ServiceNow Certified Implementation Specialist — Discovery practice questions

1. Question 1 of 25

   How do you create relationships between CIs in a horizontal pattern?

   • ARelationships are created automatically for each successful connection section.
   • BBy using the Create Connections operation.
   • CBy using the Create Relation/Reference operation.
   • DRelationships cannot be created via patterns.

   Show answer

   Correct answer: C

   Explanation

   As part of creating or modifying a discovery pattern, you can use the Relation and/or Reference condition to create relationships and references between CIs and their related items. This operation is relevant for both infrastructure and application patterns that Discovery uses for horizontal discovery. https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/service-mapping/task/t_CreateARelationshipAndReference.html

   Adapted from community discussion by theadminek · 2024-08-18 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.servicenow.com documentation

   View community discussion1

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. T

      theadminek

      2024-08-18

      3 upvotes

      As part of creating or modifying a discovery pattern, you can use the Relation and/or Reference condition to create relationships and references between CIs and their related items. This operation is relevant for both infrastructure and application patterns that Discovery uses for horizontal discovery. https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/service-mapping/task/t_CreateARelationshipAndReference.html

2. Question 2 of 25

   Which part of Agent Client Collector must be configured to run osquery commands on a CI?

   • AACC Websocket Endpoint
   • BCredential-less Discovery
   • CCheck
   • DInfrastructure Patterns
   • EPolicies

   Show answer

   Correct answer: C

   How others answered

   • C67%
   • E33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   C. Example: Check: A check is created to run the osquery command SELECT * FROM processes; to gather a list of running processes on the CI. Policy: A policy is set up to run this check on all Windows servers every 24 hours. Summary: Checks specify the osquery commands to be run. Policies determine when and on which CIs those checks are executed.

   Adapted from community discussion by nyto089 · 2024-10-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion1

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. N

      nyto089

      2024-10-04

      Selected C2 upvotes

      C. Example: Check: A check is created to run the osquery command SELECT * FROM processes; to gather a list of running processes on the CI. Policy: A policy is set up to run this check on all Windows servers every 24 hours. Summary: Checks specify the osquery commands to be run. Policies determine when and on which CIs those checks are executed.

3. Question 3 of 25

   One method for deleting specific CIs not discovered in 30 days is:

   • AScheduled Job
   • BUI Policy
   • CService Mapping
   • DData Policy

   Show answer

   Correct answer: A

   How others answered

   • A88%

   Explanation

   From the Discovery course how to leverage Scheduled Jobs to automatically delete CIs that are no longer in your environment but still display in the CMDB

   Adapted from community discussion by McKenzieDuquesne · 2024-02-06 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. M

      McKenzieDuquesne

      2024-02-06

      Selected A4 upvotes

      From the Discovery course how to leverage Scheduled Jobs to automatically delete CIs that are no longer in your environment but still display in the CMDB

   2. M

      MrDDo

      2024-01-08

      Selected A3 upvotes

      From the Discovery course, using the most recent discovery date as a condition, a Scheduled Job can be set to update the Install Status to Absent for CIs not discovered in 30 days. Where Data Policies are used to enforce data consistency.

   3. W

      weureul

      2024-10-07

      1 upvote

      And he's definitely right. It is answered by the last section of the Discovery Fundamentals course

4. Question 4 of 25

   Which of the following choices must be installed on a MID Server to run Credential-less Discovery?

