CIS-Discovery Practice Exam Questions with Answers Certified Implementation Specialist - Discovery Certification

The Duplicate CI Remediator is a feature of ServiceNow Discovery that helps to identify and merge duplicate CIs in the CMDB. It uses predefined rules and criteria to compare CIs across different data sources and determine if they are duplicates. It also provides a user interface to review and approve the suggested merges, or to manually merge CIs as needed. The Duplicate CI Remediator helps to improve the accuracy and quality of the CMDB data and reduce the maintenance efforts.

The Set Parameter Value operation is used to assign a value to a variable in a Discovery pattern1. The syntax for this operation is as follows2:

Set Parameter Value: =

The  can be either a constant or an expression. To declare a constant, unchanging value, one must use quotes around the value. For example2:

Set Parameter Value: $name = "John"

This assigns the string “John” to the variable $name. The quotes indicate that the value is a constant and will not change. The other options, hash tag, brackets, and dollar sign, are not used to declare a constant value. They have different meanings in the syntax of the Set Parameter Value operation. A hash tag (#) is used to indicate a comment2. Brackets ([]) are used to access an element of an array or a map2. A dollar sign

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

The Parse File operation is used to extract information from a file and create variables to contain the extracted information1. The two main options within a Parse File operation are Select File and Define Parsing2. Select File allows you to specify the file path or browse to the file. Define Parsing allows you to select the relevant parsing strategy and define parsing criteria2.

 File Based Discovery is used to discover file paths to recognize the signature of installed software. File Based Discovery helps to identify what software is running on Windows and UNIX servers and devices by scanning the file system for specific files or directories that indicate the presence of a software product1. File Based Discovery can also check the file size, version, and checksum of the discovered files to verify the software installation2. File Based Discovery can be configured using file signatures, which are patterns that match the file paths of software products3.

The ECC Queue is the normal connection point between an instance and other systems that integrate with ServiceNow, such as MID Servers1. The ECC Queue displays input and output messages from and to MID Servers2. The actual XML payload that is sent to or from an instance is stored in the ECC Queue3. The ECC Queue also provides a connected flow of probe and sensor activity, as probes are sent from the instance to the MID Server, and sensors are sent from the MID Server to the instance2.

 To allow a MID Server to access servers using WinRM, the following configurations are required:

MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.

MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

In ServiceNow Discovery, a horizontal discovery pattern refers to the logical set of steps that the Discovery process executes to find CI information across the network. Each step in a horizontal discovery pattern performs specific operations such as running probes, executing commands, or querying databases to gather information about the configuration items (CIs). It's about expanding the breadth of discovery across devices and applications, rather than going in-depth into a specific CI's details, which would be vertical discovery. Classifiers, credential depots, and port scanning tools are part of the discovery process but do not describe the horizontal discovery pattern itself.

The Parse Variable pattern operation allows you to extract information from the output of a previous operation and save it in a variable. You can choose from different parsing methods, such as JSON File, XML File, Regular Expression, or Custom Script. To have two different parsing methods to populate variables, you need to use two different steps, each with a different Define Parsing selection. For example, you can use one step to parse a JSON file and another step to parse an XML file. You cannot use two different parsing methods on the same step, as the Define Parsing selection is unique for each step.

In the context of ServiceNow Discovery patterns, the types of temporary variables include Scalar/List and Tabular/Table. Scalar/List variables are used to store single values or lists of values, while Tabular/Table variables are used to store structured data in a table format. Command and SQL statement are not types of temporary variables; rather, they are types of operations or steps that can be used within a pattern to execute commands or SQL queries.References= ServiceNow Discovery documentation, especially sections related to Discovery Patterns and the use of temporary variables within patterns.

CMDB Health measures the quality of the data in the CMDB by testing it against predefined rules and metrics. One of the categories of these rules is Correctness, which tests the data against data integrity rules such as identification rules, orphan CI rules, and stale CI rules1. These rules help identify and flag the existing CMDB relationships that are not compliant with the suggested relationships2.

Duplicate relationships are those that have more than one relationship of the same type between the same two CIs3. For example, if a server CI has two relationships of type “Depends on” with the same network CI, it is a duplicate relationship.

Stale relationships are those that have not been updated for a specified period of time3. For example, if a server CI has a relationship of type “Runs on” with a virtual machine CI that has not been discovered for more than 60 days, it is a stale relationship.

Orphan relationships are those that are missing a defined relationship within the CMDB3. For example, if a server CI has no relationship of type “Depends on” with any network CI, it is an orphan relationship.

