before UI elements appear.
Why this answer
The visibility of sections and UI components is controlled by View Rules, ACLs, or Form Layout/Sections configurations.
A support agent needs to create a Problem record directly from an existing Incident while preserving the correlation between the two. Which related link or UI action should the agent use on the Incident form?
Create Problem is the standard related link that initializes a problem record linked to the incident.
Why this answer
The 'Create Problem' UI action on the Incident form maps relevant incident details to a new problem record and establishes a baseline relationship.
Which TWO ways can you restrict who can resolve an incident?
UI Policies can hide the UI action based on roles.
Why this answer
Access to specific states can be restricted via ACLs or by modifying the 'State' field choice options/choices.
A problem has been investigated, and a permanent fix has been identified. When the problem coordinator creates a known error article from the problem record, how does this workflow assist Incident Management?
Known error articles provide agents with documented workarounds to apply to active incidents.
Why this answer
Known error articles published from problems appear in knowledge searches for service desk agents, allowing them to attach workarounds to active incidents.
A company requires that when an incident is assigned to a specific group, the 'Assigned to' field must be mandatory. Which configuration change accomplishes this using the most efficient ServiceNow best practice?
UI Policies provide a declarative way to manage field attributes like mandatory, visible, and read-only based on form conditions.
Why this answer
UI Policies are the recommended method for making fields mandatory on a form, as they are client-side and easier to maintain than Business Rules or Client Scripts.
Which TWO fields are commonly used to categorize an incident?
Category is the top-level classification.
Why this answer
Category and Subcategory are the standard fields used to define the nature of the incident.
Which TWO fields are mandatory on the Incident form out of the box when creating a new incident manually? (Choose two.)
Short description is a mandatory field on the incident form.
Why this answer
Out of the box, Caller and Short description are mandatory fields when creating an incident.
An IT support team member needs to quickly communicate a known workaround to all active incidents related to a specific active Problem record. Which related link or related list on the Problem form enables the propagation of the workaround to all associated incidents?
The 'Communicate Workaround' UI action on the Problem record copies the workaround field value to all related active incidents' work notes.
Why this answer
The Problem form includes a related list or UI Action allowing administrators to communicate workarounds to related incidents out of the box.
What happens when an incident 'Priority' is changed from 3 to 1?
Changes to priority trigger a recalculation of the SLA due date.
Why this answer
The SLA engine recalculates the target resolution time based on the new priority if the SLA definition is tied to priority.
An IT team wants to prevent agents from closing an incident unless the 'Resolution code' and 'Resolution notes' fields are populated. Which configuration tool is best suited to enforce this requirement upon clicking 'Resolve'?
UI Policies can make fields mandatory based on state conditions without writing JavaScript.
Why this answer
Client Scripts or UI Policies can enforce mandatory fields on form submission or state transition, but Data Policies or UI Policies specifically manage mandatory field states.
A service desk manager wants to ensure that when an incident is assigned to the Hardware group, the Assignment group field automatically populates the Assigned to field with a specific default handler if left empty, or dynamically limits the list of assignees. Which core ServiceNow feature should be configured to automatically populate or route incident assignment within a specific group?
Assignment Rules (sys_rule_assignment) allow administrators to automatically set the Assigned to or Assignment group based on defined conditions.
Why this answer
Assignment rules or configurable business rules/Client Scripts handle this, but the native baseline method for auto-assigning based on group routing is Assignment Rules. More specifically, Assignment Rules evaluate tables and set values when conditions match.
Which feature allows an agent to create a knowledge article directly from an Incident?
This built-in UI Action simplifies the process of documenting resolutions.
Why this answer
The 'Knowledge' related link or UI action on an incident allows for quick article creation.
A service desk technician attempts to close an incident, but the system prevents the closure and displays a mandatory error message requiring the 'Close code' and 'Close notes' fields to be populated. Which component of the Incident Management application enforces these fields upon state change to Closed?
Baseline ServiceNow uses UI Policies and Client Scripts to enforce mandatory closing fields when state changes to Resolved or Closed.
Why this answer
UI Policies or Client Scripts configured out-of-the-box on the Incident table make Close code and Close notes mandatory when the state is set to Closed or Resolved.
When viewing an Incident record, where can an agent see a chronological audit trail of all field updates, comments, and work notes added by users and system processes?
The Activity Stream visualizes the audit history, comments, and work notes chronologically.
Why this answer
The Activity Stream displays the chronological history of updates, work notes, and comments on task records.
Which field on the Incident form is calculated automatically based on the 'Impact' and 'Urgency' fields using the Priority Lookup Rules?
The Priority field is populated by the priority lookup engine based on impact and urgency.