   • ACredential-less Extension
   • BNmap
   • CAdvanced IP Scanner
   • DDefender

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Supporting references

   • docs.servicenow.com documentation
   • docs.servicenow.com documentation
   • docs.servicenow.com documentation

   View community discussion3

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. J

      JBurns1979

      2024-04-27

      Selected B3 upvotes

      https://docs.servicenow.com/bundle/sandiego-it-operations-management/page/product/discovery/reference/credential-less-app-discovery.html

   2. M

      Manosgg

      2024-08-27

      1 upvote

      If the instance fails to identify a configuration item (CI) because of authentication failure, Discovery or Service Mapping can run selected Network Mapper (Nmap) commands with a MID Server to collect some basic information about the CI without using credentials. From: https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/concept/nmap-credential-less-discovery.html

   3. [

      [Removed]

      2024-09-08

      2 upvotes

      https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/reference/credential-less-app-discovery.html

5. Question 5 of 25

   A network device has both an SSH port and an SNMP port open. Discovery tries the SSH probe first and it fails. This triggers the SNMP probe, which succeeds. Discovery uses SNMP first for subsequent discoveries on that device. What discovery functionality allows the above to happen?

   • AClassification
   • BCredential affinity
   • CMID Server affinity
   • DIP service affinity

   Show answer

   Correct answer: D

   How others answered

   • D95%

   Explanation

   A system property called glide.discovery.ip_service_affinity allows Discovery to remember the last port of the IP address that was discovered. This property is set to false by default.

   Adapted from community discussion by d2c4a96 · 2024-07-31 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.servicenow.com documentation
   • docs.servicenow.com documentation
   • docs.servicenow.com documentation
   • docs.servicenow.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. D

      d2c4a96

      2024-07-31

      Selected D3 upvotes

      A system property called glide.discovery.ip_service_affinity allows Discovery to remember the last port of the IP address that was discovered. This property is set to false by default.

   2. E

      Egweimai

      2024-01-15

      Selected D3 upvotes

      https://docs.servicenow.com/bundle/utah-it-operations-management/page/product/discovery/concept/c_GetStartedWithDiscovery.html#d142973e344

   3. M

      moSplat

      2024-04-25

      Selected D3 upvotes

      Credential affinity has nothing to do with choosing the order of ports/services to probe.

   4. K

      Kaimu

      2023-02-19

      3 upvotes

      Probably D. https://docs.servicenow.com/ja-JP/bundle/tokyo-it-operations-management/page/product/discovery/concept/c_GetStartedWithDiscovery.html

6. Question 6 of 25

   

   Based on the following images, which choice best describes what occurs if Discovery sets the name attribute of a discovered Windows Server CI to 'Windows1' and then Altiris discovery runs detecting 'Windows2' for the name attribute on the same CI?

   • AThe name of the CI stays 'Windows1'.
   • BThe name of the CI changes to 'Windows2'.
   • CThe name of the CI does not populate with either discovery.
   • DThe CI is not discovered because Discovery is not listed in either image.

   Show answer

   Correct answer: A

   How others answered

   • A80%
   • B20%

   Explanation

   Correct answer: A. The name of the CI stays ‘Windows1’. Reasoning: If multiple data sources are authorized to update the same table in the CMDB based on reconciliation definition, then a lower order data source has higher priority than a higher order data source.

   Adapted from community discussion by asitsm90 · 2024-10-29 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. A

      asitsm90

      2024-10-29

      4 upvotes

      Correct answer: A. The name of the CI stays ‘Windows1’. Reasoning: If multiple data sources are authorized to update the same table in the CMDB based on reconciliation definition, then a lower order data source has higher priority than a higher order data source.

   2. C

      Cplatt

      2024-12-11

      3 upvotes

      Sorry this wouldn't allow me to correct this. Please disregard the answer is A

   3. R

      Raj_95

      2024-05-17

      Selected A2 upvotes

      The answer is "A", no question about it. Why do they have marked "B" as Correct answer ??

   4. D

      doode

      2023-12-03

      1 upvote

      I agree the answer should be A, this is based on the ranking of 100 for ServiceNow(higher than 300 for Altrium)

7. Question 7 of 25

   Select 2

   Which of the below choices are horizontal pattern types? (Choose two.)

