ServiceNow CIS-Discovery Certified Implementation Specialist - Discovery Exam Practice Test

The SNMP Query pattern operation executes an SNMP query on a target device and stores the results in a variable. The Variable Type field determines the format of the results. There are two valid Variable Types for this operation: Table and Scalar. Table is used when the query returns multiple values, such as a list of interfaces or processes. Scalar is used when the query returns a single value, such as the system name or uptime12.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• SNMP Query pattern operation - Product Documentation: Vancouver - ServiceNow

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

References: Patterns and horizontal discovery, Available discovery patterns

The Credential Affinity table is a table that associates an IP address and a credential in Discovery1. It is used to store the credential that was successfully used to access a device during Discovery2. It can also be used to manually assign a credential to an IP address or a range of IP addresses3. The other options are not tables that associate an IP address and a credential in Discovery. The Service Affinity table is a table that associates a business service and a credential. The Service CI Association table is a table that associates a business service and a configuration item (CI). The Tags table is a table that stores tags that can be applied to records in any table.

References: 1: Credential Affinity table 2: Credential affinity 3: Manually assign a credential to an IP address : Service Affinity table : Service CI Association table : Tags table

Global variables are variables that are automatically available for all steps in horizontal discovery patterns. They store information about the target CI, such as its IP address, host name, operating system, and credentials. There are two global variables that may be used for steps in horizontal discovery patterns: system and computer_system. The system variable contains the information about the target CI’s IP address, host name, and credentials. The computer_system variable contains the information about the target CI’s operating system, such as its name, version, and architecture12.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

References: The explanation is based on the following sources:

• Activate pattern Debug mode: This document explains how to activate the Debug mode and use the Debug Identification Section to debug a pattern.
• ServiceNow Exam CIS-Discovery Topic 6 Question 9 Discussion: This discussion provides a similar question and answer about the Debug Identification Section in Debug Mode.

 The MID Server’s user account must have the mid_server role to interact with a ServiceNow instance. This role allows the MID Server to access protected tables and perform discovery and orchestration tasks on behalf of the instance. The other roles are not related to the MID Server functionality. The discovery_admin role is for configuring and managing discovery, the sm_mid role is for using the Service Mapping MID Server, and the mid_discovery role is for running discovery probes and sensors.

References:

• Setting up MID Server user and role
• Configure Windows MID Server service credentials
• Correcting MID Server Windows service account user and permissions

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

A Functionality Definition is a configuration record that defines what protocols to detect from within a Behavior. A Behavior is a set of Functionality Definitions that Discovery uses to identify and explore a device or application. A Functionality Definition specifies the order, type, and parameters of the probes that Discovery launches to gather information about a device or application12.

References:

• Functionality Definition
• Behavior

A MID Server needs to have access to the install.service-now.com domain to automatically stay up-to-date with instance versions. This domain hosts the MID Server upgrade files that are downloaded and installed by the MID Server when a new version is available. The MID Server checks for updates every 24 hours by default, or when the mid.upgrade.check_interval property is set12.

References:

• 1: ServiceNow Discovery Documentation, MID Server Upgrade section
• 2: ServiceNow Support Article, Connections to allow list for the MID Server

The Pattern Designer in ServiceNow Discovery uses different types of horizontal patterns to model various IT components and services. The temporary variable 'computer_system' seen in the pattern indicates that this is a 'Computer System' pattern type. This type of pattern is used to model and discover details about computer systems, which typically include hardware, operating system, and other related components.

The mid.discovery.max_pattern_payload_size property defines the maximum overall size for the returned payload that comes from patterns. This property is set on the MID Server and applies to all patterns that run on that MID Server. If the payload size exceeds this limit, the pattern execution fails and an error message is logged in the ECC queue. The default value of this property is 10 MB1.

References: 1: ServiceNow Docs - MID Server properties for Discovery and Service Mapping 2: ServiceNow Docs - Discovery payload size and processing

 The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI.