Why this answer
The Priority field is a derived value based on the matrix defined in Priority Lookup Rules.
When configuring Assignment Rules for incidents, what occurs if multiple assignment rules match the criteria of an incoming or updated incident record?
Assignment rules process sequentially by Order; the first match wins and evaluation halts.
Why this answer
Assignment rules are evaluated based on their Order field; the first rule that matches the criteria (lowest order number) is applied, and subsequent rules are ignored.
You are configuring a new Incident Record Producer. You want to map the 'Urgency' variable to the Incident 'Urgency' field. How do you map this dynamically?
The 'Map to field' field allows direct mapping without scripting.
Why this answer
In a Record Producer, you use the 'Map to field' checkbox on the variable form to map it directly to a field on the target table (incident).
What is the purpose of the 'Incident Task' table?
Tasks allow for granular assignments within a parent incident.
Why this answer
Incident tasks allow breaking down a complex incident into smaller, assignable work units.
An organization requires that when an Incident priority is set to '1 - Critical', a 'Major Incident' candidate record is created. What is the best practice approach?
Trigger rules automatically evaluate incidents for promotion to major status.
Why this answer
The Major Incident Management plugin provides the 'Major Incident' functionality that integrates with existing incidents.
What is the primary function of the 'Knowledge' icon on an incident form?
The icon triggers a search based on the short description.
Why this answer
The Knowledge icon (often a book) allows users to search for and attach knowledge articles to the incident for resolution.
A user reports that they cannot see the 'Create Problem' UI Action on the Incident form. What is the most likely cause?
The 'Create Problem' button is conditional based on state and role.
Why this answer
UI Actions have a 'Condition' field that controls visibility. If the state is not 'New' or 'In Progress', the button may be hidden.
An organization wants to capture 'Resolution Code' values that are specific to the 'Network' category. How is this achieved?
Dependent values allow a choice field to filter based on the value of another field like Category.
Why this answer
Choice lists can be filtered using dependent values or dictionary overrides to show specific options based on category.
Which THREE items are included in the Major Incident Workbench?
It provides a clear view of tasks associated with the incident.
Why this answer
The workbench features a timeline, stakeholder communication status, and incident task overview.
A Major Incident has been promoted. The Incident manager needs to ensure that all child incidents are updated when the parent incident state changes to Resolved. How should this be achieved?
The 'Major Incident' plugin includes 'MajorIncidentUpdateChildIncidents' Business Rule to automate this.
Why this answer
The Major Incident Management plugin provides specific Business Rules and flows to handle the propagation of state changes from parent to child incidents.
Which THREE actions can be performed via the Incident 'Related Links'?
Standard feature for root cause investigation.
Why this answer
Common related links include Create Knowledge, Create Problem, and Create Incident task.
What is the purpose of the 'Parent Incident' field?
This field enables the parent-child relationship in incident management.
Why this answer
It allows grouping related incidents under one master record for easier management.
Which THREE are standard 'Resolution Codes' in ServiceNow?
Standard out-of-box resolution code.
Why this answer
Commonly used codes include Resolved by Change, Closed/Resolved by Caller, and Work Around.
Which THREE settings can be modified in an SLA Definition to control the SLA timer?
Defines the calculation method for the SLA clock.
Why this answer
SLA definitions use duration, schedules, and conditions to manage the timer.
When migrating incidents from a legacy system, you need to ensure that the SLA duration is calculated based on the Business Calendar. Where is this configured?
The Schedule field on the SLA Definition determines the operating hours.
Why this answer
SLA Definition records contain a 'Schedule' field where you associate the relevant Business Calendar.
What is the purpose of the 'Configuration Item' (CI) field on the Incident form?
Identifying the CI is crucial for impact analysis and problem correlation.
Why this answer
The CI field identifies the specific hardware or software asset that is causing the incident.
What is the 'Service Desk' group's primary role in Incident Management?
The service desk receives incoming reports and triages them.
Why this answer
The service desk acts as the Single Point of Contact (SPOC) for users to report incidents.
Which TWO of the following can trigger the creation of a 'Problem' record from an 'Incident'?
Built-in button on the incident form.
Why this answer
The 'Create Problem' UI Action and Flow Designer are standard methods for creating problems from incidents.
Which THREE aspects must be considered when creating an SLA Definition for Incidents?
This determines when the SLA clock starts.
Why this answer
An SLA needs a start condition, stop condition, and a duration (schedule).
Which role is specifically required to create or modify 'SLA Definitions'?
This role provides the necessary permissions for SLA lifecycle management.
Why this answer
The 'sla_admin' role is required to manage SLA definition records.
An organization wants to ensure that when an incident is assigned to a specific assignment group, the 'Assigned to' field automatically populates with the manager of that group. Which configuration is best for this requirement?