   • AHardware
   • BSoftware
   • CInfrastructure
   • DApplication

   Show answer

   Correct answer: C, D

   How others answered

   • CD100%

   Explanation

   A pattern is a sequence of commands whose purpose it is to detect attributes of a CI and its outbound connections. Service Mapping and Discovery share a set of preconfigured patterns that cover most of the commonly used devices and applications. Patterns can be of the infrastructure or application type. Infrastructure patterns are used only by Discovery for creating lists of devices. Application patterns serve both Service Mapping and Discovery, which use the same application patterns for their purposes. For example, Discovery runs the horizontal discovery with the Apache Web Server pattern to find and list all Apache Web Servers in your organization. Service Mapping runs the top-down discovery using the same pattern to discover a specific Apache Web Server and place it on an application service map. https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/concept/c_MappingPatternsCustomization.html

   Adapted from community discussion by JBurns1979 · 2024-10-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.servicenow.com documentation

   View community discussion1

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. J

      JBurns1979

      2024-10-27

      Selected C, D2 upvotes

      A pattern is a sequence of commands whose purpose it is to detect attributes of a CI and its outbound connections. Service Mapping and Discovery share a set of preconfigured patterns that cover most of the commonly used devices and applications. Patterns can be of the infrastructure or application type. Infrastructure patterns are used only by Discovery for creating lists of devices. Application patterns serve both Service Mapping and Discovery, which use the same application patterns for their purposes. For example, Discovery runs the horizontal discovery with the Apache Web Server pattern to find and list all Apache Web Servers in your organization. Service Mapping runs the top-down discovery using the same pattern to discover a specific Apache Web Server and place it on an application service map. https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/concept/c_MappingPatternsCustomization.html

8. Question 8 of 25

   A Discovery Schedule contains a /24 subnet IP Range and a Shazzam batch size of 5000. How many times will a Shazzam probe be launched during discovery?

   • A1
   • B2
   • C5000
   • D254

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   A. 1 For example, a schedule is created to scan 100,000 IP addresses, with 10 MID Servers assigned to do the work. Each MID Server is assigned to scan 10,000 IP addresses. If the Shazzam batch size is set to 5,000 IP addresses per probe, the schedule runs two Shazzam probes per MID Server (10,000 IP addresses/5,000 per batch). These probes are run in sequence and not concurrently. https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/task/t_CreateADiscoverySchedule.html

   Adapted from community discussion by McKenzieDuquesne · 2024-11-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.servicenow.com documentation

   View community discussion2

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. M

      McKenzieDuquesne

      2024-11-26

      Selected A2 upvotes

      A. 1 For example, a schedule is created to scan 100,000 IP addresses, with 10 MID Servers assigned to do the work. Each MID Server is assigned to scan 10,000 IP addresses. If the Shazzam batch size is set to 5,000 IP addresses per probe, the schedule runs two Shazzam probes per MID Server (10,000 IP addresses/5,000 per batch). These probes are run in sequence and not concurrently. https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/task/t_CreateADiscoverySchedule.html

   2. M

      MrDDo

      2024-07-08

      Selected A3 upvotes

      A /24 subnet contains 253 usable IPs. And if the Shazzam batch size is configured as 5000. Only one Shazam probe needs to be created to complete the scan.

9. Question 9 of 25

   Which method is used by Discovery to determine if a Host IP is active or alive?

   • APort Scan
   • BTraceroute
   • CPing
   • DClassification

   Show answer

   Correct answer: A

   How others answered

   • A93%

   Explanation

   I believe SNOW dumped ping awhile ago. While it is possible to have a CI that has all listening ports closed, it is highly unlikely to the point of near-impossibility (because any device active on a network will always have at least one port open, even if it's open temporarily to receive return packets).