References: Discovery - How Location field is set for a CI, How to pass discovery schedule fields to a CI record via discovery

The $process.executableDir expression correctly calls the value of the executableDir variable from the tabular process variable. The process variable is a tabular variable that contains the output of the ps command, which lists the processes running on a CI. The executableDir variable is a column name that holds the directory path of the executable file for each process. To access the value of a column name from a tabular variable, you need to use the dot notation, such as $variable.columnName12.

References1: Pattern variables - Product Documentation: Tokyo - Now Support Portal2: Examples of EVAL scripts used in Discovery patterns - ServiceNow

In ServiceNow Discovery, relationships between Configuration Items (CIs) in a horizontal pattern are created using the "Create Relation/Reference" operation. This operation allows the pattern to define and establish relationships or references between discovered CIs, based on the information gathered during the discovery process. Options B and C are incorrect as relationships are not automatically created nor is it true that they cannot be created via patterns. Option D, "Create Connections," is not a standard operation in this context. References = ServiceNow Discovery documentation, specifically the sections on creating and managing horizontal discovery patterns.

 When Discovery or Service Mapping identifies a CI that matches an existing CI in the CMDB, it checks whether the CIs are duplicates or not. If they are duplicates, Discovery adds them to a de-duplication task, which is a record that groups duplicate CIs and allows you to review and remediate them. You can use the Duplicate CI Remediator wizard to merge, flag, retire, or delete the duplicate CIs. By default, Discovery does not send notifications, create identification rules, or stop the next discovery for duplicate CIs.

References: Handle Duplicate CIs in your CMDB, De-duplication tasks, How to de-duplicate 2 ESX servers with same name?

The ECC Queue tab displays the input and output messages from and to MID Servers. The default fields that are displayed on this tab are:

• Topic: The topic of the message, such as Discovery, Orchestration, or MID Server.
• Queue: The queue name of the message, such as input, output, or error.
• Source: The source of the message, such as the MID Server name, the instance name, or the probe name.
• State: The state of the message, such as ready, processed, or ignored.
• Created: The date and time when the message was created.
• Updated: The date and time when the message was last updated.

Some other fields that can be added to the ECC Queue tab are:

• Details: The details of the message, such as the payload, the response, or the error message.
• Pattern log link: The link to the pattern log file, if the message is related to a pattern execution.
• CMDB CI: The configuration item that is associated with the message, if any.
• Discovery schedule name: The name of the discovery schedule that triggered the message, if any.

References: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example, The ECC queue for Discovery

To troubleshoot discovery issues from a discovery status in ServiceNow, the following related lists can be particularly useful:

• Discovery Log - Provides detailed logs of the discovery process, helping to identify errors or issues encountered during discovery.
• ECC Queue - Shows the messages and data passed between the ServiceNow instance and the MID Server, offering insights into the communication and data exchange during discovery.
• Devices - Lists the devices discovered in the process, allowing for a direct view of the results and any potential issues with specific devices.

The "Running Processes" list is not typically used for troubleshooting discovery processes as it relates more to the operational aspects of the server or device rather than the discovery process itself. References = ServiceNow Discovery documentation, specifically the sections on Discovery troubleshooting and analysis, and the use of related lists for monitoring and troubleshooting purposes.

The Automation Error Messages list displays the errors that occurred during the execution of Discovery automation scripts. From this list, you can view the details of each error, such as the script name, the error message, the device, and the time. You can also perform actions on the errors, such as retrying the script, ignoring the error, or creating an incident. To do so, you can use the options on the right navigation pane, which are categorized as follows1:

• SELECT ALL: This option allows you to select all the errors in the list.
• SELECT ONE: This option allows you to select one error in the list by clicking on the checkbox next to it.
• ACTION ON SELECTED: This option allows you to perform an action on the selected errors, such as Retry, Ignore, or Create Incident. You can also choose to perform the action on all the errors in the list by selecting the All option from the drop-down menu.
• ACTION ON ALL: This option allows you to perform an action on all the errors in the list, regardless of the selection. You can choose from the same actions as the ACTION ON SELECTED option.

