CCNA Incident Management Questions — Page 2 of 2

MCQeasy

Which role is the minimum required to read and update incident records?

A.user

B.itil

C.admin

D.itil_admin

AnswerB

The itil role grants the read and update permissions required for incident records, making it the minimum role that satisfies both operations. Roles such as admin or sn_incident_write exceed this requirement, while read-only roles cannot update records.

Why this answer

The itil role in ServiceNow is the minimum role that grants read and write access to incident, problem, and change records. It is designed for ITIL process users such as service desk agents who need to work on incidents daily. The user role alone cannot update incidents, and admin/itil_admin are higher-privileged than required.

Exam trap

CIS-ITSM often tests the difference between 'user' (self-service only) and 'itil' (process user), and candidates incorrectly assume the base user role can update incidents.

How to eliminate wrong answers

Option A is wrong because the base 'user' role only grants access to self-service and basic record viewing — it cannot read or update incident records belonging to other users. Option C is wrong because 'admin' is a full system administrator role with far more privileges than needed, so it is not the minimum. Option D is wrong because 'itil_admin' is a role that combines ITIL process access with administrative capabilities over ITIL tables, which exceeds the minimum required to simply read and update incidents.

Practice this question →

MCQhard

When a Major Incident is created, what happens to the linked child incidents?

A.They are ignored by the system

B.They are deleted

C.They are closed immediately

D.They are automatically updated with major incident information

AnswerD

When a major incident is raised, linked child incidents are automatically updated with the major incident information, keeping them aligned without manual edits. This propagation ensures consistent status and reference data across all related records throughout the major incident lifecycle.

Why this answer

When a Major Incident is created in ServiceNow, linked child incidents are automatically updated with major incident information. This ensures that all related incidents share the major incident context, including the major incident number, state, and communication updates. The system propagates key fields from the parent major incident to the child incidents so that support teams and users have consistent information across all linked records.

Exam trap

CIS-ITSM often tests the Major Incident Management process — candidates assume child incidents are closed or deleted when a major incident is created, but the correct behavior is that they are updated with major incident information and remain linked for tracking.

How to eliminate wrong answers

Option A is wrong because child incidents are not ignored — they are actively updated with major incident details. Option B is wrong because child incidents are not deleted; they remain as separate records linked to the major incident for tracking and reporting. Option C is wrong because child incidents are not closed immediately — they are updated with major incident information and remain open until resolved through the normal incident lifecycle.

Practice this question →

MCQhard

You want to hide the 'Impact' field for users who do not have the 'itil' role. Where is the most appropriate place to configure this?

A.ACL

B.UI Policy

C.Data Policy

D.Client Script

AnswerB

A UI Policy dynamically hides or makes fields read-only based on role or other conditions, so the Impact field can be suppressed for users lacking the itil role. ACLs and dictionary changes cannot achieve this role-based form behaviour.

Why this answer

A UI Policy is the correct place to hide the 'Impact' field for users without the 'itil' role, because UI Policies control field visibility, mandatory, and read-only behavior on the client side based on conditions like role or field values. They are the standard ServiceNow mechanism for role-based form field display.

Exam trap

CIS-ITSM often tests the confusion between UI Policies (form field visibility) and ACLs (data access security) — candidates pick ACLs thinking 'hide' means 'secure,' but the question asks about form field visibility.

How to eliminate wrong answers

Option A is wrong because ACLs control record- and field-level read/write access at the database layer — they restrict data access, not form field visibility, and hiding via ACL would still leave the field rendered but inaccessible. Option C is wrong because Data Policies enforce mandatory/read-only rules on the server side during save, not visibility on the form. Option D is wrong because a Client Script can manipulate fields via JavaScript, but it is not the declarative, maintainable mechanism for role-based field hiding that UI Policies provide.

Practice this question →

MCQeasy

An incident has been resolved and the caller confirms the fix. The incident is now in the 'Resolved' state. After a predefined period, the incident should automatically move to 'Closed'. Which feature controls this automatic closure?