   Adapted from community discussion by moSplat · 2024-10-25 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.servicenow.com documentation

   View community discussion3

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

   1. F

      FQuaresma25

      2024-06-18

      Selected A5 upvotes

      I think Discovery no longer pings devices, so I think the (most) correct answer here is A

   2. K

      Kaimu

      2023-08-21

      5 upvotes

      Probably A. https://docs.servicenow.com/bundle/tokyo-it-operations-management/page/product/discovery/reference/r_DiscoveryPortsAndProtocols.html

   3. M

      moSplat

      2024-10-25

      Selected A3 upvotes

      I believe SNOW dumped ping awhile ago. While it is possible to have a CI that has all listening ports closed, it is highly unlikely to the point of near-impossibility (because any device active on a network will always have at least one port open, even if it's open temporarily to receive return packets).

10. Question 10 of 25

    Which choice best describes a horizontal discovery pattern?

    • ASteps that execute operations
    • BCredential depot
    • CPort scanning tool
    • DClassifiers that execute probes

    Show answer

    Correct answer: A

    How others answered

    • A90%

    Explanation

    Discovery still uses probes to trigger the Pattern, but I believe that the Pattern itself is a series of steps that execute operations, so I think A is the correct answer

    Adapted from community discussion by FQuaresma25 · 2024-06-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. F

       FQuaresma25

       2024-06-18

       Selected A4 upvotes

       Discovery still uses probes to trigger the Pattern, but I believe that the Pattern itself is a series of steps that execute operations, so I think A is the correct answer

    2. E

       Egweimai

       2024-07-15

       Selected A3 upvotes

       https://docs.servicenow.com/en-US/bundle/vancouver-it-operations-management/page/product/discovery/concept/c-UsingPatternsForHorizontalDiscovery.html#:~:text=discovery%20with%20probes-,Horizontal%20discovery%20with%20patterns,probes%20to%20kick%20off%20discovery

11. Question 11 of 25

    When installing a MID Server on a Windows platform, which right must be associated when creating a Service Account?

    • ARoot
    • BDomain Admin
    • CMID Server User Role
    • DLog on as service

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Username of the service account that will be used to run the MID Server service. For information on creating service accounts, see Create a Windows service account with "Log on as Service" [KB0867669].

    Adapted from community discussion by HDMC · 2023-09-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. H

       HDMC

       2023-09-18

       Selected D4 upvotes

       Username of the service account that will be used to run the MID Server service. For information on creating service accounts, see Create a Windows service account with "Log on as Service" [KB0867669].

    2. M

       MrDDo

       2024-07-08

       Selected D3 upvotes

       The provided service account credentials must meet the following requirements in addition to being a valid account. The user cannot be a local system or an administrator level account (local admin, domain admin, etc.) The service account provided has the log on as service right, which is required for an account to be used as the log on user for a service.

    3. M

       moSplat

       2024-10-25

       Selected D1 upvote

       1. You can allow read-only in a AD domain without making the account Domain Admin 2. MID has to have log on as a service rights in order to run the MID services on the Windows server.

12. Question 12 of 25

    For what is File Based Discovery used?

    • ATo discover the checksum of a file and store it to track for changes
    • BTo discover the contents of flat files such as configuration files
    • CTo discover that file names conform to a defined naming standard
    • DTo discover file paths to recognize the signature of installed software

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe. File-based Discovery uses file signatures to detect software that might not have been registered.

    Adapted from community discussion by MrDDo · 2024-07-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation
    • docs.servicenow.com documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. M

       MrDDo

       2024-07-08

       Selected D4 upvotes

       File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe. File-based Discovery uses file signatures to detect software that might not have been registered.

    2. K

       Kaimu

       2023-08-20

       3 upvotes

       Probably D. https://docs.servicenow.com/ja-JP/bundle/tokyo-it-operations-management/page/product/discovery/concept/file-based-discovery.html

    3. I

       itguy2023

       2024-01-01

       Selected D2 upvotes

       D https://docs.servicenow.com/bundle/utah-it-operations-management/page/product/discovery/concept/file-based-discovery.html

    4. M

       moSplat

       2024-10-25

       Selected D1 upvote

       A naming standard does not matter in discovery. However, the fastest way to find out the name of an application is to correlate its config file location to that of typical installations.

