ServiceNow CIS-Discovery Certified Implementation Specialist - Discovery Exam Practice Test

Horizontal pattern types are used to discover the configuration items (CIs) that belong to a specific category or class, such as infrastructure or application. They define the operations that Discovery performs to identify and classify the CIs, and the attributes that Discovery populates for each CI. Horizontal patterns can be applied to any operating system or platform that supports the required protocols and commands12.

References:

• Horizontal discovery patterns
• Discovery pattern types

The Pattern Designer is a graphical tool that allows users to create and edit horizontal discovery patterns. The Pattern Designer has three main sections: the left section shows the CI type and the pattern type, the middle section shows the pattern steps and the flow diagram, and the far-right section shows the details of the selected step or operation. The far-right section can display the following tabs, depending on the type of step or operation selected12:

• Operations: This tab shows the list of available operations that can be added to the pattern, such as Execute Command, Parse File, Set Parameter Value, etc. Operations are the basic building blocks of a pattern that perform specific actions on the target device or the MID Server.
• CI Attributes: This tab shows the list of attributes that can be set or updated for the CI type of the pattern, such as name, serial number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information collected by the pattern.
• Temporary Variables: This tab shows the list of temporary variables that can be created or used by the pattern, such as $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data within the pattern, such as the output of a command, the value of a parameter, or the result of a calculation.
• CMDB Dashboard: This tab shows the CMDB dashboard that displays the CI record and its related lists, such as relationships, identification rules, sensors, etc. The CMDB dashboard is used to preview and verify the outcome of the pattern on the CI record in the CMDB.

References:

• 1: ServiceNow Discovery Documentation, Pattern Designer section
• 2: ServiceNow Discovery Overview, page 11

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context. References = ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

The ECC Queue is the normal connection point between an instance and other systems that integrate with ServiceNow, such as MID Servers1. The ECC Queue displays input and output messages from and to MID Servers2. The actual XML payload that is sent to or from an instance is stored in the ECC Queue3. The ECC Queue also provides a connected flow of probe and sensor activity, as probes are sent from the instance to the MID Server, and sensors are sent from the MID Server to the instance2.

References:

• 1: ServiceNow Discovery Overview
• 2: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example
• 3: Manage ECC Queue content for a MID Server

The Discovery Dashboard provides a summary of the Discovery status, including the number of active discovery errors, the number of devices discovered, and the number of credentials used. Each error has a help link that provides more information about the cause and possible solutions.

References:

• Discovery Dashboard
• Discovery troubleshooting | Error messages

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

Discovery and Service Mapping are both products that help to identify and map the IT infrastructure and services in an organization. However, they have different approaches and objectives. Discovery uses IP address ranges as the starting point for finding devices and applications on the network, and then runs probes and sensors to collect information and classify them. Discovery focuses on inventory-related use-cases, such as asset management, configuration management, and compliance. Service Mapping uses entry points, such as URLs or host names, as the starting point for mapping business services and their dependencies. Service Mapping runs patterns, which are sequences of operations that follow the traffic connections between devices and applications, and then creates a service map that shows the logical and semantic relationships. Service Mapping focuses on service-related use-cases, such as service availability, impact analysis, and root cause analysis12.

References:

• 1: ServiceNow Discovery Overview, page 9
• 2: ServiceNow Discovery Documentation, Service Mapping section

During the Discovery process, the Model Category of the Configuration Item (CI) determines if an Asset record is created. A Model Category is a grouping of models that share the same asset tracking strategy and the same CI and Asset tables. The asset tracking strategy defines whether Discovery creates an Asset record for each CI of that Model Category. There are three possible asset tracking strategies: Create Assets, Don’t create Assets, and Create Consumable Assets12.

References:

• 1: ServiceNow Discovery Documentation, Model Categories section
• 2: ServiceNow Support Article, Why do Assets get created when inserting a CI that has a Model that is set to Don’t create Assets?

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

• CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.
• Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.
• Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

References:

• 1: ServiceNow Discovery Documentation, Pattern Variables section
• 2: ServiceNow Discovery Overview, page 11

Quick Discovery is a wizard that helps you get up and running with Discovery quickly. It discovers both physical and logical components, including virtual machines, servers, storage, databases, applications, and more. To use Quick Discovery, you need to have a MID Server installed and configured, and provide a target IP range or subnet to scan. You do not need to create a Discovery Schedule or a PID for Quick Discovery.