A.The 'Close unresolved incidents' scheduled job.

B.A business rule that runs on the incident table when the state changes to Resolved.

C.The 'Incident resolution' workflow.

D.The 'Auto close incidents' scheduled job.

AnswerD

The 'Auto close incidents' scheduled job automatically closes incidents that have been in the Resolved state for a specified number of days. This is the standard mechanism for moving resolved incidents to closed after a grace period. It ensures that incidents are not left open indefinitely.

Why this answer

The 'Auto close incidents' scheduled job is the standard feature that automatically closes incidents after they have been in the Resolved state for a configured number of days. This ensures that resolved incidents are eventually closed without manual intervention.

Exam trap

The trap here is confusing the job that closes unresolved incidents with the one that closes resolved incidents.

Practice this question →

MCQhard

An IT organization defines a Service Level Agreement (SLA) for Incident Resolution that must pause its timer whenever an incident moves to the 'Awaiting User Info' state. Where must this pause condition be configured within the SLA definition record?

A.In the SLA Workflow properties under 'Timer Pause Actions'

B.In the SLA Definition form under the 'Pause condition' field

C.In the Dictionary entry for the Incident 'State' field

D.Within the Data Lookup Rules table for SLAs

AnswerB

The SLA Definition record exposes a dedicated Pause condition field, evaluated against the task's state, so setting it to 'Awaiting User Info' halts the resolution timer while the incident waits on the user and resumes when the state changes.

Why this answer

The pause condition for an SLA is configured on the SLA Definition record in the 'Pause condition' field, where you define the condition (e.g., State is 'Awaiting User Info') that halts the SLA timer. This field is evaluated by the SLA engine whenever the task is updated, and the timer resumes when the condition becomes false. It is not configured in workflow properties, dictionary entries, or data lookup rules.

Exam trap

The trap is placing the pause condition in workflow or dictionary configuration — candidates must remember it is a dedicated field on the SLA Definition record.

How to eliminate wrong answers

Option A is wrong because SLA Workflow properties control workflow activities and stages, not the pause condition logic — the pause condition is a field on the SLA Definition itself. Option C is wrong because the Dictionary entry for the Incident 'State' field defines field attributes (type, choices, default), not SLA pause behavior. Option D is wrong because Data Lookup Rules are used for data population and mapping, not for SLA timer pause conditions.

Practice this question →

MCQmedium

You are tasked with configuring the Incident Priority Matrix. If an Incident has an Urgency of 2 and an Impact of 2, what is the default Priority?

A.Priority 4 - Low

B.Priority 2 - High

C.Priority 3 - Moderate

D.Priority 1 - Critical

AnswerC

With Urgency 2 and Impact 2, the matrix maps both mid-scale values to Priority 3 – Moderate, matching ServiceNow's default priority calculation. This satisfies the stem's constraint of a two-by-two mid-range intersection, where neither axis escalates severity, so no higher priority band applies.

Why this answer

In the ServiceNow Incident Priority Matrix, Priority is derived from the combination of Impact and Urgency using a default lookup table. For the intersection of Urgency = 2 and Impact = 2, the default Priority is 3 (Moderate). This follows the standard ITIL-based matrix where only combinations of high urgency and high impact yield Priority 1 or 2, while mid-range combinations produce Priority 3.

Exam trap

CIS-ITSM often tests the default Priority Matrix values, and candidates frequently confuse the combinations that yield Priority 2 versus Priority 3, especially when both Impact and Urgency are 2.

How to eliminate wrong answers

Option A is wrong because Priority 4 (Low) is typically assigned when both Impact and Urgency are 3 (or lower), not 2. Option B is wrong because Priority 2 (High) results from combinations like Impact=1 and Urgency=2, or Impact=2 and Urgency=1, not when both are 2. Option D is wrong because Priority 1 (Critical) is reserved for the highest combination: Impact=1 and Urgency=1.

Practice this question →

MCQmedium

When using the 'On-Hold' state, which sub-field is typically used to explain why the incident is waiting?