13. Question 13 of 25

    Select 3

    Hardware Models can have a one-to-many relationship with the following: (Choose three.)

    • AAssets
    • BManufacturer
    • CConfiguration Items
    • DProduct owner
    • EModel Categories

    Show answer

    Correct answer: A, C, E

    How others answered

    • ACE50%
    • BCE50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A, C, E is correct. If you look on the "cmdb_hardware_product_model" form, the manufacturer and owner fields is are reference fields and therefore can't have one-to-many relationships.

    Adapted from community discussion by blargh69 · 2024-07-21 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation

    View community discussion3

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. B

       blargh69

       2024-07-21

       3 upvotes

       A, C, E is correct. If you look on the "cmdb_hardware_product_model" form, the manufacturer and owner fields is are reference fields and therefore can't have one-to-many relationships.

    2. S

       serviceNowExamen

       2025-03-14

       Selected A, C, E1 upvote

       ACE. Option B is incorrect because a hardware model has a one-to-one relationship with the manufacturer, as a hardware model is typically associated with a single manufacturer.

    3. N

       nyto089

       2024-10-03

       1 upvote

       A,C,E is correct. Manufacturer can have a one-to-many relationship with Models but not the other way around. https://docs.servicenow.com/bundle/xanadu-it-asset-management/page/product/product-catalog/concept/c_ModelCategories.html

14. Question 14 of 25

    During the Discovery process, what determines if an Asset record is created?

    • ACMDB
    • BModel Category
    • CModel Product
    • DECC Queue
    • EConfiguration Item

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    The Model Category and Model determine if an Asset and CI record will be created and which table they will populate. B is correct

    Adapted from community discussion by nam289 · 2024-12-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation

    View community discussion2

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. N

       nam289

       2024-12-05

       2 upvotes

       The Model Category and Model determine if an Asset and CI record will be created and which table they will populate. B is correct

    2. F

       ftpuser

       2024-09-27

       Selected B1 upvote

       Probably B.. not sure https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/concept/c_GetStartedWithDiscovery.html

15. Question 15 of 25

    On the ECC Queue, sensor records have a Queue value of ___________ and probe records have a Queue value of ___________.

    • Ainput, output
    • Bstarted, ready
    • Cready, started
    • Doutput, input

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • D33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Input, Output Discovery Course - Module 5 To determine whether a record is for a probe or a sensor, look at the value in the Queue column. Sensor records are in the input queue, and probe records are in the output queue

    Adapted from community discussion by McKenzieDuquesne · 2024-05-26 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. M

       McKenzieDuquesne

       2024-05-26

       Selected A6 upvotes

       A. Input, Output Discovery Course - Module 5 To determine whether a record is for a probe or a sensor, look at the value in the Queue column. Sensor records are in the input queue, and probe records are in the output queue

    2. N

       nyto089

       2024-10-03

       2 upvotes

       A is the answer. The link you just shared shows this: "Probes and sensors Probes and sensors are scripts that collect and process data on a host and then update the CMDB. More specifically, probes explore or investigate CIs on your network, and sensors parse the data returned from the probes." Probes are the output and sensors are the input.

16. Question 16 of 25

    Select 2

    Which of the following must be configured to allow a MID Server to access servers using WinRM? (Choose two.)

    • AJEA Properties set to True
    • BMID Servers must be configured as a trusted source with DNS
    • CMID Servers need to be added to the WinRM Group policy on the Servers
    • DMID Server Parameters Add WinRM

    Show answer

    Correct answer: C, D

    How others answered

    • CD56%
    • BC33%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    DNS trust is not a factor since IPs are used and not hostnames. WinRM has to be set up on the MID Server, and Active Directory has to allow WinRM use.

    Adapted from community discussion by moSplat · 2024-10-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. M

       moSplat

       2024-10-30

       Selected C, D3 upvotes

       DNS trust is not a factor since IPs are used and not hostnames. WinRM has to be set up on the MID Server, and Active Directory has to allow WinRM use.

