Courseiva

CCNA Problem Management Questions

64 questions · Problem Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

Which THREE methods can be used to assign incoming Problem records to the correct assignment group automatically? (Choose three.)

Select 3 answers
A.Flow Designer or Workflow assignment logic
B.Assignment Rules
C.Random guessing by junior service desk agents
D.Manually rolling dice in the server room
E.Data Lookup and Matching rules
AnswersA, B, E

Flow Designer and Workflow assignment logic evaluate record conditions at creation, then set the assignment group field automatically via server-side rules — satisfying the stem's requirement for automatic routing of incoming Problem records without manual intervention. This is native platform automation, distinct from client-side UI policies or default value configuration.

Why this answer

Option A (Flow Designer or Workflow assignment logic) is correct because ServiceNow lets you build server-side automation in Flow Designer or Workflow that sets the assignment_group field on a Problem record based on conditions, so the record is routed without human intervention. Option B (Assignment Rules) is correct because Assignment Rules are a native platform mechanism that evaluates conditions on the Problem record and automatically populates the assignment group (and optionally the assigned user) when the record is created or updated. Option E (Data Lookup and Matching rules) is correct because Data Lookup and Matching rules can derive and set field values such as assignment group by matching record attributes against a lookup table, enabling automatic routing of incoming Problems.

Option C (Random guessing by junior service desk agents) is not a valid automated assignment method because it relies on arbitrary human choice and provides no deterministic, rule-based routing. Option D (Manually rolling dice in the server room) is not a supported ServiceNow capability and is purely a joke distractor with no technical mechanism for setting assignment groups.

Exam trap

The trap is including non-automated or nonsensical options — candidates must recognize that only native ServiceNow assignment features (Flow Designer, Assignment Rules, Data Lookup) are valid, while manual or random methods are distractors.

Practice this question →
2
MCQmedium

A problem manager wants to ensure that when a problem is moved to the 'Fix in Progress' state, a specific approval from the change manager is automatically requested before any fix tasks can be created. Which configuration should be used to enforce this requirement?

A.Configure a workflow that, upon entering 'Fix in Progress', creates an approval record and waits for it before proceeding.
B.Use a UI policy to make the 'Fix in Progress' state read-only until an approval is manually attached.
C.Set up a scheduled job that checks for problems in 'Fix in Progress' and sends an email to the change manager for approval.
D.Create a business rule on the Problem table that blocks state changes to 'Fix in Progress' unless an approval record exists.
AnswerA

Workflows are the standard mechanism to automate approvals. By adding an approval activity in the Problem workflow that triggers on the 'Fix in Progress' state, the system automatically generates an approval request and pauses until it is approved. This ensures the change manager's approval is obtained before fix tasks are created, meeting the requirement without custom scripting.

Why this answer

The requirement is to automatically request approval when a problem enters 'Fix in Progress' and ensure no fix tasks are created until approval is granted. ServiceNow workflows natively support approval activities that create approval records and pause execution, providing a controlled and auditable process. This is the standard and most reliable method to enforce such a gate.

Exam trap

The trap here is assuming that business rules or UI policies can handle approval automation, when in fact workflows are the designated tool for orchestrating approvals and state transitions.

Practice this question →
3
MCQmedium

A problem coordinator wants to analyze the effectiveness of the problem management process. They need to see how many problems were reopened after being closed in the last quarter. Which metric or report should they use?

A.Problem reopen rate
B.Problem aging report
C.Mean time to resolve (MTTR) for problems
D.Problem backlog trend
AnswerA

The problem reopen rate metric specifically measures the percentage or count of problems that were reopened after closure. It is a key performance indicator for process quality, as a high reopen rate indicates ineffective root cause analysis or premature closure. This metric directly answers how many problems were reopened in a given period, such as the last quarter.

Why this answer

The problem reopen rate is the metric that counts or calculates the percentage of problems that were closed and subsequently reopened. It is a direct measure of process effectiveness, as reopening indicates that the original resolution did not fully address the root cause. Other metrics like aging, backlog, or MTTR do not specifically track reopen events.

Exam trap

The trap here is confusing metrics that measure volume or duration with those that measure quality, such as reopen rate, which specifically tracks problems that failed closure.

Practice this question →
4
Multi-Selecteasy

Which TWO types of records can be directly linked to a Problem record in standard ServiceNow ITSM? (Choose two.)

Select 2 answers
A.Bank Account
B.Incident
C.Airplane Flight Plan
D.Change Request
E.Real Estate Deed
AnswersB, D

Incidents are linked directly to Problem records so that recurring or related outages roll up into a single root-cause investigation. This satisfies the stem's requirement by naming a record type that standard ServiceNow ITSM permits as a direct Problem association.

Why this answer

Option B (Incident) is correct because in standard ServiceNow ITSM a Problem record can be directly linked to one or more Incidents via the related Incidents related list, allowing multiple incidents with a common root cause to be grouped under a single problem. Option D (Change Request) is correct because a Problem can be directly associated with a Change Request through the related Change Requests related list, typically to implement the fix or workaround identified during problem investigation. Options A (Bank Account), C (Airplane Flight Plan), and E (Real Estate Deed) are not standard ServiceNow ITSM record types and have no native relationship to Problem records, so they cannot be directly linked in the base platform.

Exam trap

CIS-ITSM often tests whether candidates know the standard ITSM record relationships, and the distractor options (Bank Account, Airplane Flight Plan, Real Estate Deed) are absurd non-ITSM records designed to see if you'll pick anything that sounds like a 'record'.

Practice this question →
5
MCQeasy

Which module allows service desk agents to view problems that have been published as known errors?

A.Known Errors
B.Problem Properties
C.Incident Overview
D.Change Schedule
AnswerA

The Known Errors module stores problems whose root cause is identified and for which a workaround exists, publishing them for service desk reference. Agents open this module to view those records, satisfying the requirement to see published known errors.

Why this answer

The 'Known Errors' module in ServiceNow allows service desk agents to view problems that have been published as known errors. Known errors are problems that have a root cause and a workaround, and they are made available to agents to help resolve incidents.

Exam trap

The trap is confusing the Known Errors module with other problem-related modules or incident modules; candidates might think known errors are viewed within incidents or problems, but there is a dedicated module.

How to eliminate wrong answers

Option B is wrong because Problem Properties is a configuration form, not a module for viewing known errors. Option C is wrong because Incident Overview is for viewing incidents, not known errors. Option D is wrong because Change Schedule is for viewing changes, not known errors.

Practice this question →
6
Multi-Selectmedium

Which THREE actions can be performed directly from a Problem record form using baseline UI Actions or related lists? (Choose three.)

Select 3 answers
A.Create a Known Error Article
B.Create a Problem Task
C.Automatically reboot all linked server CIs
D.Create a Change Request
E.Convert the problem directly into an HR Case
AnswersA, B, D

The Problem form provides a UI Action to create a Known Error article, publishing the root cause and workaround to the knowledge base. This satisfies the requirement because the action is invoked directly from the Problem record, not through a separate knowledge workflow.

Why this answer

Option A (Create a Known Error Article) is correct because the Problem form includes a baseline UI Action that lets an agent create a Known Error article, typically by generating it from the problem's information and linking it back to the Problem record. Option B (Create a Problem Task) is correct because the Problem form provides a baseline UI Action and a Problem Tasks related list that allow agents to add child Problem Task records to break the investigation into work items. Option D (Create a Change Request) is correct because the baseline Problem form offers a UI Action to create a Change Request when a fix requires a change, linking the change to the problem for traceability.

Option C is not correct because rebooting linked server CIs is not a baseline Problem UI Action or related-list function; that would require orchestration, workflow, or a custom action. Option E is not correct because converting a Problem directly into an HR Case is not a baseline capability of the Problem form and would require custom configuration.

Exam trap

CIS-ITSM often tests the boundary between baseline problem actions and cross-application actions — candidates pick HR Case or CI reboot because they sound plausible, but they are not baseline UI actions on the Problem form.

Practice this question →
7
MCQeasy

Which tab or related list on a Problem record displays the individual tasks assigned to various groups to investigate specific components of the root cause?

A.Problem Tasks
B.Child Incidents
C.Outages
D.Affected CIs
AnswerA

Problem Tasks is the related list holding the individual task records assigned to groups investigating specific components of the root cause. It captures the decomposition of the investigation, distinguishing it from the broader Problem record fields and unrelated lists.

Why this answer

The Problem Tasks tab or related list on a Problem record is specifically designed to hold individual tasks that are assigned to different groups to investigate specific components of the root cause. These tasks allow for parallel investigation and are a core part of the Problem Management process in ServiceNow. Child Incidents, Outages, and Affected CIs serve different purposes and do not represent the breakdown of root cause investigation work.

Exam trap

CIS-ITSM often tests the distinction between related lists on Problem records, and candidates may confuse Child Incidents (which are linked incidents) with Problem Tasks (which are the actual investigation tasks).

How to eliminate wrong answers

Option B is wrong because Child Incidents are incidents that are linked to the problem, typically to indicate they may share a common root cause, but they are not tasks assigned for investigation. Option C is wrong because Outages record unplanned downtime events or service outages, not the individual investigation tasks. Option D is wrong because Affected CIs list the configuration items that are impacted by the problem, not the tasks to investigate the root cause.

Practice this question →
8
MCQmedium

An IT manager wants to ensure that whenever a Problem is resolved, a survey is automatically sent to the caller of each associated active incident. Which ServiceNow feature manages survey triggers upon task resolution?

A.Email Client Template rules
B.Assessments / Trigger Conditions
C.Data Lookup definitions for surveys
D.UI Action Survey buttons
AnswerB

Assessments with trigger conditions fire a survey automatically when the associated task resolves, sending it to each active incident caller. This is the native ServiceNow mechanism for conditional, resolution-triggered surveys rather than manual or notification-based approaches.

Why this answer

ServiceNow's Assessments (Survey) module uses Trigger Conditions to define when a survey is dispatched. An administrator configures a trigger condition on the survey (e.g., Problem state changes to Resolved) and a recipient source, which can include callers of associated incidents, so surveys fire automatically on resolution.

Exam trap

CIS-ITSM often tests confusion between notification mechanics and survey mechanics — candidates pick Email Client Templates or UI Actions, not realizing surveys are governed by Assessment Trigger Conditions, not email or form logic.

How to eliminate wrong answers

Option A is wrong because Email Client Templates format outbound email content; they do not evaluate task state or determine survey recipients. Option C is wrong because Data Lookup definitions resolve field values from reference tables — they have no role in triggering surveys. Option D is wrong because UI Actions are buttons rendered on forms; they require manual user interaction and cannot automatically send surveys on state change.

Practice this question →
9
MCQeasy

What does the 'Root cause summary' field on a Problem record typically capture?

A.The SLA breach percentage for the problem task
B.The detailed explanation of the underlying cause determined during investigation
C.A list of all engineers who logged into the server
D.The purchase order number of the replacement hardware
AnswerB

The 'Root cause summary' field documents the verified underlying cause identified through problem investigation, satisfying the requirement to record why an incident occurred. Unlike workaround or resolution fields, it captures the diagnostic conclusion itself, enabling trend analysis and preventing recurrence. This aligns with ITIL problem management practise, where root cause determination is the core investigative output.

Why this answer

The 'Root cause summary' field on a Problem record captures the detailed explanation of the underlying cause identified during investigation. It documents why the problem occurred, such as a misconfiguration, code defect, or process gap, so that permanent fixes can be applied and knowledge shared. This field is populated after root cause analysis (RCA) is complete.

