CIS-Discovery Practice Exam Questions with Answers Certified Implementation Specialist - Discovery Certification

Step 25 uses a shared library called Windows - Storage, which is a reusable component that can be invoked by multiple patterns to discover the storage information of Windows servers. A shared library is a collection of steps that can be referenced by a pattern name and can accept input parameters and return output values. Shared libraries help to avoid duplication of code and simplify the maintenance of patterns.

References:

• Pattern Designer | Shared libraries
• Windows - Storage shared library

 When Discovery or Service Mapping identifies a CI that matches an existing CI in the CMDB, it checks whether the CIs are duplicates or not. If they are duplicates, Discovery adds them to a de-duplication task, which is a record that groups duplicate CIs and allows you to review and remediate them. You can use the Duplicate CI Remediator wizard to merge, flag, retire, or delete the duplicate CIs. By default, Discovery does not send notifications, create identification rules, or stop the next discovery for duplicate CIs.

References: Handle Duplicate CIs in your CMDB, De-duplication tasks, How to de-duplicate 2 ESX servers with same name?

The main Key Performance Indicators (KPIs) for the CMDB Health scorecard in ServiceNow include Correctness, Completeness, and Staleness. These KPIs are critical for assessing the overall health and quality of the CMDB. Correctness refers to the accuracy of the data in the CMDB, Completeness measures whether all required CI data is present, and Staleness indicates the freshness or timeliness of the CI data. Compliance and Duplicates, while important, are not considered main KPIs in the context of the CMDB Health scorecard. References = ServiceNow CMDB documentation and CMDB Health Dashboard user guide, focusing on the key performance indicators for CMDB health.

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

References: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

An extension section of a discovery pattern is a section that allows you to modify or extend the functionality of an existing pattern without customizing it. An extension section can contain shared libraries, which are reusable code snippets that can be invoked from any pattern or extension section. Shared libraries can be used to define common functions, variables, or constants that are used across multiple patterns or extension sections. Shared libraries can also be used to override the default behavior of some built-in functions, such as identification or classification12. References = 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow 2: How to Create Discovery Pattern Extensions and Why to Use Them

Horizontal discovery patterns are a series of operations that tell Discovery which CIs to find on your network, what credentials to use, and what tables to populate in the CMDB. Horizontal discovery patterns use variables to store and pass information between the operations. By default, there are two variables that are automatically available for horizontal discovery patterns: infrastructure_system and computer_system. These variables store the information about the infrastructure and the computer system of the target CI, respectively. They are populated by the Horizontal Pattern probe and sensor, which enable Discovery to use patterns for horizontal discovery123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal
• Using patterns for horizontal discovery - Product Documentation: Vancouver - ServiceNow

Discovery uses the ping method to determine if a host IP is active or alive. Ping is a network utility that sends an ICMP echo request packet to a target IP address and waits for an ICMP echo reply packet. If the target IP address responds, it means that the host is active or alive12.

References:

• 1: ServiceNow Discovery Documentation, Discovery Process section
• 2: ServiceNow Discovery Overview, page 8

 Based on the web search results from the search_web tool, the following choices best represent key capabilities of a ServiceNow ITOM Enterprise solution:

• Manage Hybrid Clouds: ServiceNow ITOM enables organizations to gain visibility into their IT environment, on-premises to cloud, and see the impact of their applications on business services12. It also helps to plan, track, and secure cloud implementation through best-practice governance1. Four apps comprise Cloud Accelerate to help prepare for cloud migration, streamline provisioning requests, and manage cloud resources1.
• Proactively Eliminate Service Outages: ServiceNow ITOM helps to predict issues, reduce user impact, and automate resolutions with predictive AIOps and automation13. It analyzes telemetry and log data using AI to reduce noise, expedite mapping and predict issues1. It also delivers proactive digital operations with real-time log data to solve problems quickly1.

The other choices are not specific to ServiceNow ITOM Enterprise solution, but rather general features of the ServiceNow platform. The ServiceNow platform allows users to create an engaging user experience with intuitive interfaces and workflows. It also enables users to build new apps fast with low-code development tools and pre-built components.

References: 1: ITOM - Enterprise IT Operations Management - ServiceNow 2: ServiceNow IT Operations Management (ITOM) Services | Jade 3: Modernize IT Operations Management with ServiceNow ITOM : ServiceNow Platform

The $process.executableDir expression correctly calls the value of the executableDir variable from the tabular process variable. The process variable is a tabular variable that contains the output of the ps command, which lists the processes running on a CI. The executableDir variable is a column name that holds the directory path of the executable file for each process. To access the value of a column name from a tabular variable, you need to use the dot notation, such as $variable.columnName12.

References1: Pattern variables - Product Documentation: Tokyo - Now Support Portal2: Examples of EVAL scripts used in Discovery patterns - ServiceNow

To troubleshoot discovery issues from a discovery status in ServiceNow, the following related lists can be particularly useful:

• Discovery Log - Provides detailed logs of the discovery process, helping to identify errors or issues encountered during discovery.
• ECC Queue - Shows the messages and data passed between the ServiceNow instance and the MID Server, offering insights into the communication and data exchange during discovery.
• Devices - Lists the devices discovered in the process, allowing for a direct view of the results and any potential issues with specific devices.

The "Running Processes" list is not typically used for troubleshooting discovery processes as it relates more to the operational aspects of the server or device rather than the discovery process itself. References = ServiceNow Discovery documentation, specifically the sections on Discovery troubleshooting and analysis, and the use of related lists for monitoring and troubleshooting purposes.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

References: File-based Discovery, File Based Discovery - Support and Troubleshooting

One method for deleting specific CIs not discovered in 30 days is to use a scheduled job that runs a script to query the CMDB for CIs that have not been updated by Discovery for a certain period of time, and then delete them or mark them as retired. This method can help you keep your CMDB clean and accurate, and avoid having stale or obsolete CIs. You can configure the scheduled job to run at a specific frequency and time, and specify the criteria for selecting the CIs to delete.