    2. T

       theadminek

       2024-08-13

       3 upvotes

       B is almost correct but DNS is not mentioned in documentation. It seems to be a trap word. C & D in my opinion.

17. Question 17 of 25

    In order to use Debug from the Pattern Designer, you must have what?

    • Aa proxy server
    • Ba discoverable CI
    • Cthe admin role
    • DService Mapping installed

    Show answer

    Correct answer: B

    How others answered

    • B80%
    • C20%

    Explanation

    B is correct. On page 266 of the Discovery Fundamentals Guide Book it says: "Note: Debug Mode is used to test pattern steps and verify variable values against a CI prior to running discovery".

    Adapted from community discussion by Sarah34745 · 2024-04-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. D

       doode

       2024-05-29

       3 upvotes

       It has to be B, bear in mind that a CI has a reasonable number of attributes that a pattern will identify during the discovery process. No Discoverable CI, no point using a pattern, no reason to debug!

    2. S

       Sarah34745

       2024-04-30

       Selected B2 upvotes

       B is correct. On page 266 of the Discovery Fundamentals Guide Book it says: "Note: Debug Mode is used to test pattern steps and verify variable values against a CI prior to running discovery".

    3. M

       Michael_K_1

       2024-12-02

       Selected B1 upvote

       You have to connect to an actual CI in order to debug it. B is correct

    4. T

       Taddei

       2024-08-09

       1 upvote

       I did the SAM Exam, and in the exam they called "sam_admin" as "admin" only, maybe its the case here.

18. Question 18 of 25

    Which choice best describes a Functionality Definition?

    • ADefines what CI identifiers to use.
    • BDefines the IP addresses to discover.
    • CDefines what Behavior to use from a Discovery Schedule.
    • DDefines what protocols to detect from within a Behavior.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/task/create-disco-behavior.html In the Discovery Functionality related list, click New. Discovery Functionality defines what each MID Server in this behavior must do, specifically which protocols to detect.

    Adapted from community discussion by Thenets · 2024-08-01 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation
    • docs.servicenow.com documentation
    • docs.servicenow.com documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. T

       Thenets

       2024-08-01

       Selected D2 upvotes

       https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/task/create-disco-behavior.html In the Discovery Functionality related list, click New. Discovery Functionality defines what each MID Server in this behavior must do, specifically which protocols to detect.

    2. P

       paulvanman

       2024-07-28

       Selected D2 upvotes

       https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/reference/r_DefineTheFunctionalities.html

    3. I

       it0m_man

       2023-09-08

       Selected D2 upvotes

       Answer is D "pre-configured functionality that defines the protocol or list of protocols that each MID Server scans."

    4. K

       Kaimu

       2023-08-20

       2 upvotes

       Probably D. https://docs.servicenow.com/bundle/utah-it-operations-management/page/product/discovery/task/create-disco-behavior.html

19. Question 19 of 25

    A discovery runs against a Windows Server returning the following attribute values for the first time: name = WindowsSN1 serial_number = 12321 A subsequent discovery runs against a different Windows Server returning the following attribute values: name = WindowsSN2 serial_number = 12321 With only base system CI Identifiers configured, which of the following is true?

    • AA Windows Server CI is created, then updated with WindowsSN2 as the name.
    • BTwo Windows Sewer CIs are created, with WindowsSN1 AND WindowsSN2 for names.
    • CTwo Windows Server CIs are created, without serial_number values.
    • DA Windows Server CI is created, then updated with WindowsSN1 as the name.

    Show answer

    Correct answer: A

    How others answered

    • A90%

    Explanation

    the OOB IRE rule has a higher priority for the serial number (derived from the Hardware Class), IRE will stop with the first matching condition that delivery a unique identification, therefore it would consider the serialnumber as significant. Thus I opt for A

    Adapted from community discussion by carstenschnorr · 2023-09-17 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. C

       carstenschnorr

       2023-09-17

       4 upvotes

       the OOB IRE rule has a higher priority for the serial number (derived from the Hardware Class), IRE will stop with the first matching condition that delivery a unique identification, therefore it would consider the serialnumber as significant. Thus I opt for A

    2. D

       doode

       2024-05-29

       2 upvotes

       the question says "subsequent discovery is run against a different windows server" this implies that there is a second windows server to consider. In this case, the answer has to be B.