Exam trap

The trap is selecting a field that sounds related to problem resolution but actually belongs to a different record type (SLA, audit, or procurement) — candidates must know which fields live on the Problem table itself.

How to eliminate wrong answers

Option A is wrong because SLA breach percentage is a metric tracked on task SLA records, not a narrative field on the Problem record. Option C is wrong because a list of engineers who logged into a server is audit/access data, not root cause information. Option D is wrong because a purchase order number for replacement hardware is procurement data that might appear in work notes or related records, but it does not describe the underlying cause of the problem.

Practice this question →
10
MCQeasy

What is the primary objective of reactive Problem Management?

A.To build the initial Configuration Management Database (CMDB)
B.To review change request risk before deployment
C.To handle password reset requests from end users
D.To identify and eliminate the underlying causes of incidents that have already occurred
AnswerD

Reactive Problem Management responds after incidents occur, performing root cause analysis to find and remove the underlying cause, preventing recurrence. This contrasts with proactive Problem Management, which seeks causes before incidents arise, matching the stem's emphasis on incidents that have already happened.

Why this answer

Reactive Problem Management focuses on investigating incidents that have already occurred to determine and eliminate their root cause, preventing recurrence. Its primary objective is to reduce the number and impact of future incidents by addressing the underlying cause rather than just restoring service. This is distinct from proactive Problem Management, which seeks to identify problems before incidents occur.

Exam trap

CIS-ITSM often tests the distinction between reactive and proactive Problem Management — candidates confuse reactive (responding to incidents already occurred) with proactive (identifying problems before incidents happen) and pick answers describing proactive or unrelated activities.

How to eliminate wrong answers

Option A is wrong because building the initial CMDB is a Configuration Management objective, not a Problem Management objective — CMDB population is driven by discovery and configuration management processes. Option B is wrong because reviewing change request risk before deployment is a Change Management responsibility handled through change advisory board (CAB) reviews and risk assessment, not Problem Management. Option C is wrong because handling password reset requests is a Service Desk / Incident Management function (often automated via password reset tools), not a Problem Management activity.

Practice this question →
11
MCQhard

A custom integration creates Problem records in ServiceNow via REST API. The integration payload occasionally omits the 'Assignment group', but company policy requires all problems to have an assignment group before reaching the 'Assess' state. Where should this default assignment logic be robustly implemented?

A.In a Service Portal Widget controller script
B.In a UI Policy Action
C.In an onLoad Client Script on the Problem form
D.In a Before Insert/Update Business Rule on the Problem table
AnswerD

A Before Insert/Update Business Rule runs server-side on the Problem table regardless of entry channel, so it applies the default assignment group before the record can reach Assess. This enforces policy for REST-created records, not just form submissions.

Why this answer

Implementing the default assignment logic in a Before Insert/Update Business Rule on the Problem table ensures that the assignment group is set regardless of how the record is created or updated, including via REST API, import sets, or UI. Business Rules run on the server side and are the most robust place for data integrity logic that must apply to all entry points.

Exam trap

CIS-ITSM often tests the appropriate use of Business Rules versus Client Scripts or UI Policies; candidates may choose client-side solutions that do not apply to API or background operations, leading to data integrity gaps.

How to eliminate wrong answers

Option A is wrong because a Service Portal Widget controller script only affects records created through that specific widget, not via REST API or other channels. Option B is wrong because a UI Policy Action only runs on the client side when the form is used, so it does not apply to API-created records. Option C is wrong because an onLoad Client Script only executes when the form loads in the browser, and it cannot enforce logic on API inserts or updates.

Practice this question →
12
Multi-Selecthard

When configuring Problem Management properties (Problem Administration > Properties), which TWO behaviors can typically be controlled or enabled? (Choose two.)

Select 2 answers
A.Automatically provision AWS cloud infrastructure upon problem creation
B.Configure bi-weekly payroll deduction rates
C.Require root cause to be filled in before closing or resolving a problem
D.Force all end users to reset their Active Directory passwords
E.Enable automatic communication of workarounds to related active incidents
AnswersC, E

Requiring root cause completion before closure enforces data quality at the point of resolution, satisfying the stem's demand for a controllable Problem Administration property. ServiceNow's Problem Properties include a mandatory root cause field setting that blocks state transition to Closed or Resolved until populated, ensuring the investigation record is complete.

Why this answer

Option C is correct because Problem Management properties commonly include a setting that mandates the Root Cause field be populated before a problem can be resolved or closed, enforcing proper root cause analysis discipline. Option E is correct because these properties typically allow enabling automatic notification or communication of known workarounds to related active incidents, helping service desk agents apply interim fixes quickly. Option A is incorrect because provisioning AWS cloud infrastructure is an orchestration/automation task, not a Problem Management property.

Option B is incorrect because payroll deduction rates belong to HR/payroll systems, not Problem Administration. Option D is incorrect because forcing Active Directory password resets is an identity management function, unrelated to Problem Management configuration.

Exam trap

CIS-ITSM often tests the specific location and scope of Problem Management properties; candidates may confuse them with Incident or Change properties, or assume that all listed behaviors are configurable when some are not.

Practice this question →
13
MCQeasy

Which related list on a Problem form displays incidents that have been associated with that specific problem?

A.Problem Tasks
B.Child Incidents
C.Outages
D.Knowledge Articles
AnswerB

The Child Incidents related list on a Problem record shows incidents linked to that problem, providing the association the stem requests. It is populated when incidents are related to the problem, distinguishing it from lists such as Problem Tasks or Affected CIs.

Why this answer

The Child Incidents related list on a Problem record displays incidents that have been associated with that problem, either manually or through the problem's incident correlation process. This is the standard related list used to view and manage the incidents tied to a specific problem.

Exam trap

The trap is confusing the various related lists on the Problem form; candidates often pick Problem Tasks because it sounds like the work associated with the problem, but the question specifically asks for the incidents linked to it.

How to eliminate wrong answers

Option A is wrong because Problem Tasks are the work items created to investigate and resolve the problem, not the incidents linked to it. Option C is wrong because Outages records represent service outages and their impact, not the individual incidents associated with the problem. Option D is wrong because Knowledge Articles are the documented solutions and references attached to the problem, not the incidents it affects.

Practice this question →
14
MCQeasy

What is the primary role of the 'Configuration Item' (CI) field on a Problem record?

A.To schedule an automatic reboot of the CI upon problem creation
B.To automatically assign the problem to the vendor who manufactured the hardware
C.To lock the CI from being modified while investigations are ongoing
D.To identify the specific hardware, software, or service suspected of causing the failure
AnswerD

The CI field links the Problem record to the specific configuration item — hardware, software, or service — suspected of causing the failure, enabling impact analysis and root cause investigation. This directly satisfies the stem's requirement to identify what is failing rather than who reported it.

Why this answer

The CI field on a Problem record identifies the specific configuration item (hardware, software, or service) that is suspected of causing the failure. This helps in root cause analysis and linking the problem to the affected infrastructure.

Exam trap

The trap here is confusing the CI field's purpose with other automation features like reboots or locking, which are not inherent to the field.

How to eliminate wrong answers

Option A is wrong because the CI field does not trigger automatic reboots; that would require a workflow or orchestration. Option B is wrong because vendor assignment is not automatic based on CI; it would require assignment rules. Option C is wrong because the CI field does not lock the CI from modification; locking is controlled by other mechanisms like business rules or ACLs.

Practice this question →
15
Multi-Selecthard

A customized Problem workflow requires integrating with an external CMDB discovery tool. When a Problem is resolved, the integration must verify CI attributes via REST. Which TWO ServiceNow features support making outbound REST calls and parsing JSON responses? (Choose two.)

Select 2 answers
A.Dictionary Override checkbox attributes
B.Flow Designer with the 'REST Step' in IntegrationHub
C.Client-side alert() popups
D.RESTMessageV2 API inside a Script Include or Business Rule
E.UI Policy Action visibility toggles
AnswersB, D

The IntegrationHub REST step performs outbound REST calls declaratively within a flow, and its response can be parsed as JSON for downstream logic. This meets the stem's requirement to verify CI attributes against the external discovery tool on Problem resolution.

Why this answer

Option B is correct because Flow Designer with IntegrationHub's REST step provides a no-code/low-code way to make outbound REST calls and natively parse JSON responses into flow variables, which fits the requirement to verify CI attributes when a Problem is resolved. Option D is correct because the RESTMessageV2 API (in a Script Include or Business Rule) allows server-side outbound REST calls via methods like execute() and executeAsync(), and the returned response body can be parsed with JSON.parse() to read CI attributes. Option A is not correct because Dictionary Override checkbox attributes only control field-level behavior across extended tables and have nothing to do with outbound REST or JSON parsing.

Option C is not correct because client-side alert() popups only display browser messages and cannot perform server-side REST integrations. Option E is not correct because UI Policy Action visibility toggles only show or hide form fields and do not make REST calls or parse JSON.

Exam trap

CIS-ITSM often tests the confusion between client-side UI features and server-side integration capabilities, tricking candidates into selecting UI policies or client scripts when the requirement is for outbound REST calls and JSON parsing.

Practice this question →
16
MCQeasy

What is the primary purpose of the 'Known Error Article' integration with Knowledge Management?

A.To automatically order replacement hardware from vendors
B.To publish known errors and workarounds to a knowledge base for searchability and incident deflection
C.To generate annual financial audit reports
D.To reset user passwords automatically
AnswerB

Known Error Articles record the root cause and workaround for diagnosed errors, and publishing them into the knowledge base makes that content searchable by service desk staff and users. This enables incident deflection by resolving recurring issues without escalation, satisfying the integration's stated purpose.

Why this answer

The Known Error Article integration with Knowledge Management publishes documented known errors and their workarounds into the knowledge base so they are searchable and reusable. This supports incident deflection — users and agents can find the workaround without logging a new incident, and agents can attach the article to incidents. It is a knowledge-sharing mechanism, not an automation or procurement tool.

Exam trap

CIS-ITSM often tests whether candidates confuse knowledge management (documenting and sharing) with automation (executing fixes), leading them to pick an option that implies the article performs an action.

How to eliminate wrong answers

Option A is wrong because ordering replacement hardware is a procurement/asset workflow, not a function of knowledge articles. Option C is wrong because financial audit reports come from financial systems, not from known error knowledge articles. Option D is wrong because password resets are handled by identity/credential management tools or automated workflows, not by publishing a knowledge article.

Practice this question →
17
Multi-Selecthard

An administrator is designing a custom Flow Designer action to process Problem records. Which TWO types of inputs can be configured for a custom Flow Designer action? (Choose two.)

Select 2 answers
A.Live video streaming feed codec
B.Analog radio frequency wave capture
C.Record (referencing a specific table like Problem [problem])
D.Direct physical server motherboard circuit diagram binary
E.String (for text inputs like short descriptions or workarounds)
AnswersC, E

A Record input references a specific table, such as Problem [problem], passing a full record rather than a scalar value. This satisfies the stem's requirement for configurable input types by enabling the action to operate directly on Problem records.

Why this answer

Option C is correct because Flow Designer custom actions support a Record input type, which lets the action accept a reference to a specific table such as Problem [problem], enabling the action to operate on that record's fields and sys_id. Option E is correct because Flow Designer also supports the String input type, which is used for plain text values like short descriptions or workaround notes. These input types are defined in the action's input metadata and are surfaced as variables when the action is used in a flow.