References: ServiceNow Discovery Data Sheet, Discovery Quick Start

The Set Parameter Value operation is used to assign a value to a variable in a Discovery pattern1. The syntax for this operation is as follows2:

Set Parameter Value: =

The  can be either a constant or an expression. To declare a constant, unchanging value, one must use quotes around the value. For example2:

Set Parameter Value: $name = "John"

This assigns the string “John” to the variable $name. The quotes indicate that the value is a constant and will not change. The other options, hash tag, brackets, and dollar sign, are not used to declare a constant value. They have different meanings in the syntax of the Set Parameter Value operation. A hash tag (#) is used to indicate a comment2. Brackets ([]) are used to access an element of an array or a map2. A dollar sign

Based on the image, the value assigned to the label “Value” is a concatenation of variables and strings. One of the variables is $name_details[1].exec_info, which indicates that $name_details is a tabular variable, meaning an array or a map that can store multiple values1. The [1] is the index or the key that accesses the element of the tabular variable. The .exec_info is the attribute or the property of the element. Therefore, the choice D is true.

The other choices are not true based on the image. The choice A is false because the image does not show any WMI query operation step. A WMI query operation step is a pattern step that executes a WMI query on a Windows device and returns the results as a tabular variable2. The image does not show any WMI query syntax or result. The choice B is false because there is no scalar variable labeled ‘1’. A scalar variable is a variable that can store only one value1. The image shows a label “Value” but not a variable name. The choice C is false because the value can be used in a pattern step. A pattern step is a unit of logic that performs a specific action during Discovery or Service Mapping3. The value can be used as an input or an output of a pattern step, depending on the context.

References: 2: Define a WMI query 3: Pattern steps 1: Pattern variables

A horizontal discovery pattern is a sequence of operations that collects information about a specific type of configuration item (CI), such as an operating system, a database, or a web server1. A horizontal discovery pattern does not use the connectivity section, which is only used for the application pattern type2. The connectivity section defines how to connect to a CI and run commands on it3. A horizontal discovery pattern uses the following sections1:

• Variables: Defines the variables that store the data collected by the pattern and map them to the target table fields.
• Identification: Defines the criteria to identify a CI and update or create a record in the CMDB.
• Operations: Defines the actions to perform on the target CI, such as running commands, querying databases, or parsing files.

References: 1: ServiceNow Docs - Horizontal discovery patterns 2: ServiceNow Docs - Application pattern types 3: ServiceNow Docs - Connectivity section

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

References: Patterns and horizontal discovery, Available discovery patterns

For discovering Windows Servers, ServiceNow Discovery recommends using credentials that have a domain user account with local administrator access on the target servers. This level of access ensures that Discovery can successfully execute the necessary probes and sensors to collect comprehensive data about the server without being restricted by permission limitations. The other options either provide excessive permissions (like a domain administrator with sudo access) or insufficient privileges (like a standard domain user with read access).

The Application Pattern Type is a pattern that discovers applications and their dependencies by using probes and sensors1. It has two main components: the Run Order and the Identification Section2. The Run Order defines the sequence of probes and sensors that Discovery uses to find and classify CIs2. The Identification Section specifies the criteria that Discovery uses to identify CIs and their relationships2. The other options, CI Type and Operating System, are not specific to the Application Pattern Type. They are used for other pattern types, such as the Horizontal Pattern Type and the Service Mapping Pattern Type3 .

References: 1: Application Pattern Type 2: Application Pattern Type components 3: Horizontal Pattern Type : Service Mapping Pattern Type

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Pattern is a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

References:

• 1: Tracked Configuration files - Product Documentation: San Diego - ServiceNow
• 2: Tracked Configuration files pattern - Product Documentation: San Diego - ServiceNow
• 3: Patterns and horizontal discovery - Product Documentation: Tokyo - ServiceNow

The image shows a part of a horizontal pattern in Pattern Designer that uses the WMI Query operation to retrieve information about the processes running on a Windows server. The operation takes a WQL query as an input parameter and returns a tabular variable that contains the results of the query. The tabular variable is named ‘WMI Query’ by default, but it can be renamed by the user. The WQL query in the image selects four attributes from the Win32_Process class: Name, MaximumWorkingSetSize, PageFaults, and PeakVirtualSize. These attributes are stored as scalar variables in the tabular variable, and they can be accessed by using the dot notation, such as WMI Query.Name or WMI Query.MaximumWorkingSetSize. Therefore, the most probable results of the image are a tabular variable named ‘WMI Query’ and two scalar variables named ‘MaximumWorkingSetSize’ and ‘PeakVirtualSize’.