    3. D

       doode

       2023-06-03

       1 upvote

       I would say the answer is A, it would only NOT update the name if a less authoritative data source was used.

20. Question 20 of 25

    Which of the following executes the osquery commands on agents to gather attribute details from a CI?

    • AAgent Collector
    • BAgent listener
    • CACC for Discovery
    • DCheck Definitions
    • EPolicies

    Show answer

    Correct answer: D

    How others answered

    • D79%
    • C21%

    Explanation

    Once the Check Type is defines you need a check definition that define the way of querying the end-device. This could be done with scripts, commands or with the build in OSQuery (https://osquery.io/). ACC-V uses OSQuery for other data detection, and is maintained by the Agent. The good thing is that there is a predefined Check Definition to run OSQuery (util.osquery.agent) that you can take inspiration from.

    Adapted from community discussion by Thenets · 2024-08-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. S

       sm6

       2024-07-22

       Selected D5 upvotes

       This guide says it is D. https://www.servicenow.com/community/itom-articles/build-your-own-acc-v-inventory-module-check-definition/ta-p/2368617

    2. T

       Thenets

       2024-08-01

       Selected D3 upvotes

       Once the Check Type is defines you need a check definition that define the way of querying the end-device. This could be done with scripts, commands or with the build in OSQuery (https://osquery.io/). ACC-V uses OSQuery for other data detection, and is maintained by the Agent. The good thing is that there is a predefined Check Definition to run OSQuery (util.osquery.agent) that you can take inspiration from.

    3. P

       paulvanman

       2024-07-28

       Selected D3 upvotes

       The Disco training has a slide which states: Check Definitions executes the osquery command on agents. verbatim.. I'm suggesting D.

    4. C

       Checwes

       2024-06-02

       2 upvotes

       I wanted to make a correction. I found the answer in Module 7 of the lab. If you watch that module at the portion where it talks about Check Definitions, it says word for word "executes the osquery command on agents." and "osquery commands are used to gather specific attribute details..." That being said the correct answer is actually D. Check Definitions

21. Question 21 of 25

    While discovering a new SNMP network device, which choice could cause the error “Active, couldn’t classify” to occur on a Discovery Status?

    • AA firewall blocking the communication between the MID Server and the target device.
    • BSNMP credentials are incorrect.
    • CSNMP only behavior is not configured.
    • DAn SNMP Classification must be updated or created for the new device.

    Show answer

    Correct answer: D

    How others answered

    • D75%
    • B25%

    Explanation

    Based on the troubleshooting module of the self-paced training, the example they gave stated that this is the result of a classifier not existing for the specific CI.

    Adapted from community discussion by e876ab6 · 2024-09-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. T

       theadminek

       2024-02-18

       Selected D2 upvotes

       From this community thread D is correct, but documentation would be better to be completely sure. https://www.servicenow.com/community/itom-forum/unable-to-discover-snmp-devices-active-could-t-classify/m-p/931929/page/3

    2. E

       e876ab6

       2024-09-06

       Selected D2 upvotes

       Based on the troubleshooting module of the self-paced training, the example they gave stated that this is the result of a classifier not existing for the specific CI.

    3. S

       serviceNowExamen

       2025-03-15

       Selected D1 upvote

       The error message refers to a classification error. If the SNMP credentials are incorrect (option B), the discovery attempt would fail completely when connecting to the device, but a classification error would not specifically occur.

    4. N

       nyto089

       2024-10-03

       Selected D1 upvote

       From the self-paced learning troubleshooting module on Classification, it says that the classifier for SNMP is missing if you encounter this error

22. Question 22 of 25

    What is the default thread count for a MID Server?