The other options (A, B, and D) are not valid Flow Designer input types; they describe media codecs, radio signals, and hardware schematics, none of which are configurable inputs in the platform.

Exam trap

CIS-ITSM often tests the distinction between valid Flow Designer input types and unrelated technical concepts, causing candidates to overthink and select options that sound sophisticated but are not part of the platform.

Practice this question →
18
Multi-Selecteasy

Which TWO benefits are gained by linking related Incidents to a Problem record? (Choose two.)

Select 2 answers
A.Immediate deletion of all server hard drives
B.Automatic conversion of incidents into physical paper mail
C.Ability to send bulk communications to all affected incident callers when a workaround is found
D.Accurate calculation of total business impact and affected user counts
E.Automatic promotion of all end users to IT administrators
AnswersC, D

Related incidents expose their caller contact details to the problem record, letting support staff issue one bulk notification to every affected caller once a workaround exists. This satisfies the requirement for efficient mass communication instead of contacting each caller individually.

Why this answer

Option C is correct because linking incidents to a Problem record lets support teams identify every caller tied to that problem and issue a single bulk notification (e.g., email or portal update) once a workaround or fix is available, rather than contacting each user individually. Option D is correct because the linked incident records aggregate data such as the number of affected users, sites, and services, enabling accurate calculation of the Problem's total business impact and user counts for prioritization and reporting. Options A, B, and E are incorrect because deleting hard drives, converting incidents to paper mail, and promoting users to administrators are not functions of incident-to-problem linking and have no basis in ITIL problem management practice.

Exam trap

CIS-ITSM often tests the misconception that linking Incidents to a Problem automatically resolves or closes the Incidents, or that it grants administrative privileges, when in fact the primary benefits are aggregated impact calculation and bulk communication.

Practice this question →
19
MCQhard

A custom workflow is designed for High Priority problems. When priority is 1 - Critical, the workflow must spawn a parallel set of problem tasks for Infrastructure, Security, and Database teams simultaneously. Which Flow Designer flow logic component accomplishes parallel execution?

A.For Each loop logic
B.Wait for condition activity
C.If / Else condition branches
D.Do in Parallel flow logic block
AnswerD

The Do in Parallel block branches execution into concurrent paths, so Infrastructure, Security, and Database problem tasks are created simultaneously rather than sequentially. This directly satisfies the stem's requirement for parallel task spawning when priority is 1 - Critical.

Why this answer

Flow Designer's 'Do in Parallel' flow logic block is specifically designed to execute multiple branches simultaneously, which is exactly what is needed to spawn Infrastructure, Security, and Database tasks at the same time. Each branch runs independently and the flow waits for all branches to complete before continuing. This is the native parallel execution primitive in Flow Designer.

Exam trap

CIS-ITSM often tests the difference between sequential iteration (For Each) and true parallel execution (Do in Parallel), catching candidates who assume any multi-branch logic runs concurrently.

How to eliminate wrong answers

Option A is wrong because a For Each loop iterates sequentially over a collection, executing one item at a time — it does not run branches concurrently. Option B is wrong because 'Wait for condition' pauses the flow until a condition is met; it does not create parallel execution paths. Option C is wrong because If/Else branches are mutually exclusive — only one path executes based on the condition, so it cannot spawn three simultaneous task sets.

Practice this question →
20
MCQhard

A high-volume enterprise experiences thousands of problem state updates daily. To optimize database performance, an administrator wants to archive closed Problem records older than 3 years. Which feature should be configured?

A.Dictionary entry attribute 'auto_purge'
B.A scheduled job running manual SQL DELETE statements
C.Client script cleanup routine
D.Archiving Rules (Data Archiving plugin)
AnswerD

Archiving Rules in the Data Archiving plugin move closed Problem records older than a defined age into the archive tables, removing them from active queries. This directly satisfies the stem's three-year retention threshold and reduces load on the primary database.

Why this answer

ServiceNow's Data Archiving plugin provides Archiving Rules that let administrators define conditions (such as 'Closed Problem records older than 3 years') and schedule automated archival of matching records to the archive tables. This is the supported, upgrade-safe mechanism for reducing active table size and improving query performance on high-volume tables like Problem.

Exam trap

The trap here is confusing 'auto_purge' (hard delete via Table Cleanup) with Archiving Rules (move to archive tables) — candidates who see 'archive' in the question often still pick auto_purge because it sounds like a cleanup mechanism.

How to eliminate wrong answers

Option A is wrong because 'auto_purge' is a dictionary attribute used by the Table Cleanup / purge utility for hard-deleting records based on age, not for archiving them to a separate archive table — it destroys data rather than preserving it. Option B is wrong because running manual SQL DELETE statements against the ServiceNow database is unsupported, bypasses business rules and audit trails, and can corrupt referential integrity. Option C is wrong because client scripts run in the browser and cannot perform server-side bulk archival of thousands of records.

Option D is correct because Archiving Rules are the native, supported feature for moving aged records out of the active table while keeping them queryable in archive tables.

Practice this question →
21
MCQmedium

An organization wants to restrict problem creation so that only users assigned to the 'Problem Management' group can create new problem records. How should this be implemented?

A.A create Access Control List (ACL) on the Problem table checking group membership
B.A Dictionary entry attribute 'no_create'
C.A Client Script hiding the 'New' button for unauthorized users
D.A UI Policy enforcing mandatory user groups
AnswerA

A create ACL on the Problem table evaluates the user's group membership before permitting record insertion, directly enforcing the restriction that only members of the 'Problem Management' group may create problem records. This is the native ServiceNow authorisation mechanism for table-level create operations, satisfying the stem's group-based constraint.

Why this answer

A create ACL on the Problem table that checks group membership is the correct implementation because ACLs are the only server-side security mechanism that can restrict who can create records. By configuring the create ACL with a condition that the user is a member of the 'Problem Management' group, only those users can create problem records. This enforces security at the database level, not just the UI.

Exam trap

CIS-ITSM often tests whether candidates understand that UI-level controls (Client Scripts, UI Policies) are not security — candidates incorrectly pick UI-based solutions for access restriction questions.

How to eliminate wrong answers

Option B is wrong because a Dictionary entry attribute 'no_create' is not a valid ServiceNow attribute — dictionary attributes like 'no_audit' or 'read_only' exist, but 'no_create' does not, and dictionary attributes do not enforce role or group-based creation restrictions. Option C is wrong because a Client Script hiding the 'New' button only affects the UI and can be bypassed via direct URL access, REST API, or list view — it is not a security control. Option D is wrong because a UI Policy enforcing mandatory user groups only makes fields mandatory or read-only on the form; it does not restrict who can create records and is client-side only.

Practice this question →
22
MCQhard

A company integrates Problem Management with an external bug tracker. When a Problem state changes in ServiceNow, an outbound REST message must be sent asynchronously. Which ServiceNow feature should trigger this outbound REST call?

A.An asynchronous Business Rule or Flow Designer action invoking a REST message
B.A UI Policy with an inbound webhook script
C.A Dictionary Override on the REST endpoint field
D.A synchronous Client Script using XMLHttpRequest
AnswerA

An asynchronous Business Rule or Flow Designer action runs after the transaction commits, so the outbound REST message fires without blocking the Problem state change. This satisfies the requirement for a non-blocking, asynchronous call to the external bug tracker.

Why this answer

An asynchronous Business Rule or Flow Designer action invoking a REST message is the correct feature to trigger an outbound REST call asynchronously when a Problem state changes. Business Rules can be configured to run asynchronously, meaning they execute in a separate thread after the transaction commits, preventing user delay. Flow Designer actions can also make REST calls asynchronously as part of a flow.

This ensures the external bug tracker is notified without impacting the user's session.

Exam trap

CIS-ITSM often tests the misconception that client-side scripts can handle outbound REST calls, but the exam expects knowledge that server-side asynchronous mechanisms are required for reliable integrations.

How to eliminate wrong answers

Option B is wrong because a UI Policy with an inbound webhook script is not a valid mechanism for outbound REST calls; UI Policies are client-side and cannot send outbound REST messages. Option C is wrong because a Dictionary Override on the REST endpoint field does not trigger REST calls; Dictionary Overrides are used to change field behavior or labels. Option D is wrong because a synchronous Client Script using XMLHttpRequest runs in the browser, is not asynchronous in the context of server-side state changes, and is not reliable for outbound integrations; it also exposes credentials and is not best practice.

Practice this question →
23
MCQhard

An enterprise uses Agile Development in tandem with Problem Management. When a root cause points to a software defect, the team wants to create a Defect record in ServiceNow Agile Development directly from the Problem form. How is this integration typically achieved?

A.By configuring a UI Action on the Problem form that instantiates an Agile Defect record and establishes a relationship
B.By mapping Data Lookup definitions between rm_defects and problem tables
C.By editing the core cmdb_ci relationship formatter
D.By changing the base table of the problem table to rm_defect
AnswerA

A UI Action on the Problem form runs server-side script that creates an Agile Defect record and links it to the Problem, giving agents one-click defect creation with traceable relationship, which is the standard ServiceNow integration pattern.

Why this answer

Configuring UI Actions or extending Agile Development plugins enables creating Agile artifacts (Stories, Defects, Epics) from task forms like Problem.

Practice this question →
24
Multi-Selecteasy

Which TWO methods can be used to navigate to Problem Management modules in the ServiceNow application navigator? (Choose two.)

Select 2 answers
A.Clicking on System Security > Certificates
B.Navigating via Problem > Open or Problem Administration > Properties
C.Accessing Facilities > Work Orders
D.Opening the Incident menu and selecting 'Payroll Runs'
E.Typing 'Problem' in the Filter navigator box
AnswersB, E

The application navigator exposes Problem Management through its hierarchical menu structure. Expanding Problem > Open or Problem Administration > Properties drills into the specific modules, which is the standard click-through navigation path within the ServiceNow interface.

Why this answer

Option B is correct because the ServiceNow application navigator organizes Problem Management under the Problem menu (e.g., Problem > Open, Problem > Assigned to me) and the Problem Administration module (e.g., Problem Administration > Properties), so navigating those paths reaches Problem Management modules. Option E is correct because the Filter navigator box at the top of the application navigator accepts typed text and performs a live search, so typing 'Problem' filters the menu to display the Problem-related modules for direct navigation. Option A is incorrect because System Security > Certificates belongs to certificate management, not Problem Management.

Option C is incorrect because Facilities > Work Orders is part of Facilities Management, unrelated to Problem records. Option D is incorrect because the Incident menu contains incident-related modules, and 'Payroll Runs' is not a Problem Management module.

Exam trap

CIS-ITSM often tests the distinction between valid navigation paths and unrelated modules, so candidates must recognize that only the Problem menu and Filter navigator search are correct, while options referencing unrelated applications (e.g., Facilities, System Security) are distractors.

Practice this question →
25
MCQmedium

An organization wants to track problem metrics using Performance Analytics. Which plugin must be active to utilize out-of-the-box Performance Analytics content packs for Problem Management?

A.Incident and Problem Analytics Pack
B.ITSM Performance Analytics Core
C.Problem Management Advanced Analytics
D.Performance Analytics - Content Pack - Problem Management
AnswerD

The Performance Analytics - Content Pack - Problem Management plugin installs the prebuilt indicators, breakdowns, and dashboards that surface problem metrics. Without it, Performance Analytics holds no out-of-the-box Problem Management content, so the required tracking cannot be delivered.