When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's often necessary to also increase the memory allocated to the MID Server application. This is because more threads can result in higher memory usage as each thread may consume resources while performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing the MID Server max payload size are not directly related to the number of threads used by a MID Server.References= ServiceNow Discovery documentation, especially sections discussing MID Server configuration and performance tuning.

Credential-less Discovery is a feature of ServiceNow Discovery that allows the instance to identify configuration items (CIs) without using credentials. Credential-less Discovery uses Network Mapper (Nmap), a free and open-source network scanner, to collect information about the CIs by sending packets and analyzing the responses. Nmap must be installed on the MID Server that runs Credential-less Discovery. Credential-less Discovery can be used as a fallbackoption when credential-based probes fail, or as a primary option for scanning certain types of devices, such as network devices, printers, or IoT devices12.

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload. The thread count can be configured by changing the MID Server parameters in the ServiceNow instance12. References = 1: MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow 2: Product Documentation | ServiceNow

The CMDB contains records of configuration items (CIs) and their relationships. A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A relation type defines the nature of the connection between two CIs, such as depends on, uses, or contains. A model is a template for a CI that defines its attributes and default values. An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract.

The Put file operation allows the transfer of a file from the MID Server to a target1. This operation can be used to copy files from the MID Server to a target device, such as configuration files, scripts, or binaries2. The Put file operation requires the file path on the MID Server and the file path on the target as inputs2.

An extension section of a discovery pattern is a section that allows you to modify or extend the functionality of an existing pattern without customizing it. An extension section can contain shared libraries, which are reusable code snippets that can be invoked from any pattern or extension section. Shared libraries can be used to define common functions, variables, or constants that are used across multiple patterns or extension sections. Shared libraries can also be used to override the default behavior of some built-in functions, such as identification or classification12. References = 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow 2: How to Create Discovery Pattern Extensions and Why to Use Them

A horizontal pattern must have a TCP entry point type or an ALL entry point type to execute from a process classifier. A process classifier is a rule that matches a process running on a host and triggers a horizontal pattern to discover the application associated with that process1. The entry point type determines the type of connection that the pattern uses to access the target host. A TCP entry point type means that the pattern uses a TCP port to connect to the host, while an ALL entry point type means that the pattern can use any available connection method2.

From the Discovery Status record, a Device record in ServiceNow Discovery contains a link to the discovered Configuration Item (CI). This link provides direct access to the CI record that was discovered and processed during the discovery cycle. The Device record does not contain the contents of the CI, a link to the discovered Asset, or a link to the CMDB Health Dashboard.References= ServiceNow Discovery documentation, focusing on the details of Discovery Status records and the information contained within Device records.

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping1. It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings2. The ECC Queue is a table that displays the input and output messages from and to MID Servers3. It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps4. The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution2.

For a MID Server to access servers using Windows Remote Management (WinRM), it's necessary to specify that WinRM should be used as the protocol for Windows management. This is typically done by setting the appropriate MID Server parameter, such asmid.windows.management_protocol, to WinRM. This configuration tells the MID Server to use the WinRM protocol when communicating with the target servers for executing commands and collecting data. The answer is derived from understanding how ServiceNow Discovery uses MID Servers to perform remote operations and the need to configure these MID Servers appropriately to communicate using different protocols like WinRM. It is not sufficient to just add the WinRM parameter on target servers or simply add the MID Servers as a trusted source with DNS; the MID Server itself must be configured to use WinRM. Setting a 'JEA Property' to true is not relevant to the basic configuration of a MID Server for WinRM access.

For ServiceNow Discovery to detect a Windows device, the Windows Management Instrumentation (WMI) service needs to be running on the host. WMI is a Windows feature that provides a standardized way to access management information about operating system components and services. Discovery uses WMI to query Windows hosts for information about their hardware, software, and system configuration. SSH is used for Unix-like systems, WinRM is an alternative Windows management protocol, and CIM (Common Information Model) is a cross-platform standard; however, WMI is the primary service used for Windows device discovery.

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable. Get Process executes a command to list the processes running on a target and stores the results in a variable12.

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

 Reconciliation rules are used to determine which data sources can update CI attributes in ServiceNow. Reconciliation rules can be static or dynamic, and they can be applied to specific CI classes, attributes, or discovery sources. Reconciliation rules can also specify the actions to take when there are unmatched values, such as removing, ignoring, or updating them1.

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.