A.Assignment Group

B.Work Notes

C.On-Hold Reason

D.Resolution Code

AnswerC

The On-Hold Reason sub-field records the specific cause of the pause, such as awaiting a vendor or a change window, distinguishing it from the generic On-Hold state. This satisfies the stem's requirement to explain why the incident is waiting.

Why this answer

The 'On-Hold' state in ServiceNow incident management requires a mandatory sub-field called 'On-Hold Reason' to specify why the incident is paused. This field provides a structured, reportable reason (e.g., 'Awaiting Caller', 'Awaiting Change', 'Awaiting Problem') that distinguishes it from free-form notes. It ensures consistency and enables metrics like hold duration by reason.

Therefore, C is correct.

Exam trap

CIS-ITSM often tests the distinction between structured fields (like On-Hold Reason) and free-text fields (like Work Notes), so candidates may incorrectly choose Work Notes because it seems like a place to explain anything.

How to eliminate wrong answers

Option A is wrong because Assignment Group is a field that determines which team owns the incident, not why it is on hold. Option B is wrong because Work Notes are free-text updates for collaboration, not a structured sub-field for hold reasons. Option D is wrong because Resolution Code is used when resolving or closing an incident, not for explaining a hold state.

Practice this question →

MCQhard

A service desk manager wants to ensure that when an incident is reassigned to a different assignment group, the previous assignee is automatically cleared. Which feature should be configured to achieve this?

A.A business rule that runs before update and clears the Assigned to field if the Assignment group changes.

B.A data policy that sets the Assigned to field to mandatory when the Assignment group changes.

C.A UI policy that makes the Assigned to field read-only when the Assignment group changes.

D.A client script that clears the Assigned to field on change of the Assignment group.

AnswerA

A before update business rule can detect a change in the Assignment group field and clear the Assigned to field. This ensures that when the group changes, the previous assignee is removed, preventing misassignment. Business rules are the appropriate tool for enforcing such data integrity logic on the server side.

Why this answer

To automatically clear the Assigned to field when the Assignment group changes, a before update business rule is the correct solution. It runs on the server, ensuring consistency regardless of how the update is made. UI policies and client scripts only affect the client side and do not guarantee data integrity.

Exam trap

The trap here is thinking that a UI policy or client script can enforce automatic field clearing, but they are client-side and not reliable for all update paths.

Practice this question →

MCQhard

An enterprise organization requires that when a Major Incident Candidate is promoted to a Major Incident, a dedicated Major Incident workspace opens automatically, and specific child incidents are automatically associated. Which plugin must be activated to utilize the formal Major Incident Management workbench and associated workflows in ITSM?

A.com.snc.incident.mim

B.com.snc.problem.mim

C.com.snc.itsm.major_incident

D.com.snc.incident_management.advanced

AnswerA

The com.snc.incident.mim plugin activates the Major Incident Management workbench, which delivers the dedicated workspace and automated child-incident association workflows. Without it, promoting a Major Incident Candidate cannot trigger the formal MIM process the organisation requires.

Why this answer

The plugin com.snc.incident.mim is the official ServiceNow plugin that activates the Major Incident Management (MIM) workbench. It provides the dedicated Major Incident workspace, the promotion of Major Incident Candidates to Major Incidents, and the automatic association of child incidents. This plugin is specifically designed for the formal MIM workflows within ITSM.

Exam trap

CIS-ITSM often tests the exact plugin name for Major Incident Management, and candidates may confuse it with non-existent or similarly named plugins like com.snc.itsm.major_incident or com.snc.incident_management.advanced.

How to eliminate wrong answers

Option B is wrong because com.snc.problem.mim does not exist; the correct plugin for problem management is com.snc.problem, and there is no MIM-specific problem plugin. Option C is wrong because com.snc.itsm.major_incident is not a valid ServiceNow plugin; the correct plugin name follows the pattern com.snc.incident.mim. Option D is wrong because com.snc.incident_management.advanced is not a real plugin; advanced incident management features are part of other plugins like com.snc.incident or com.snc.incident.mim.

Practice this question →