Why this answer

The out-of-the-box Performance Analytics content for Problem Management is delivered through the dedicated plugin 'Performance Analytics - Content Pack - Problem Management.' This plugin installs the pre-built indicators, breakdowns, and dashboards specific to Problem Management KPIs such as open problems, mean time to resolve, and aging. Without this content pack activated, the Problem Management dashboards and indicators will not be populated with baseline data.

Exam trap

CIS-ITSM often tests whether candidates can distinguish between the base Performance Analytics plugin and the process-specific content pack plugin — candidates frequently pick a plausible-sounding but non-existent 'Analytics Pack' name instead of the exact 'Content Pack' plugin.

How to eliminate wrong answers

Option A is wrong because 'Incident and Problem Analytics Pack' is not a real ServiceNow plugin name — it conflates two separate content packs and does not exist in the plugin registry. Option B is wrong because 'ITSM Performance Analytics Core' is not the correct plugin identifier; the core ITSM content is delivered via separate content packs per process (Incident, Problem, Change, etc.), not a single 'Core' plugin. Option C is wrong because 'Problem Management Advanced Analytics' is a fabricated name — no such plugin exists; the actual plugin uses the 'Content Pack' naming convention.

Practice this question →
26
MCQhard

An organization requires that when a Problem goes to 'Resolved', all related active incidents must be updated with the workaround text and moved to 'Awaiting User Info' state. How should this be configured for optimal performance?

A.A Script Include combined with a Problem Business Rule to batch-update related incidents
B.An Access Control List script with update capabilities
C.A Dictionary Client Script on the Incident table
D.A Client Script running on the Problem form with synchronous GlideRecord loops
AnswerA

Encapsulating business logic in a Script Include called by a Business Rule ensures clean, maintainable, and high-performance server processing.

Why this answer

A Script Include combined with a Problem Business Rule is the correct approach because Business Rules execute server-side on the Problem table when the state changes to 'Resolved'. The Script Include encapsulates the batch update logic (using GlideRecord or GlideMultipleUpdate) to efficiently update all related active incidents, setting the workaround field and changing state to 'Awaiting User Info'. This server-side approach ensures data integrity and optimal performance by avoiding client-side loops and leveraging the platform's bulk update capabilities.

Exam trap

CIS-ITSM often tests the misconception that client-side scripts can handle cross-table batch updates, but the exam expects knowledge that server-side Business Rules with Script Includes are required for performance and data integrity.

How to eliminate wrong answers

Option B is wrong because an Access Control List script only controls record-level read/write/delete access and cannot perform business logic updates on related records. Option C is wrong because a Dictionary Client Script runs on the client side and cannot reliably update multiple related incident records, especially in bulk, and is not designed for cross-table operations. Option D is wrong because a Client Script on the Problem form with synchronous GlideRecord loops runs in the browser, causing performance degradation, potential timeouts, and is not suitable for batch updates across many records.

Practice this question →
27
Multi-Selecthard

An enterprise is auditing its ServiceNow instance for ITIL compliance in Problem Management. Which TWO core metrics or practices are typically evaluated to measure Problem Management effectiveness? (Choose two.)

Select 2 answers
A.Reduction in recurring incidents linked to known problems
B.Total number of printer toner cartridges ordered annually
C.Percentage of known errors documented with workarounds in the KEDB
D.Average employee commute distance
E.Frequency of firewall firmware updates
AnswersA, C

Problem Management effectiveness is measured by tracking how many recurring incidents are eliminated once a known error's root cause is fixed. A falling count of incidents tied to known problems demonstrates that permanent resolutions are working, satisfying the stem's audit criterion.

Why this answer

Option A is correct because a primary measure of Problem Management effectiveness is the reduction in recurring incidents tied to known problems, demonstrating that root cause analysis and permanent fixes are working. Option C is correct because documenting known errors with workarounds in the Known Error Database (KEDB) is a core ITIL practice that directly supports faster incident resolution and is measured as a percentage of known errors properly recorded. Options B, D, and E are incorrect because toner cartridge ordering, employee commute distance, and firewall firmware update frequency are unrelated to Problem Management metrics and do not reflect ITIL Problem Management practices.

Exam trap

CIS-ITSM often tests whether candidates can distinguish Problem Management metrics from Incident, Change, or Asset Management metrics — the trap is picking a plausible-sounding operational metric that belongs to another practice.

Practice this question →
28
MCQeasy

What is the primary purpose of the 'Description' field on a Problem record?

A.To hold the XML payload of inbound emails
B.To log the license key of the software
C.To provide a detailed explanation of the symptoms and issue observed
D.To store the administrator's login credentials
AnswerC

The Description field captures the detailed symptoms and observed issue, giving resolvers the technical context needed to investigate the problem's root cause. This satisfies the stem's requirement for the field's primary purpose: documenting what was actually seen, distinct from workaround or resolution notes recorded elsewhere on the Problem record.

Why this answer

The 'Description' field on a Problem record is a free-text field used to capture a detailed explanation of the symptoms and the issue observed. It provides the problem analyst with the context needed to understand what is happening, when it started, and how it impacts users, forming the basis for investigation and root cause analysis.

Exam trap

CIS-ITSM often tests the distinction between Description (symptoms/issue) and other fields like Work notes (internal updates) or Additional comments (user-facing), so candidates who confuse these fields pick the wrong purpose.

How to eliminate wrong answers

Option A is wrong because XML payloads of inbound emails are stored in the email body or attachment fields (e.g., sys_email table), not in the Problem Description field. Option B is wrong because license keys are typically stored in CMDB configuration item records or a dedicated license management table, not in a problem's description. Option D is wrong because storing administrator credentials in any description field is a security violation and has no relation to the purpose of the Description field.

Practice this question →
29
MCQmedium

An analyst wants to search for problems that mention a specific error code in their description or workaround notes. Which ServiceNow search feature indexes and searches across all Problem records efficiently?

A.Global Text Search (Zing / AI Search)
B.Database Views builder
C.Metric Definition report generator
D.Data Archiving search query tool
AnswerA

Global Text Search (Zing / AI Search) indexes all indexed fields across Problem records, including description and workaround notes, so a single query returns matching problems without building explicit filters. This satisfies the requirement to search free-text error codes efficiently across the entire Problem table.

Why this answer

Global Text Search (backed by Zing in older releases and AI Search in newer ones) indexes searchable fields across all records, including Problem short descriptions, descriptions, and workaround notes, so an analyst can find records by keyword or error code without building a filtered list query. It is the platform's cross-table full-text search engine.

Exam trap

CIS-ITSM often tests the misconception that any list filter or report can 'search' free text — candidates pick Database Views or reports, missing that only Global Text Search / AI Search performs indexed full-text lookup across records.

How to eliminate wrong answers

Option B is wrong because Database Views builder creates joined, read-only views of multiple tables for reporting — it does not index or search free-text content. Option C is wrong because Metric Definition reports track numeric KPIs over time, not textual content in descriptions or work notes. Option D is wrong because Data Archiving moves aged records to archive tables; its query tool filters records for archival, it does not provide full-text search across live Problem records.

Practice this question →
30
Multi-Selecthard

An administrator is configuring UI Policies on the Problem table to streamline user entry. Which TWO properties or configurations can a UI Policy modify on form fields without scripting? (Choose two.)

Select 2 answers
A.Instance IP address binding
B.Java runtime memory allocation
C.Underlying database table schema definition
D.Visible state (showing or hiding fields/sections)
E.Mandatory state (making fields mandatory or optional)
AnswersD, E

UI policies manage field and section visibility.

Why this answer

UI Policies in ServiceNow are declarative, no-script configurations that control form field behavior, and option D (Visible state) is correct because a UI Policy can show or hide fields and sections on the form based on conditions, using the 'Visible' field setting. Option E (Mandatory state) is also correct because a UI Policy can make fields mandatory or optional via the 'Mandatory' field setting, again without any client script. Options A (Instance IP address binding), B (Java runtime memory allocation), and C (Underlying database table schema definition) are incorrect because these are infrastructure, platform, or schema-level concerns handled outside UI Policies — IP binding and JVM memory are system/instance configuration, and table schema is defined in the data dictionary, not on a form UI Policy.

Exam trap

CIS-ITSM often tests the capabilities of UI Policies versus Client Scripts; candidates may think UI Policies can set field values or perform complex logic, but they are limited to visible, mandatory, and read-only states (and sometimes field values via UI Policy Actions, but that is a separate action type).

Practice this question →
31
MCQhard

A company wants to implement a multi-stage approval for Problem records where the total estimated financial impact exceeds $10,000. Which ServiceNow feature should be used to orchestrate this conditional approval routing?

A.A Client Script validation check
B.An Email Notification template
C.A Dictionary Override on the Approval field
D.Flow Designer with Approval activities and conditional branching based on financial impact
AnswerD

Flow Designer's conditional branching evaluates the financial impact field and routes the record through multi-stage Approval activities only when the $10,000 threshold is exceeded, satisfying the conditional routing constraint that a static approval workflow cannot handle.

Why this answer

Flow Designer supports conditional branching and Approval activities, allowing a flow to evaluate the estimated financial impact and route through multi-stage approvals only when the amount exceeds $10,000. This is the platform's orchestration tool for conditional, multi-step approval routing on Problem records.

Exam trap

CIS-ITSM often tests the misconception that notifications or client scripts can drive approvals — candidates pick Email Notifications, missing that only Flow Designer (or legacy Workflow) creates and manages approval records with conditional branching.

How to eliminate wrong answers

Option A is wrong because a Client Script runs in the browser for form validation and cannot orchestrate server-side approval workflows or multi-stage routing. Option B is wrong because an Email Notification only sends a message; it does not create approval records or manage approval state transitions. Option C is wrong because a Dictionary Override changes field labels, defaults, or reference qualifiers — it has no approval orchestration capability.

Practice this question →
32
MCQmedium

An administrator is tasked with ensuring that Problem records cannot be deleted by anyone except users with the 'admin' role. Where should this security rule be configured?

A.A Before Delete Business Rule on the Task table
B.A delete Access Control List (ACL) on the Problem table
C.Problem Administration Properties
D.Dictionary Overrides for the sys_id field
AnswerB

A delete ACL on the Problem table restricts the delete operation to records matching the condition, so only users holding the admin role can remove them. Table-level ACLs apply before record access, enforcing the requirement centrally.

Why this answer

A delete ACL on the Problem table is the correct place to enforce that only users with the 'admin' role can delete problem records. ACLs in ServiceNow control record-level and field-level access for read, write, create, and delete operations, and a delete ACL specifically governs who can delete records. Configuring the ACL with a role condition of 'admin' ensures only admins can perform the delete operation.

Exam trap

CIS-ITSM often tests whether candidates know that ACLs are the correct mechanism for access control — candidates incorrectly pick Business Rules or UI Policies, which enforce logic or UI behavior but not security.

How to eliminate wrong answers

Option A is wrong because a Before Delete Business Rule on the Task table would affect all task types (incidents, changes, problems, etc.) and is not the proper security mechanism — Business Rules enforce logic, not access control, and should not be used for role-based deletion restrictions. Option C is wrong because Problem Administration Properties do not include a setting for restricting deletion by role — properties control behavior like state transitions or mandatory fields, not ACL-level security. Option D is wrong because Dictionary Overrides for the sys_id field control field-level behavior (like default values or attributes) and have no bearing on delete permissions.