A Business Rule can query the sys_user_group table for the manager and set the value on the incident record.
Why this answer
A Business Rule is the most appropriate way to trigger a server-side script upon update or insertion of a record to handle field population logic.
When a Major Incident is created, a 'Major Incident Workbench' is available. What is its primary function?
The workbench is designed for coordination and visibility during a major incident.
Why this answer
The Major Incident Workbench provides a centralized view for incident responders to track status, timeline, and communications.
Which THREE types of metrics can be tracked using the baseline Incident Management SLA and Metric definitions? (Choose three.)
Metric definitions track the elapsed duration of field values like assignment group.
Why this answer
Metrics and SLAs track operational metrics such as assignment group duration, resolution time, and SLA breach statuses.
If an organization wants to prevent an Incident from being closed unless certain fields are populated, which feature should be used?
Data policies can enforce mandatory fields at the database level regardless of the UI.
Why this answer
Data Policies or UI Policies are used to enforce data integrity before state changes.
When creating an Incident from a Service Portal, which component defines the fields displayed to the user?
Record producers map catalog variables to incident fields.
Why this answer
A 'Record Producer' is the catalog item type used to create task-based records from the portal.
Which THREE actions can be performed when utilizing the incident-to-problem workflow in ITSM? (Choose three.)
Many incidents can be linked to one problem to track underlying root causes.
Why this answer
Problems can be created from incidents, incidents can be attached to existing problems, and related incidents can be resolved when the problem is fixed.
A user complains that they can see 'Incident' but not 'Problem'. What is the most likely reason?
Application access is governed by roles defined in the Application Menu.
Why this answer
Access to modules is controlled by roles. If the user lacks a role associated with the Problem Management application, the module will be hidden.
Which THREE components are configured when setting up a Service Level Agreement (SLA) Definition for Incident Management? (Choose three.)
Start conditions determine when the SLA timer begins tracking.
Why this answer
An SLA definition requires specifying the target table, duration/schedule, and workflow conditions (Start, Stop, Pause).
A service desk manager needs to ensure that Incidents assigned to the 'Hardware' group are automatically routed to a specific sub-group based on the 'Category' field. Which configuration should be used?
Assignment rules allow for automated routing based on conditions.
Why this answer
Assignment Rules are the standard mechanism to automatically route tickets based on defined criteria like Category and Assignment Group.
When configuring an 'Incident Record Producer', what is the purpose of the 'Script' field?
Mapping allows variable data to be captured in actual incident fields.
Why this answer
The script field allows for mapping variables from the catalog item to fields on the created incident record.
You are troubleshooting a scenario where an Incident SLA is not attaching to a ticket. What is the first place you should investigate?
The condition builder determines the start criteria; if these don't match the ticket, the SLA won't attach.
Why this answer
The SLA Definition condition builder determines if an incident meets the criteria to attach the SLA.
A customer wants to make the 'Short Description' field mandatory only when the Incident state changes to 'Resolved'. Which approach is best?
UI Policies are designed specifically for this behavior.
Why this answer
UI Policies are the standard, best-practice tool for making fields mandatory based on conditions.
Which THREE fields are mandatory by default in the Incident module?
Category is mandatory for reporting purposes.
Why this answer
ServiceNow includes 'Caller', 'Short Description', and 'Category' as core mandatory fields for incident creation.
Which TWO methods can be used to escalate an incident to a Major Incident in ServiceNow? (Choose two.)
Agents with appropriate roles can manually promote an incident using the form UI action.
Why this answer
Major incidents can be promoted via UI actions on the incident form or automatically triggered via configured rules and thresholds.
A problem coordinator wants to create a new Problem record directly from an existing major Incident while retaining a bi-directional link so that updates to the Incident's workaround are automatically copied to the related Problem. How should the administrator achieve this relationship natively?
The 'Create Problem' UI action natively links the incident and problem, allowing workarounds and details to be shared.
Why this answer
Using the 'Create Problem' UI Action on the Incident form creates a problem record and establishes a related list entry using the task_rel_table or out-of-the-box reference mechanisms.
A service desk manager reports that priority is not updating automatically when Impact and Urgency are changed on an incident form. Where is the mapping between Impact, Urgency, and Priority configured?
Priority Lookup Rules automatically set the priority value based on matching impact and urgency inputs.
Why this answer
Priority is calculated using the Priority Lookup Rules table (sys_choice or Data Lookup Definitions depending on configuration), which maps impact and urgency combinations to a priority value.
What is the purpose of the 'Incident Task' table?
This allows for parallel work assignment within the context of a single parent incident.
Why this answer
Incident Tasks allow for granular breakdown of incident work, allowing multiple teams to contribute to the resolution.