References:

• Discovery error messages: This article explains the different types of error messages and warnings in Discovery, and how to access and manage them.

Discovery uses the ping method to determine if a host IP is active or alive. Ping is a network utility that sends an ICMP echo request packet to a target IP address and waits for an ICMP echo reply packet. If the target IP address responds, it means that the host is active or alive12.

References:

• 1: ServiceNow Discovery Documentation, Discovery Process section
• 2: ServiceNow Discovery Overview, page 8

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

References: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures.

References: Credential affinity for Discovery and Orchestration, Credential Management in ServiceNow discovery

The Discovery Dashboard provides a summary of the Discovery status, including the number of active discovery errors, the number of devices discovered, and the number of credentials used. Each error has a help link that provides more information about the cause and possible solutions.

References:

• Discovery Dashboard
• Discovery troubleshooting | Error messages

 A scheduled job is a background process that runs at a specified time or interval to perform a specific task1. It is not a method for deleting specific CIs that are not discovered in 30 days. The other options are methods for deleting or updating CIs based on discovery data. A UI policy is a script that can dynamically change the behavior of a form or list2. A service mapping is a process that creates a map of the relationships between CIs that support a business service3. A data policy is a rule that enforces data consistency and accuracy by validating the data entered into a record.

References: 1: Scheduled Jobs 2: UI Policies 3: Service Mapping : Data Policies

The Set Parameter Value operation is used to assign a value to a variable in a Discovery pattern1. The syntax for this operation is as follows2:

Set Parameter Value: =

The  can be either a constant or an expression. To declare a constant, unchanging value, one must use quotes around the value. For example2:

Set Parameter Value: $name = "John"

This assigns the string “John” to the variable $name. The quotes indicate that the value is a constant and will not change. The other options, hash tag, brackets, and dollar sign, are not used to declare a constant value. They have different meanings in the syntax of the Set Parameter Value operation. A hash tag (#) is used to indicate a comment2. Brackets ([]) are used to access an element of an array or a map2. A dollar sign

In ServiceNow Discovery, most properties related to the Discovery module start with the prefix 'glide.discovery'. This naming convention is part of ServiceNow's system property design, where 'glide' typically indicates system properties and 'discovery' specifies that the property is related to the Discovery module. Properties are used to configure various aspects of the Discovery process, such as behavior, timeouts, and performance settings.

A horizontal pattern must have a TCP entry point type or an ALL entry point type to execute from a process classifier. A process classifier is a rule that matches a process running on a host and triggers a horizontal pattern to discover the application associated with that process1. The entry point type determines the type of connection that the pattern uses to access the target host. A TCP entry point type means that the pattern uses a TCP port to connect to the host, while an ALL entry point type means that the pattern can use any available connection method2.

References:

• 1: Process classifiers - Product Documentation: San Diego - ServiceNow
• 2: Horizontal Pattern probe - Product Documentation: San Diego - ServiceNow

For discovering Windows Servers, ServiceNow Discovery recommends using credentials that have a domain user account with local administrator access on the target servers. This level of access ensures that Discovery can successfully execute the necessary probes and sensors to collect comprehensive data about the server without being restricted by permission limitations. The other options either provide excessive permissions (like a domain administrator with sudo access) or insufficient privileges (like a standard domain user with read access).

When designing steps with operations requiring variables, it is best practice to query targets for variables1. This allows you to dynamically obtain the values of the variables from the target devices, rather than hard coding them or using scalar variables that may not reflect the current state of the target. Querying targets for variables also enables you to design for a dynamic environment, where the target configuration may change over time.

References:

• 1: Define discovery steps

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References1: Agent Client Collector - Product Documentation: San Diego - ServiceNow2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow

 To allow a MID Server to access servers using WinRM, the following configurations are required:

• MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.
• MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

References:

• Configure Windows servers for WinRM
• MID Server Parameters Add WinRM

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

• CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.
• Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.
• Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

References:

• 1: ServiceNow Discovery Documentation, Pattern Variables section
• 2: ServiceNow Discovery Overview, page 11