Practice this question →
33
MCQhard

An organization uses Domain Separation in ServiceNow. Problem records must be segregated by region. Where must an administrator verify domain separation configurations to ensure proper record visibility and visibility rules for Problem tasks?

A.System Security > Access Control Lists exclusively
B.Table dictionary attributes ensuring 'no_domain' is disabled and domain pathing is active on problem and problem_task
C.System Definition > Tables for problem and problem_task with Domain separation set to 'Edge'
D.Service Portal > Pages configuration
AnswerB

Domain separation depends on the table's dictionary attributes: the 'no_domain' flag must be disabled and domain pathing active so records inherit the correct domain. Verifying these on problem and problem_task ensures visibility rules segregate records by region correctly.

Why this answer

For Domain Separation to work on Problem and Problem Task, the tables must be domain-separated: the 'no_domain' dictionary attribute must be disabled (so records carry a domain) and domain pathing must be active. Administrators verify these dictionary attributes on the problem and problem_task tables to ensure records are segregated and visibility rules apply.

Exam trap

CIS-ITSM often tests the belief that ACLs alone provide domain separation — candidates pick ACL-only answers, missing that domain stamping and pathing on the table dictionary are the foundational controls.

How to eliminate wrong answers

Option A is wrong because ACLs alone do not implement domain separation; domain visibility is enforced by the domain field and domain pathing, with ACLs as a supplementary layer. Option C is wrong because there is no 'Edge' domain separation setting on tables — domain separation is enabled via the 'Domain Separated' table attribute and the no_domain dictionary attribute, not an 'Edge' value. Option D is wrong because Service Portal page configuration controls UI layout, not record-level domain segregation or visibility rules.

Practice this question →
34
MCQeasy

What is the primary benefit of linking multiple recurring Incidents to a single Problem record?

A.It allows tracking the underlying root cause and enables bulk updates or closure once resolved
B.It converts all linked incidents into emergency change requests
C.It bypasses the need for Service Level Agreements on the incidents
D.It automatically increases the user satisfaction score (CSAT) for all affected callers
AnswerA

Linking many recurring Incidents to one Problem record consolidates their symptoms under a single root-cause investigation. This satisfies the stem's need for a primary benefit: analysts avoid duplicated diagnosis, and resolving the Problem lets them bulk-update or close all associated Incidents together.

Why this answer

Linking multiple recurring incidents to a single problem record allows the organization to track the underlying root cause across all affected incidents and, once the problem is resolved, perform bulk updates or closure on the linked incidents. This consolidation prevents duplicate investigation efforts and ensures all related incidents are addressed when the permanent fix is deployed. It is the core value of the problem-incident relationship in ITIL.

Exam trap

CIS-ITSM often tests the purpose of the problem-incident relationship — candidates incorrectly assume linking triggers automatic changes (like SLA bypass or change creation) when it only provides association and bulk-update capability.

How to eliminate wrong answers

Option B is wrong because linking incidents to a problem does not convert them into emergency change requests — change requests are separate records created through Change Management, and linking does not trigger that conversion. Option C is wrong because linking incidents to a problem does not bypass SLAs — SLAs continue to apply to the incidents independently, and linking has no effect on SLA clocks or compliance. Option D is wrong because linking incidents to a problem does not automatically increase CSAT scores — CSAT is based on user survey responses, and linking has no direct impact on survey results.

Practice this question →
35
MCQhard

A company uses ServiceNow Domain Separation. A global Problem record needs to be visible across child domains while allowing child domains to create local problem tasks. How should domain scoping be configured on the Problem Task table?

A.Ensure domain visibility and reference cascading are configured properly for parent-child domain hierarchies
B.Disable domain separation entirely on the task table
C.Create duplicate problem records in every child domain manually
D.Use Access Control Lists with domain bypass scripts
AnswerA

Problem Task sits below Problem in the domain hierarchy, so enabling domain visibility and reference cascading lets a global Problem be seen across child domains while child domains still create their own local tasks. This satisfies both the global visibility and local task creation constraints.

Why this answer

For a global Problem record to be visible across child domains while allowing child domains to create local Problem Tasks, the Problem Task table must have proper domain visibility and reference cascading configured for the parent-child domain hierarchy. This ensures the global problem is readable in child domains and that tasks created in a child domain inherit the correct domain.

Exam trap

CIS-ITSM often tests domain separation by offering 'disable it' or 'duplicate records' as shortcuts — candidates pick these instead of understanding that visibility and reference cascading must be configured on the table for parent-child hierarchies.

How to eliminate wrong answers

Option B is wrong because disabling domain separation on the task table breaks the domain model and can expose data across domains inappropriately. Option C is wrong because manually duplicating problem records in every child domain creates data redundancy, breaks the single global record, and defeats the purpose of domain separation. Option D is wrong because ACLs with domain bypass scripts are a security anti-pattern that circumvents the domain model rather than configuring it correctly.

Practice this question →
36
MCQhard

A company implements proactive Problem Management. They want to automatically generate a Problem record when more than 5 incidents with the exact same Configuration Item and Category are logged within a 2-hour window. Which ServiceNow feature should be configured to achieve this automation?

A.A Dictionary Data Policy
B.An Email Notification template
C.Flow Designer with a scheduled trigger or table trigger combined with aggregate queries
D.A UI Action script
AnswerC

Flow Designer supports table triggers and scheduled triggers, and can run aggregate queries against the Incident table. Grouping by Configuration Item and Category over a two-hour window lets it detect the threshold of five matching incidents and automatically create the Problem record.

Why this answer

Flow Designer can be configured with a scheduled trigger that runs periodically (for example, every 15 minutes) and uses an aggregate query (via a Look Up Records or custom action) to count incidents matching the same CI and Category within a 2-hour window. If the count exceeds 5, the flow creates a Problem record. This is the native, low-code automation approach for proactive problem management.

Exam trap

CIS-ITSM often tests whether candidates know that proactive problem creation requires aggregation over time, which rules out simple table triggers or client-side scripts — the trap is picking a UI Action or Data Policy because it sounds like automation.

How to eliminate wrong answers

Option A is wrong because a Dictionary Data Policy enforces field-level validation or defaulting on a table — it cannot aggregate incidents over a time window or create Problem records. Option B is wrong because an Email Notification template only formats and sends email; it has no logic to query incidents or create problems. Option D is wrong because a UI Action script runs only when a user clicks a button on a form, so it cannot run automatically on a schedule or in response to incident creation.

Practice this question →
37
MCQeasy

An ITIL process owner wants to review the effectiveness of problem resolution by analyzing how often problems are reopened after being closed. Which field on the Problem record should be used to track the number of times a problem has been reopened?

A.Resolution count
B.Problem state changes
C.Reassignment count
D.Reopen count
AnswerD

The 'Reopen count' field on the Problem record increments each time a problem is reopened after being closed. This provides a direct metric for how often problems are not fully resolved. The field is automatically updated by the system when the state changes from Closed to an active state, making it the correct choice for tracking reopen frequency.

Why this answer

The 'Reopen count' field is a standard field on the Problem table that automatically increments each time a problem is reopened. It is the correct metric to analyze how often problems are not permanently fixed. Other fields like reassignment count do not capture reopen events.

Exam trap

The trap here is assuming that reassignment count or state change history indicates reopens, when the explicit 'Reopen count' field is the correct one.

Practice this question →
38
Multi-Selectmedium

A problem manager is configuring the Problem Management process and needs to define how known errors are managed. Which TWO statements accurately describe the 'Known Error' functionality in ServiceNow ITSM? (Choose two.)

Select 2 answers
A.A known error is a problem that has a documented root cause and a workaround.
B.A known error record automatically closes the associated problem record.
C.The Known Error Database (KEDB) is a repository that stores known errors and their workarounds.
D.Known errors can be created directly from an incident record without an associated problem.
E.Known errors are only accessible to users with the problem_manager role.
AnswersA, C

In ITIL and ServiceNow, a known error represents a problem where the root cause is identified and a workaround is available. This allows IT to provide temporary solutions to users while a permanent fix is developed. The known error record is typically created from a problem and includes details of the root cause and workaround, making this statement accurate.

Why this answer

A known error is a problem with a documented root cause and workaround, and the KEDB is the repository for these records. These two statements correctly describe the functionality. Known errors are not created directly from incidents, do not auto-close problems, and are accessible to multiple roles for effective incident resolution.

Exam trap

The trap here is assuming that known errors can be created from incidents or that they automatically close problems, when they are derived from problems and remain open until a permanent fix.

Practice this question →
39
MCQhard

A Problem record is associated with a Change Request via the 'Caused by change' field. When the Change Request is cancelled, a stakeholder wants the linked Problem record to automatically transition back to the 'Assess' state and notify the problem assignee. How should this be configured?

A.A Data Lookup definition on the task table
B.A Business Rule on the Change Request table that evaluates state changes and updates linked Problem records
C.A Client Script on the Problem table checking parent change status
D.A UI Policy on the Change form
AnswerB

A Business Rule on the Change Request table fires on state changes, so when the change is cancelled it can query and update the linked Problem records, setting state to Assess and triggering notification to the assignee. This automates the cross-table transition the stakeholder requires.

Why this answer

A Business Rule on the Change Request table is the correct mechanism because it runs server-side on state changes and can query and update related Problem records. This ensures the transition to Assess and the notification to the problem assignee happen automatically when the change is cancelled.

Exam trap

The trap is choosing a client-side or presentation-layer control (Client Script or UI Policy) for a server-side automation requirement; ServiceNow exams expect candidates to match the mechanism to the execution context and the need to update related records.

How to eliminate wrong answers

Option A is wrong because a Data Lookup definition maps data between tables for display or reference; it does not execute logic or trigger state transitions. Option C is wrong because a Client Script runs in the browser and cannot reliably update related records or fire notifications on the server. Option D is wrong because a UI Policy only controls field visibility, mandatory, and read-only behavior on the form; it cannot transition a Problem record or send notifications.

Practice this question →
40
MCQmedium

An IT manager wants to report on the average time it takes problems to move from the 'Assess' state to 'Root Cause Analysis'. Which reporting feature in ServiceNow should be used to track this stage duration?

A.Data Archiving rules
B.Sys_audit table queries in standard List View
C.Metric Definitions / Metric Instance table
D.Service Level Agreements (SLAs) on the incident table
AnswerC

Metric Definitions create Metric Instances that record the duration a record spends in each state, such as Assess to Root Cause Analysis. This satisfies the stem's need to report average stage duration, which standard field-based reporting on the Problem table cannot calculate.

Why this answer

Metric Definitions and the Metric Instance table are designed to track duration and state transition timing on records, making them the correct feature for measuring how long problems spend in a specific state such as 'Assess' to 'Root Cause Analysis.' Metric Definitions define what to measure (e.g., time in state), and Metric Instances store the calculated values per record. This is the standard ServiceNow mechanism for stage duration reporting.

Exam trap

CIS-ITSM often tests the difference between SLAs (external service commitments on incidents) and Metrics (internal duration/state tracking) — candidates incorrectly pick SLAs for measuring internal problem stage durations.

How to eliminate wrong answers

Option A is wrong because Data Archiving rules move old records to archive tables to manage database size — they have nothing to do with measuring stage durations. Option B is wrong because querying the sys_audit table in a standard List View shows field-level change history but does not provide aggregated duration metrics or a reporting-friendly structure for stage timing. Option C is correct.