    • A5
    • B1
    • C50
    • D25

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    The MID Server default setting for max.threads is 25. If you have made no changes to this setting, your MID Servers will have this value https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0997594

    Adapted from community discussion by theadminek · 2024-08-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. T

       theadminek

       2024-08-18

       Selected D2 upvotes

       The MID Server default setting for max.threads is 25. If you have made no changes to this setting, your MID Servers will have this value https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0997594

    2. M

       MrNice2028

       2024-05-08

       Selected D2 upvotes

       D - 25 is correct. - 500 (25*Threads) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0743566

23. Question 23 of 25

    What is the recommended method for excluding specific software from discovery on Windows and Unix Servers?

    • APattern Modification
    • BProbe Modification
    • CConfiguration Console
    • DDiscovery Properties

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/concept/c_DiscoveryConfigurationConsole.html You can filter the discovery of software packages based on the keywords they contain for Windows and UNIX computers.

    Adapted from community discussion by theadminek · 2024-08-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation
    • docs.servicenow.com documentation

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. T

       theadminek

       2024-08-18

       Selected C2 upvotes

       https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/discovery/concept/c_DiscoveryConfigurationConsole.html You can filter the discovery of software packages based on the keywords they contain for Windows and UNIX computers.

    2. F

       ftpuser

       2024-09-26

       Selected C2 upvotes

       https://docs.servicenow.com/bundle/washingtondc-it-operations-management/page/product/discovery/concept/c_DiscoveryConfigurationConsole.html

24. Question 24 of 25

    Which of the choices best describes a tabular variable in a discovery pattern?

    • AA single column
    • BA single string
    • CEach cell is a CI attribute
    • DEach cell is a scalar variable

    Show answer

    Correct answer: D

    Explanation

    D is correct https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/reference/r_PatternVariables.html A variable can be: Scalar: A single string Tabular: A table, where each cell is a scalar variable. Vector: A single, unnamed column with as many rows as needed

    Adapted from community discussion by 1samlsof1 · 2024-08-03 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation

    View community discussion1

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. 1

       1samlsof1

       2024-08-03

       4 upvotes

       D is correct https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/reference/r_PatternVariables.html A variable can be: Scalar: A single string Tabular: A table, where each cell is a scalar variable. Vector: A single, unnamed column with as many rows as needed

25. Question 25 of 25

    Which one of the following is not used in a horizontal discovery pattern?

    • AVariables
    • BConnectivity section
    • COperations
    • DIdentification section

    Show answer

    Correct answer: B

    How others answered

    • B88%

    Explanation

    I want to again correct my first answer. I think the correct answer is actually conectivity section. When you go to the pattern and select Infrastructure as the type, it shows two sections the "Identification section" and the "extension section". When you select application, it show both of those as well as a "Connection Section" not "Connectivity" I think this is a trick question.

    Adapted from community discussion by Checwes · 2024-06-02 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.servicenow.com documentation

    View community discussion2

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CIS-DISCOVERY or CertExamHQ.

    1. C

       Checwes

       2024-06-02

       Selected B7 upvotes

       I want to again correct my first answer. I think the correct answer is actually conectivity section. When you go to the pattern and select Infrastructure as the type, it shows two sections the "Identification section" and the "extension section". When you select application, it show both of those as well as a "Connection Section" not "Connectivity" I think this is a trick question.

    2. 1

       1samlsof1

       2024-08-04

       2 upvotes

       B is correct. https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/service-mapping/task/t_DefineConnecSectionPatDef.html Procedure Navigate to All > Pattern Designer > Discovery Patterns and open the required pattern from the pattern list. The pattern must be of the Application type. In the Connectivity Section, click New. Note: The Connectivity Section is greyed out if the pattern cannot be edited for Service Mapping.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIS-DISCOVERY practice, question 1 of 25