Which TWO of the following are valid ways to escalate an incident?
SLA breach events are standard methods to signal escalation.
Why this answer
Escalation can be performed by manually changing the priority/urgency or by setting up automated SLA breach triggers.
An organization requires that incidents created from a specific catalog item are automatically assigned to the 'Service Desk' group. What is the best way to implement this?
You can set current.assignment_group in the script field of the Record Producer.
Why this answer
Using the Record Producer's 'Script' field or a Flow Designer flow is the standard way to set values for records generated by the Service Catalog.
Which TWO considerations are important when designing Assignment Rules for Incident Management? (Choose two.)
The first matching assignment rule executes and processing halts.
Why this answer
Assignment rules should be structured with proper Order values and condition statements matching target records.
Which TWO states are typically included in the baseline Incident lifecycle state model? (Choose two.)
Resolved is a standard baseline incident state.
Why this answer
Baseline incident states include New, In Progress, On Hold, Resolved, Closed, and Canceled.
When an incident is set to 'On Hold', the 'On Hold' timer should begin. How is this configured?
Pause conditions in an SLA definition trigger the timer to pause/start based on state.
Why this answer
SLA pause conditions are configured in the SLA Definition to track time when the incident is in a specific state.
When an incident is moved to 'Resolved', what happens to the SLA timer?
Standard configurations stop the SLA timer when the incident reaches a resolved state.
Why this answer
The SLA engine pauses or stops the SLA timer based on the stop condition defined in the SLA Definition.
Which TWO actions occur automatically when a Major Incident Candidate is promoted to a Major Incident using the Major Incident Management workbench? (Choose two.)
The workbench provides real-time collaboration tools, task tracking, and timeline updates for the major incident team.
Why this answer
Promoting a major incident candidate triggers state flows, can create child incidents, notifies stakeholders, and opens the Major Incident Workbench.
How can an agent escalate an incident that is currently 'In Progress'?
Changing these inputs forces a re-evaluation of the priority.
Why this answer
The 'Priority' field is increased by updating the Impact or Urgency fields, which triggers a priority recalculation.
Which THREE items are required to properly define an SLA?
The schedule defines the working hours applied to the duration.
Why this answer
An SLA definition requires a schedule, duration, and start/stop/pause conditions.
Which mechanism ensures that if an Incident is not updated for 24 hours, an email is sent to the manager?
Inactivity monitors are designed to trigger actions after a period of no updates.
Why this answer
A 'Scheduled Job' or 'SLA' can be used, but 'SLA Breach' or specific 'Inactivity Monitors' are the standard tools for this.
What does the 'Caller' field on the Incident form reference?
The caller must be a record in the user database.
Why this answer
The Caller field is a reference field pointing to the 'sys_user' table.
Which tool is best for visualizing the relationship between an Incident and the affected Configuration Item?
The Dependency View graphically displays the CI and its related upstream/downstream components.
Why this answer
The Dependency View is the standard tool for visualizing CI relationships and impacts.
An Incident is related to a Problem record. When the Problem is resolved, the related Incidents should be updated automatically. How is this typically managed?
Standard Problem Management includes UI actions to sync state changes to related incidents.
Why this answer
The 'Update related incidents' UI Action on the Problem form automates this process.
Which TWO of the following are common methods to populate the 'Affected CI' on an incident?
Users can select the CI directly from the form.
Why this answer
The CI can be populated manually or automatically via the 'Caller's' record if a primary CI is linked.
You are investigating why an incident was not auto-assigned. You check the Assignment Rules but notice the 'Match Conditions' are met. What is another common reason?
An inactive rule will not process regardless of match conditions.
Why this answer
Assignment rules must be active and the 'Assignment rule' field on the incident form must be empty if you want the rule to overwrite it.
When configuring Incident Management properties (Incident > Administration > Properties), which TWO behaviors can an administrator control globally? (Choose two.)
System properties control whether end users can reopen closed incidents by replying to notifications.
Why this answer
Incident properties control operational behaviors like reopening rules, auto-closure intervals, and default search behaviors.
Which TWO are common 'On Hold' reasons in the standard Incident process?
Standard hold reason for waiting on the user.
Why this answer
Standard on-hold reasons include 'Awaiting Caller' and 'Awaiting Vendor'.
You need to ensure that only members of the 'Major Incident Management' group can promote an incident to a Major Incident. How do you restrict this?
Modifying the Condition on the 'Promote to Major Incident' UI Action is the standard way to restrict access.
Why this answer
The 'Major Incident' promotion feature is governed by a UI Action which can have its 'Condition' field updated to check for specific roles or groups.
Ready to test yourself?
Try a timed practice session using only Incident Management questions.