Option D is wrong because SLAs on the incident table measure service level compliance (response/resolution targets) on incidents, not problem state transition durations — SLAs are not designed for internal problem lifecycle stage measurement.

Practice this question →
41
MCQeasy

What is the primary function of the 'Workarounds' field on a Problem record?

A.To document temporary solutions that can be shared with service desk agents to resolve related incidents
B.To log the exact times the server experienced packet loss
C.To store the final approved code for software deployment
D.To record the financial cost of the problem
AnswerA

The Workarounds field holds temporary mitigations that restore service without resolving the underlying root cause, letting service desk agents apply them to related incidents while permanent problem resolution proceeds. This matches the stem's requirement to document temporary solutions shared with agents for resolving linked incidents.

Why this answer

The 'Workarounds' field on a Problem record is specifically designed to capture temporary fixes or alternative solutions that can be used to restore service or resolve incidents while the underlying root cause is still being investigated. These workarounds are often shared with service desk agents to help them quickly resolve related incidents, reducing downtime and improving user productivity. This aligns with ITIL's Problem Management practice, where workarounds are a key output of problem investigation and are documented for reuse.

Exam trap

CIS-ITSM often tests the distinction between temporary workarounds and permanent fixes, so candidates must remember that the Workarounds field is for interim solutions, not final resolutions or unrelated data.

How to eliminate wrong answers

Option B is wrong because logging exact times of server packet loss is a monitoring or event management activity, not the purpose of the Workarounds field; such data would typically be recorded in incident or event records, not as a workaround. Option C is wrong because storing final approved code for software deployment is a release and deployment management function, not a workaround; workarounds are temporary and not necessarily code-based. Option D is wrong because recording the financial cost of a problem is related to cost tracking or financial management, not workarounds; workarounds focus on technical or procedural solutions, not cost accounting.

Practice this question →
42
MCQeasy

Which action should a problem coordinator take when a permanent fix has been successfully deployed and verified?

A.Change the priority to 1 - Critical
B.Delete the problem record immediately to save database storage
C.Transition the Problem state to Resolved / Closed
D.Reassign the problem to the Service Desk as a new incident
AnswerC

Once the permanent fix is deployed and verified, the Problem no longer requires investigation, so its state moves to Resolved and then Closed. This satisfies the stem's condition that the fix has been successfully deployed and verified.

Why this answer

When a permanent fix has been deployed and verified, the problem coordinator should transition the Problem record to Resolved, and then typically to Closed after a verification period. This reflects that the root cause has been eliminated and no further investigation is needed, while preserving the record for audit and knowledge management.

Exam trap

CIS-ITSM often tests whether candidates know that problem records are transitioned to Resolved/Closed rather than deleted or converted, so options implying record destruction or incident reassignment are the trap.

How to eliminate wrong answers

Option A is wrong because changing priority to Critical is unrelated to fix completion — priority reflects business impact and urgency, not lifecycle state, and escalating priority after resolution is nonsensical. Option B is wrong because deleting the problem record destroys the audit trail and the knowledge gained from root cause analysis, violating ITIL knowledge management practices; problems are closed, not deleted. Option D is wrong because reassigning the problem as a new incident confuses the two record types — incidents are unplanned interruptions, while problems are the underlying causes; converting a resolved problem into an incident would duplicate work and corrupt reporting.

Practice this question →
43
Multi-Selecthard

A problem manager needs to ensure that when a problem is closed, the resolution information is captured and can be reused for future incidents. Which TWO actions should be taken to meet this requirement? (Choose two.)

Select 2 answers
A.Attach the original incident records to the problem record.
B.Enable the 'Known error' field on the problem record.
C.Require the 'Resolution code' and 'Resolution notes' fields to be filled before the problem can be closed.
D.Create a knowledge article from the problem record upon closure.
E.Set the problem state to 'Closed' automatically after 7 days of inactivity.
AnswersC, D

Mandating resolution code and notes ensures that the root cause and fix are documented. This information is essential for building the Known Error Database (KEDB) and for future reference. Without these fields, the resolution would be lost, and the problem record would lack the details needed to help resolve similar incidents quickly.

Why this answer

To capture resolution information for future reuse, the problem record must enforce documentation of resolution details and ideally convert that into a knowledge article. Requiring resolution code and notes ensures the data is entered, while creating a knowledge article makes it accessible to support staff. Together, these actions populate the KEDB and enable faster incident resolution.

Exam trap

The trap here is assuming that simply marking a problem as a known error or attaching incidents automatically captures resolution details; the actual capture requires mandatory fields and knowledge creation.

Practice this question →
44
MCQmedium

An organization wants to ensure that when a Problem record is created, its priority is automatically calculated based on Impact and Urgency using a data lookup matrix. Which ServiceNow feature provides this capability?

A.Client Script onLoad calculation
B.Data Lookup Definitions and Matchers
C.Dictionary Overrides for Priority
D.UI Policy Action matrix
AnswerB

Data Lookup Definitions and Matchers let ServiceNow derive a field value, such as Problem priority, by matching Impact and Urgency against a configured matrix table. This directly satisfies the requirement for automatic priority calculation on Problem record creation.

Why this answer

Data Lookup Definitions and Matchers in ServiceNow allow administrators to define a matrix that maps input values (Impact and Urgency) to an output value (Priority). This is the standard feature for automatically calculating Priority based on a lookup table, and it is commonly used in Problem, Incident, and Change Management. The lookup executes on the server side when the record is created or updated, ensuring consistent priority assignment.

Exam trap

CIS-ITSM often tests the difference between client-side scripts, UI policies, and server-side data lookups, luring candidates into choosing UI-centric options when the requirement is for a server-side matrix calculation.

How to eliminate wrong answers

Option A is wrong because a Client Script onLoad runs in the browser when a form loads and is not suited for server-side, matrix-based priority calculation; it also cannot easily reference a data lookup matrix. Option C is wrong because Dictionary Overrides change field behavior (e.g., making a field mandatory or read-only) but do not perform value lookups or calculations. Option D is wrong because a UI Policy Action matrix controls field visibility or mandatory state on the form, not the calculation of field values like Priority.

Practice this question →
45
MCQeasy

Which module allows problem managers to review unassigned problems that require triage and assignment?

A.Closed Problems
B.Known Errors
C.My Work
D.Open - Unassigned
AnswerD

The Open - Unassigned module filters problems that are open yet have no assigned owner, giving problem managers the triage queue they need. It directly satisfies the requirement to review unassigned problems awaiting triage and assignment, unlike assigned or closed views.

Why this answer

The 'Open - Unassigned' module in ServiceNow Problem Management is a default list view that filters problems with a state of Open and no assigned user, specifically designed for problem managers to perform triage and assign resources. It provides a centralized queue of new or unassigned problems that require immediate attention. This module is part of the standard Problem Management application and is essential for managing the problem lifecycle.

Exam trap

CIS-ITSM often tests the distinction between modules that show unassigned problems versus those that show assigned or closed problems, so candidates must remember that 'Open - Unassigned' is specifically for triage.

How to eliminate wrong answers

Option A is wrong because 'Closed Problems' displays problems that have been resolved and closed, not those needing triage. Option B is wrong because 'Known Errors' lists problems that have a known root cause and workaround, typically after analysis, not unassigned ones. Option C is wrong because 'My Work' shows records assigned to the current user, not unassigned problems.

Practice this question →
46
MCQmedium

A problem manager notices that many problem records are created from incident records but the link between the incident and the problem is not automatically established. The manager wants to ensure that whenever an incident is promoted to a problem, the incident is automatically associated with the new problem record. Which action should be taken?

A.Use the 'Promote to Problem' UI action on the Incident form.
B.Enable the 'Create Problem from Incident' UI action.
C.Configure the 'Problem' related list on the Incident form to auto-populate.
D.Create a business rule that inserts a problem record and updates the incident's problem field.
AnswerA

The 'Promote to Problem' UI action on the Incident form creates a new problem record and automatically associates the incident with it. This action is designed to streamline the process by copying relevant incident details and establishing the link. It ensures that the incident is directly tied to the problem, fulfilling the manager's requirement without manual intervention.

Why this answer

The 'Promote to Problem' UI action is the standard ServiceNow feature that creates a problem from an incident and automatically links the two records. It copies key fields and establishes the relationship, ensuring traceability. Custom solutions or manual actions are not required and may not provide the same seamless integration.

Exam trap

The trap here is assuming that any UI action or related list automatically creates the link, when only the specific 'Promote to Problem' UI action does so.

Practice this question →
47
MCQeasy

Which state indicates that a Problem has completed root cause analysis and investigation, and a fix is currently being implemented via Change Management?

A.Closed
B.Root Cause Analysis
C.Fix In Progress
D.Assess
AnswerC

Fix In Progress is the Problem state recorded once root cause analysis and investigation are complete and a Change is actively implementing the remediation. It satisfies the stem's condition that a fix is currently being deployed through Change Management.

Why this answer

The 'Fix In Progress' state in Problem Management indicates that root cause analysis is complete and a fix is being implemented, typically through a Change request. This state bridges Problem and Change Management, ensuring the fix is tracked and applied. It is the correct state when a fix is actively being deployed.

Exam trap

CIS-ITSM often tests the distinction between 'Root Cause Analysis' and 'Fix in Progress', causing candidates to select the former when a fix is already being implemented.

How to eliminate wrong answers

Option A is wrong because 'Closed' means the problem is resolved and no further action is needed. Option B is wrong because 'Root Cause Analysis' is the state where investigation is ongoing, not yet complete. Option D is wrong because 'Assess' is an early state for evaluating the problem, before root cause analysis.

Practice this question →
48
MCQhard

A Problem task is assigned to a vendor group. The vendor updates the task via an inbound email action. The administrator wants to ensure that the inbound email sender is validated against the vendor company record before updating the task. Where should this validation be implemented?

A.In a Client Script running on the Email form
B.In the Dictionary entry for email body
C.In the script of the Inbound Email Action record
D.In a UI Policy Action
AnswerC

The Inbound Email Action script executes before the record update, giving access to the sender address and the ability to query the vendor company record. Validating there blocks unauthorised senders from modifying the task, satisfying the stem's requirement to check the sender against the vendor company.

Why this answer

Inbound Email Actions in ServiceNow contain a script field where you can inspect the sender (email.from) and validate it against the vendor company record before allowing the task update. This is the correct place because the Inbound Email Action is the processing logic that runs when the email is received and decides whether to update the target record.

Exam trap

CIS-ITSM often tests the misconception that client-side or dictionary-level logic can validate inbound email senders, when only the server-side Inbound Email Action script executes during email processing.

How to eliminate wrong answers

Option A is wrong because Client Scripts run in the browser on form load/change and cannot execute during server-side inbound email processing. Option B is wrong because a Dictionary entry defines field attributes (type, default, etc.) and cannot contain validation logic for email senders. Option D is wrong because UI Policies control form field visibility/read-only behavior in the UI and have no role in inbound email processing.

Practice this question →
49
Multi-Selectmedium

Which THREE fields on a Problem record are typically editable when the problem is in the 'Assess' state, prior to root cause analysis? (Choose three.)

Select 3 answers
A.Short description
B.Assignment group
C.Sys_created_on timestamp
D.Configuration item
E.System sys_id (read-only system identifier)
AnswersA, B, D

Short description remains editable during 'Assess' because it captures the reported symptom, which staff refine as understanding grows. Root cause analysis has not begun, so this descriptive field is not yet locked by the later 'Root Cause Analysis' state's mandatory-field and read-only constraints.