References: Automated way to disable/retire CIs not updated for 45 days, ServiceNow CIS-Discovery Sample Questions

For a MID Server to access servers using Windows Remote Management (WinRM), it's necessary to specify that WinRM should be used as the protocol for Windows management. This is typically done by setting the appropriate MID Server parameter, such as mid.windows.management_protocol, to WinRM. This configuration tells the MID Server to use the WinRM protocol when communicating with the target servers for executing commands and collecting data. The answer is derived from understanding how ServiceNow Discovery uses MID Servers to perform remote operations and the need to configure these MID Servers appropriately to communicate using different protocols like WinRM. It is not sufficient to just add the WinRM parameter on target servers or simply add the MID Servers as a trusted source with DNS; the MID Server itself must be configured to use WinRM. Setting a 'JEA Property' to true is not relevant to the basic configuration of a MID Server for WinRM access.

In ServiceNow Discovery, most properties related to the Discovery module start with the prefix 'glide.discovery'. This naming convention is part of ServiceNow's system property design, where 'glide' typically indicates system properties and 'discovery' specifies that the property is related to the Discovery module. Properties are used to configure various aspects of the Discovery process, such as behavior, timeouts, and performance settings.

A horizontal pattern is a type of Discovery pattern that discovers configuration items (CIs) and their relationships by moving across the network from one device to another. A horizontal pattern can use the Change user operation to switch from the default credentials to any other appropriate credentials for a specific device or application. This operation allows the pattern to access different types of CIs with different authentication methods.

References:

• Discovery patterns
• Change user operation

The Discovery Dashboard provides a summary of the Discovery status, including the number of active discovery errors, the number of devices discovered, and the number of credentials used. Each error has a help link that provides more information about the cause and possible solutions.

References:

• Discovery Dashboard
• Discovery troubleshooting | Error messages

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

Without seeing the specific image, it's challenging to definitively identify the operation. However, based on the options provided, if the image shows an operation that involves interpreting or extracting data from a variable, then "Parse Variable" is the most likely answer. "Parse Variable" is used in ServiceNow Discovery patterns to analyze and extract data from variables collected during the discovery process. References = ServiceNow Discovery documentation, particularly the sections on Discovery Pattern Designer and the various operations that can be used in patterns.

The vCenter Event Collector is a MID Server extension that listens for vCenter-related events and updates the CMDB accordingly. The event collector allows the CMDB to be updated with changes to virtual machines (VMs), in addition to the updates detected by Discovery1.

References:

• 3: Product Documentation | ServiceNow

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• Load a MIB file - Product Documentation: Vancouver - ServiceNow
• How Loading of MIB file works on SNMP Browser ( Pattern Step - SNMP Query) - Support and Troubleshooting

The Pattern Designer is a graphical tool that allows users to create and edit horizontal discovery patterns. The Pattern Designer has three main sections: the left section shows the CI type and the pattern type, the middle section shows the pattern steps and the flow diagram, and the far-right section shows the details of the selected step or operation. The far-right section can display the following tabs, depending on the type of step or operation selected12:

• Operations: This tab shows the list of available operations that can be added to the pattern, such as Execute Command, Parse File, Set Parameter Value, etc. Operations are the basic building blocks of a pattern that perform specific actions on the target device or the MID Server.
• CI Attributes: This tab shows the list of attributes that can be set or updated for the CI type of the pattern, such as name, serial number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information collected by the pattern.
• Temporary Variables: This tab shows the list of temporary variables that can be created or used by the pattern, such as $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data within the pattern, such as the output of a command, the value of a parameter, or the result of a calculation.
• CMDB Dashboard: This tab shows the CMDB dashboard that displays the CI record and its related lists, such as relationships, identification rules, sensors, etc. The CMDB dashboard is used to preview and verify the outcome of the pattern on the CI record in the CMDB.

References:

• 1: ServiceNow Discovery Documentation, Pattern Designer section
• 2: ServiceNow Discovery Overview, page 11

For discovering Windows Servers, ServiceNow Discovery recommends using credentials that have a domain user account with local administrator access on the target servers. This level of access ensures that Discovery can successfully execute the necessary probes and sensors to collect comprehensive data about the server without being restricted by permission limitations. The other options either provide excessive permissions (like a domain administrator with sudo access) or insufficient privileges (like a standard domain user with read access).

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context. References = ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

The image shows a part of a horizontal pattern in Pattern Designer that uses the WMI Query operation to retrieve information about the processes running on a Windows server. The operation takes a WQL query as an input parameter and returns a tabular variable that contains the results of the query. The tabular variable is named ‘WMI Query’ by default, but it can be renamed by the user. The WQL query in the image selects four attributes from the Win32_Process class: Name, MaximumWorkingSetSize, PageFaults, and PeakVirtualSize. These attributes are stored as scalar variables in the tabular variable, and they can be accessed by using the dot notation, such as WMI Query.Name or WMI Query.MaximumWorkingSetSize. Therefore, the most probable results of the image are a tabular variable named ‘WMI Query’ and two scalar variables named ‘MaximumWorkingSetSize’ and ‘PeakVirtualSize’.

References:

• Pattern Designer | WMI Query
• Win32_Process class
• WQL (SQL for WMI)

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

References:

• Correcting MID Server Windows service account user and permissions
• What is a ServiceNow MID Server and how does it work?
• Configure Windows MID Server service credentials

Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures.

References: Credential affinity for Discovery and Orchestration, Credential Management in ServiceNow discovery