Why this answer

In the 'Assess' state of a Problem record, the team is still triaging and scoping the issue before formal root cause analysis begins, so the Short description (A) remains editable to refine the problem statement as understanding improves. The Assignment group (B) is also editable because ownership often shifts during assessment as the problem is routed to the correct resolver group. The Configuration item (D) is editable as well, since identifying or correcting the affected CI is part of the assessment and scoping work.

The Sys_created_on timestamp (C) is a system-maintained audit field set at record creation and is never user-editable, and the sys_id (E) is a read-only unique system identifier that cannot be modified.

Exam trap

The trap is assuming that state transitions lock all fields — candidates may think Assess is read-only, or fail to recognize that sys_created_on and sys_id are system fields that are never editable regardless of state.

Practice this question →
50
MCQhard

A team uses Problem Tasks to divide root cause investigations. A requirement states that a Problem record cannot be moved to 'Fix In Progress' until all child Problem Tasks are in either 'Closed Complete' or 'Closed Skipped' state. How should an administrator configure this validation?

A.An Access Control List (ACL) with script execution
B.A Before Update Business Rule on the Problem table checking active child task counts
C.A Dictionary Override on the State field
D.A UI Policy with an advanced script condition
AnswerB

A server-side Before Business Rule can query related problem tasks and abort the transaction if open tasks exist.

Why this answer

A Before Update Business Rule on the Problem table is the correct approach because it can query the child Problem Tasks via the task relationship and block the state transition when any task is not in 'Closed Complete' or 'Closed Skipped'. Business Rules execute server-side on the database operation, so they enforce the rule regardless of whether the update comes from the UI, an import, or a REST API call. The script can use GlideAggregate to count active child tasks and call current.setAbortAction(true) with a message when the count is greater than zero.

Exam trap

CIS-ITSM often tests whether candidates confuse client-side UI Policies with server-side Business Rules — the trap is picking a UI Policy because it 'looks' like it enforces mandatory behavior, when only a Business Rule can block a database update from any source.

How to eliminate wrong answers

Option A is wrong because an ACL controls field/record read, write, create, and delete access — it cannot evaluate child task states or conditionally block a state transition based on related records. Option C is wrong because a Dictionary Override only changes which field or value is used when the same field name exists on parent and child tables; it has no logic for validating related task states. Option D is wrong because a UI Policy only affects the client-side form (making fields mandatory, read-only, or visible) and is bypassed by background updates, imports, and API calls, so it cannot reliably enforce a state-transition rule.

Practice this question →
51
MCQeasy

Which user role is required by default to create, manage, and close Problem records in ServiceNow?

A.change_manager
B.itil
C.problem
D.major_incident_manager
AnswerC

The "problem" role grants the baseline permissions needed to create, manage, and close Problem records in ServiceNow. Unlike itil, which covers broader incident and change tasks, this dedicated role satisfies the stem's default requirement for full Problem lifecycle management without relying on elevated admin rights.

Why this answer

The 'problem' role is specifically designed for managing Problem records in ServiceNow. It grants the necessary permissions to create, read, update, and delete problem records. This role is typically assigned to problem managers and problem coordinators.

Exam trap

CIS-ITSM often tests the specific roles required for problem management, and candidates may confuse the 'itil' role with the 'problem' role, not realizing that 'itil' does not grant full problem management capabilities.

How to eliminate wrong answers

Option A is wrong because change_manager is for managing change records, not problems. Option B is wrong because itil is a broad role that includes many ITIL processes but does not specifically grant full problem management rights; it may allow reading and some updates but not full management. Option D is wrong because major_incident_manager is for managing major incidents, not problems.

Practice this question →
52
MCQmedium

An administrator wants to add a custom field called 'Root Cause Category' to the Problem table. What is the recommended best practice for naming the column name in ServiceNow?

A.It must match an existing incident table column exactly
B.It must contain uppercase spaces for readability
C.It must start with 'sys_' to ensure system privileges
D.The system automatically prefixes custom fields with 'u_' (e.g., u_root_cause_category)
AnswerD

ServiceNow automatically applies the 'u_' prefix to any custom field created on a table, ensuring it never collides with reserved out-of-box column names during upgrades. This satisfies the stem's best-practice requirement: administrators should not manually add prefixes, as the platform enforces this convention automatically.

Why this answer

ServiceNow automatically prefixes custom fields created on any table with 'u_' to distinguish them from out-of-box (OOB) system fields. This convention prevents naming collisions with future platform upgrades and makes it easy to identify customizations during cloning or upgrade reviews. So a custom field named 'Root Cause Category' becomes 'u_root_cause_category' on the Problem table.

Exam trap

CIS-ITSM often tests the 'u_' prefix convention — candidates mistakenly think they must manually add the prefix, or they confuse the column name with the field label and pick an option about spaces or uppercase.

How to eliminate wrong answers

Option A is wrong because custom fields do not need to match any existing Incident column; field names are scoped per table and matching an Incident column would create confusion, not a best practice. Option B is wrong because ServiceNow column names must be lowercase with underscores — uppercase letters and spaces are not valid in the database column name (the label can have spaces, but the column name cannot). Option C is wrong because the 'sys_' prefix is reserved for ServiceNow's own system tables and fields; using it for custom fields would conflict with platform internals and is explicitly discouraged.

Practice this question →
53
MCQeasy

When managing known errors, what is the primary purpose of a Known Error Article in ServiceNow Problem Management?

A.To permanently close all related Incidents without user confirmation
B.To communicate workarounds and symptoms to support staff for faster incident resolution
C.To automatically deploy software patches to affected configuration items
D.To replace the need for creating a Root Cause Analysis document
AnswerB

A Known Error Article records the root cause, symptoms and available workaround, letting service desk staff resolve incidents quickly without rediscovering the fault. It satisfies the scenario's need to communicate workarounds and symptoms to support staff, reducing mean time to restore while permanent remediation continues.

Why this answer

A Known Error Article is a knowledge base record created from a Problem that documents the confirmed root cause (or known cause) and any available workaround. Its primary purpose is to surface that information to support agents so they can apply the workaround to related incidents, reducing resolution time while the permanent fix is being developed. It does not close incidents, deploy patches, or replace the RCA — it is a knowledge-sharing artifact tied to the Problem record.

Exam trap

CIS-ITSM often tests the distinction between the Known Error Article (knowledge/workaround communication) and the Change Request (fix deployment), so candidates who conflate 'documenting the fix' with 'applying the fix' pick the patch-deployment distractor.

How to eliminate wrong answers

Option A is wrong because Known Error Articles are informational knowledge records; they have no mechanism to close incidents, and incident closure always requires user confirmation or a defined resolution workflow. Option C is wrong because deploying patches is the job of Change Management (via change tasks and orchestration), not a knowledge article — a Known Error Article only documents the fix, it does not execute it. Option D is wrong because the Root Cause Analysis document captures the investigation findings and is a separate deliverable; the Known Error Article complements the RCA by publishing workarounds and symptoms, it does not replace it.

Practice this question →
54
MCQmedium

An administrator wants to configure SLA definitions specifically for Problem Management. Where should the SLA definition be targeted so it only applies to Problem records?

A.By writing a Client Script on the Incident table
B.In the Problem Properties module
C.By selecting 'Problem [problem]' in the Table field of the SLA Definition record
D.Via Dictionary Overrides on the Task SLA table
AnswerC

Targeting the SLA Definition at the Problem [problem] table scopes the SLA to Problem records only, so the engine evaluates conditions solely against that table rather than Incident or Task. This satisfies the stem's requirement that the definition apply exclusively to Problem Management.

Why this answer

SLA Definitions in ServiceNow are stored in the 'contract_sla' table and include a 'Table' field that determines which task type the SLA applies to. Selecting 'Problem [problem]' in that field scopes the SLA definition exclusively to Problem records, so it will not fire on Incidents, Changes, or other task types. This is the standard, out-of-the-box way to target SLAs at a specific table.

Exam trap

CIS-ITSM often tests the misconception that SLAs are scoped via properties, client scripts, or dictionary overrides, when the actual scoping field is the 'Table' field on the SLA Definition record itself.

How to eliminate wrong answers

Option A is wrong because client scripts run in the browser and cannot create or scope SLA definitions — SLAs are server-side records evaluated by the SLA engine. Option B is wrong because there is no 'Problem Properties' module that controls SLA targeting; Problem properties govern behaviors like state transitions and notifications, not SLA scope. Option D is wrong because Dictionary Overrides change field labels, defaults, or mandatory status on a table — they do not control which table an SLA definition applies to.

Option C is correct because the Table field on the SLA Definition record is the native scoping mechanism.

Practice this question →
55
MCQeasy

What is the definition of a 'Known Error' in ITIL and ServiceNow Problem Management?

A.A software bug that has been successfully patched and deployed to production
B.An expired knowledge base article
C.An incident that has been rejected by the service desk three times
D.A problem that has a documented root cause and a temporary workaround, but no permanent fix yet
AnswerD

A Known Error requires both a documented root cause and a workaround, distinguishing it from an unresolved Problem. The stem asks for the ITIL definition, and this option supplies exactly those two elements while correctly noting the permanent fix is still outstanding.

Why this answer

A Known Error in ITIL and ServiceNow Problem Management is a problem whose root cause has been identified and documented, and for which a workaround exists, but a permanent fix has not yet been implemented. This state is reached after the problem investigation phase confirms the underlying cause. It is distinct from a resolved problem, which has a permanent fix applied.

Exam trap

CIS-ITSM often tests the distinction between a Known Error (root cause known, workaround available, no permanent fix) and a Resolved problem (permanent fix deployed), so candidates who conflate 'documented' with 'fixed' pick the patched-software option.

How to eliminate wrong answers

Option A is wrong because a patched and deployed bug describes a resolved/closed problem, not a Known Error — Known Errors specifically lack a permanent fix. Option B is wrong because an expired knowledge base article is a documentation lifecycle issue unrelated to the ITIL Known Error definition. Option C is wrong because incident rejection counts have no bearing on the Known Error classification; Known Error status depends on root cause identification and workaround availability, not service desk triage history.

Practice this question →
56
MCQhard

A customized Problem workflow utilizes legacy workflow engine. During testing, a workflow timer activity fails to resume after a server restart. What is the most likely cause related to workflow engine execution?

A.The browser cache needs clearing
B.The system scheduler (sys_trigger) or workflow event queue processing encountered an issue
C.The user session expired
D.The Problem form layout was modified
AnswerB

Timer activities depend on scheduled jobs recorded in sys_trigger; after a restart, the scheduler must resume those pending triggers. If sys_trigger processing or the workflow event queue stalls, the timer never fires, so the workflow cannot resume.

Why this answer

Legacy workflow timers in ServiceNow are driven by the system scheduler (sys_trigger) and the workflow event queue. If a timer activity fails to resume after a server restart, the most likely cause is that the scheduler or event queue processing was interrupted or not properly restored. This prevents the timer from firing and resuming the workflow.

Exam trap

CIS-ITSM often tests the misconception that workflow timers are client-side or session-dependent — candidates forget that timers rely on the server-side scheduler and event queue, which can be disrupted by restarts.

How to eliminate wrong answers

Option A is wrong because browser cache is a client-side issue and has no effect on server-side workflow timer execution. Option C is wrong because user session expiration does not stop a workflow timer; workflows run as system processes independent of user sessions. Option D is wrong because form layout changes are cosmetic and do not affect workflow engine execution or timer scheduling.

Practice this question →
57
MCQeasy

What is the purpose of the 'Outages' related list on a Problem record?

A.To record periods of service unavailability associated with the problem's impact
B.To schedule future maintenance windows
C.To log network printer connection drops
D.To track employee vacation schedules
AnswerA

The Outages related list stores distinct outage records, each capturing a period when a service was unavailable, and links them to the problem. This satisfies the stem's requirement to document service unavailability tied to the problem's impact, rather than incident or change data.

Why this answer

The 'Outages' related list on a Problem record in ServiceNow is specifically designed to capture and display periods of service unavailability that are linked to the problem. This allows IT teams to document when a service was down, correlate it with the problem's impact, and analyze the duration and frequency of outages. It is a key part of problem management, helping to assess the business impact and prioritize fixes.

Exam trap

CIS-ITSM often tests the distinction between related lists on Problem records, and candidates may confuse 'Outages' with 'Change Requests' or 'Incidents', assuming it's for scheduling maintenance or logging individual device issues rather than recording service unavailability periods.

How to eliminate wrong answers

Option B is wrong because scheduling future maintenance windows is typically handled through Change Management (e.g., change schedules or maintenance plans), not through the Outages related list on a Problem. Option C is wrong because logging network printer connection drops would be an incident or a specific monitoring alert, not a high-level outage record; the Outages list is for service-level unavailability, not individual device issues. Option D is wrong because tracking employee vacation schedules is an HR function, completely unrelated to IT service management or problem records.

Practice this question →
58
Multi-Selectmedium

Which THREE entities can be associated as 'Affected CIs' or related configuration items in ServiceNow ITSM problem handling? (Choose three.)

Select 3 answers
A.Hardware server
B.Personal grocery shopping list
C.Software application
D.Business service
E.Fictional movie character profile
AnswersA, C, D

Hardware servers exist as configuration items in the CMDB, so they can be linked to a problem record as affected CIs, identifying the physical infrastructure underlying the fault. This satisfies the stem's requirement that the entity be associable as an affected or related CI.

Why this answer

Option A (Hardware server) is correct because physical CIs such as servers are stored in the CMDB as Configuration Items and can be linked to a problem record as Affected CIs to show which infrastructure is impacted. Option C (Software application) is correct because applications are also CMDB configuration items and are commonly associated with problems to identify the affected software. Option D (Business service) is correct because business services are CMDB CIs that can be attached as Affected CIs, allowing problem managers to see the service-level impact of an issue.

Options B (Personal grocery shopping list) and E (Fictional movie character profile) are not valid configuration items in ServiceNow ITSM, since they are not CMDB records representing managed IT assets or services.

Exam trap

CIS-ITSM often tests the distinction between valid CMDB configuration items and arbitrary records, so candidates might mistakenly think any 'item' can be an affected CI, but only those defined in the CMDB as CI classes qualify.

Practice this question →
59
MCQeasy

What is the primary function of the 'Known Error Database' (KEDB) module in ServiceNow ITSM?

A.To store known problems and their documented workarounds for searching and incident deflection
B.To log hardware failures directly from network monitoring tools
C.To store employee training documentation for the service desk
D.To automatically approve change requests linked to problems
AnswerA

The KEDB stores known errors with their root causes and documented workarounds, letting service desk agents search existing entries and apply fixes without re-investigating. This directly satisfies the incident deflection requirement in the stem, reducing resolution time by surfacing proven workarounds for problems already diagnosed.

Why this answer

The Known Error Database (KEDB) in ServiceNow ITSM stores known problems and their documented workarounds, allowing service desk agents to quickly search for and apply workarounds to resolve incidents or deflect them. It is a repository of problem records that have been analyzed and have a root cause and workaround identified, often linked to incidents to provide immediate resolution guidance.

Exam trap

CIS-ITSM often tests the difference between the KEDB and the Knowledge Base; candidates may think the KEDB is a separate database, but it is essentially a subset of problem records with workarounds.

How to eliminate wrong answers

Option B is wrong because hardware failures from network monitoring tools are typically logged as incidents or alerts via event management, not stored in the KEDB. Option C is wrong because employee training documentation is stored in Knowledge Base articles or document repositories, not the KEDB. Option D is wrong because change request approvals are handled by change management workflows, not the KEDB; the KEDB does not automatically approve changes.

Practice this question →
60
MCQeasy

A service desk manager wants to identify which problems are currently being investigated by the network team. Which field on the Problem record should be used to filter the list view to show only those problems?

A.Assignment group
B.Problem state
C.Configuration item
D.Assigned to
AnswerA

The Assignment group field on a Problem record indicates the team responsible for working on the problem. Filtering by 'Assignment group = Network' will show all problems currently assigned to the network team for investigation. This is the standard way to segment problems by responsible group and is used in list views, reports, and dashboards to track team workloads.

Why this answer

To filter problems by the team investigating them, the Assignment group field is the correct choice. It specifies the group responsible for the problem, allowing managers to see all problems assigned to the network team. Other fields like Assigned to, Configuration item, or Problem state do not directly indicate the responsible team and would not provide the desired list.

Exam trap

The trap here is confusing the individual assignee with the team assignment; the 'Assigned to' field is for a person, while 'Assignment group' is for the team.

Practice this question →
61
MCQeasy

An ITIL practitioner needs to view the standard baseline workflow for Problem Management in ServiceNow. Which state comes immediately after the 'Assess' state in the baseline Problem lifecycle?

A.Resolved
B.Root Cause Analysis
C.Fix In Progress
D.Review
AnswerB

ServiceNow's baseline Problem Management lifecycle flows from Assess into Root Cause Analysis, where the problem is investigated to identify underlying causes. This precedes the Fix and Review states that follow once a cause is confirmed.

Why this answer

In the ServiceNow baseline Problem Management workflow, the state sequence is New → Assess → Root Cause Analysis → Fix in Progress → Resolved → Closed. Therefore, the state immediately after 'Assess' is 'Root Cause Analysis'. This reflects the ITIL problem lifecycle where assessment is followed by investigation to determine the root cause.

Exam trap

CIS-ITSM often tests the exact order of baseline Problem states, so candidates who assume 'Fix in Progress' follows 'Assess' (skipping RCA) or who confuse the Problem lifecycle with the Incident lifecycle pick the wrong state.

How to eliminate wrong answers

Option A is wrong because 'Resolved' comes much later in the lifecycle, after the fix has been implemented and verified — it cannot immediately follow 'Assess' because no root cause has been identified yet. Option C is wrong because 'Fix in Progress' comes after 'Root Cause Analysis', not immediately after 'Assess' — you must first identify the root cause before you can implement a fix. Option D is wrong because 'Review' is not a standard baseline state in the Problem lifecycle; the baseline states are New, Assess, Root Cause Analysis, Fix in Progress, Resolved, and Closed.

Practice this question →
62
MCQhard

A Problem Coordinator wants to create a Problem record from an existing Incident. By default, which UI Action on the Incident form initiates this relationship and populates related fields?

A.Associate to Problem
B.Create Major Incident
C.Create Problem
D.Promote to Problem
AnswerC

The Create Problem UI Action on the Incident form spawns a new Problem record and copies the Incident's details into related fields, establishing the default association. This is the out-of-box mechanism linking an Incident to Problem Management without manual re-entry.

Why this answer

The 'Create Problem' UI Action on the Incident form is the default action that creates a new Problem record and populates related fields such as the short description and links the originating incident. This establishes the Problem-Incident relationship out of the box. It is the standard mechanism a Problem Coordinator uses to initiate problem management from an incident.

Exam trap

CIS-ITSM often tests the exact UI Action name, catching candidates who confuse 'Create Problem' with 'Promote to Problem' or 'Associate to Problem'.

How to eliminate wrong answers

Option A is wrong because 'Associate to Problem' is not a default UI Action on the Incident form; association is typically done from the Problem side or via related lists, not as a creation action. Option B is wrong because 'Create Major Incident' promotes the incident to a major incident, which is an incident management escalation, not a problem creation action. Option D is wrong because 'Promote to Problem' is not the default UI Action name in ServiceNow; the base system uses 'Create Problem'.

Practice this question →
63
MCQhard

A company has a requirement that when a Problem is created from an incident, all attachments on the incident must be automatically copied over to the new Problem record. Which ServiceNow feature facilitates attachment copying between related tasks?

A.Knowledge Base attachment synchronization rules
B.UI Policy attachment actions
C.Sys_attachment glide utility methods triggered via Business Rule or script
D.Data Lookup definitions for binary streams
AnswerC

The sys_attachment GlideRecord API lets a script copy attachment records by re-pointing their table_sys_id to the new Problem, satisfying the requirement that all incident attachments transfer automatically. A Business Rule on Problem insert can invoke this, since ServiceNow stores attachments as records rather than embedded files.

Why this answer

ServiceNow does not provide a native declarative 'copy attachments' feature for related records; attachment copying must be scripted. The GlideSysAttachment API (e.g., copy() or write()) invoked from a Business Rule on the Incident-to-Problem creation event is the correct approach. This allows the script to read all attachments on the source incident and write them to the newly created problem record.

Exam trap

The trap here is assuming ServiceNow has a built-in declarative attachment-copy feature like it does for field values; candidates who haven't scripted attachments often pick UI Policy or Data Lookup options that sound plausible but cannot handle binary data.

How to eliminate wrong answers

Option A is wrong because Knowledge Base attachment synchronization rules govern KB article attachments, not task-to-task copying. Option B is wrong because UI Policies only manipulate form field behavior client-side and cannot move binary attachment data between records. Option D is wrong because Data Lookup definitions map reference field values, not binary attachment streams — there is no 'binary stream' lookup type in ServiceNow.

Practice this question →
64
MCQhard

A Problem record is linked to multiple incidents. When the Problem is resolved, a custom requirement dictates that an email notification must be sent to the callers of all associated active incidents. Which ServiceNow component is best suited to trigger this efficiently?

A.A Business Rule on the Problem table that fires an event for each related active incident
B.A Client Script utilizing GlideAjax to send emails synchronously
C.A Record Producer attached to the Incident table
D.An Email Client Template configured on the Problem form
AnswerA

A Business Rule on the Problem table can query related active incidents and fire a dedicated event per incident, letting the notification engine handle delivery. This satisfies the custom requirement to email every affected caller efficiently without manual intervention or per-incident scripting.

Why this answer

A Business Rule on the Problem table can execute server-side logic when the Problem is resolved. It can query all related active incidents and fire an event for each, which the notification engine then processes to send emails. This is efficient because it leverages ServiceNow's event queue and notification framework, avoiding synchronous email sending and ensuring scalability.

Exam trap

CIS-ITSM often tests the misconception that client-side scripts or email templates can directly trigger notifications, when in fact server-side Business Rules and events are the correct approach for efficient, scalable notifications.

How to eliminate wrong answers

Option B is wrong because Client Scripts run in the browser and GlideAjax is used for asynchronous server calls, but sending emails synchronously from a client script is not efficient, can cause performance issues, and is not the intended use of client scripts. Option C is wrong because a Record Producer is used to create records via a catalog interface, not to trigger notifications on existing records. Option D is wrong because an Email Client Template is a template for composing emails, not a mechanism to trigger notifications; it must be used within a notification or mail script.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Problem Management questions.

Start 20-question session