References:

• Pattern Designer | WMI Query
• Win32_Process class
• WQL (SQL for WMI)

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload. The thread count can be configured by changing the MID Server parameters in the ServiceNow instance12. References = 1: MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow 2: Product Documentation | ServiceNow

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

 File Based Discovery is used to discover file paths to recognize the signature of installed software. File Based Discovery helps to identify what software is running on Windows and UNIX servers and devices by scanning the file system for specific files or directories that indicate the presence of a software product1. File Based Discovery can also check the file size, version, and checksum of the discovered files to verify the software installation2. File Based Discovery can be configured using file signatures, which are patterns that match the file paths of software products3.

References: 1: File Based Discovery - Support and Troubleshooting - Now Support Portal 2: Use file-based service discovery to discover scrape targets | Prometheus 3: How File based discovery can be used to populate software record running on Linux host. - Support and Troubleshooting - Now Support Portal

On the ECC Queue, sensor records have a Queue value of output and probe records have a Queue value of input. The ECC Queue is the connection point between the instance and the MID Server, and it displays the input and output messages from and to the MID Server1. A probe is a message that the instance sends to the MID Server to request information from a device or application2. A sensor is a script that the MID Server runs to process the results returned by the probe3. When a probe is created, it is inserted into the ECC Queue with a Queue value of input, which means that it is waiting to be picked up by the MID Server4. When a sensor is created, it is inserted into the ECC Queue with a Queue value of output, which means that it is waiting to be processed by the instance.

References: 1: ECC Queue - ServiceNow 2: Probes - ServiceNow 3: Sensors - ServiceNow 4: How the ECC Queue table records get processed: from output ready to input processed - Support and Troubleshooting - Now Support Portal : [ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example - Support and Troubleshooting - Now Support Portal]

 Based on the web search results from the search_web tool, the following choices best represent key capabilities of a ServiceNow ITOM Enterprise solution:

• Manage Hybrid Clouds: ServiceNow ITOM enables organizations to gain visibility into their IT environment, on-premises to cloud, and see the impact of their applications on business services12. It also helps to plan, track, and secure cloud implementation through best-practice governance1. Four apps comprise Cloud Accelerate to help prepare for cloud migration, streamline provisioning requests, and manage cloud resources1.
• Proactively Eliminate Service Outages: ServiceNow ITOM helps to predict issues, reduce user impact, and automate resolutions with predictive AIOps and automation13. It analyzes telemetry and log data using AI to reduce noise, expedite mapping and predict issues1. It also delivers proactive digital operations with real-time log data to solve problems quickly1.

The other choices are not specific to ServiceNow ITOM Enterprise solution, but rather general features of the ServiceNow platform. The ServiceNow platform allows users to create an engaging user experience with intuitive interfaces and workflows. It also enables users to build new apps fast with low-code development tools and pre-built components.

References: 1: ITOM - Enterprise IT Operations Management - ServiceNow 2: ServiceNow IT Operations Management (ITOM) Services | Jade 3: Modernize IT Operations Management with ServiceNow ITOM : ServiceNow Platform

Horizontal discovery patterns are a series of operations that tell Discovery which CIs to find on your network, what credentials to use, and what tables to populate in the CMDB. Horizontal discovery patterns use variables to store and pass information between the operations. By default, there are two variables that are automatically available for horizontal discovery patterns: infrastructure_system and computer_system. These variables store the information about the infrastructure and the computer system of the target CI, respectively. They are populated by the Horizontal Pattern probe and sensor, which enable Discovery to use patterns for horizontal discovery123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal
• Using patterns for horizontal discovery - Product Documentation: Vancouver - ServiceNow

The mid.discovery.max_pattern_payload_size property defines the maximum overall size for the returned payload that comes from patterns. This property is set on the MID Server and applies to all patterns that run on that MID Server. If the payload size exceeds this limit, the pattern execution fails and an error message is logged in the ECC queue. The default value of this property is 10 MB1.

References: 1: ServiceNow Docs - MID Server properties for Discovery and Service Mapping 2: ServiceNow Docs - Discovery payload size and processing

Discovery finds and maps dependencies for the following types of storage devices: Direct-attached storage (DAS), network-attached storage (NAS), or storage area network (SAN)1. NAS or SAN storage that is discovered via a Storage Management Initiative Specification (SMI-S) and Common Information Model (CIM) is also supported2. Discovery collects information about storage area networks from specialized devices, such as storage arrays and Fibre Channel (FC) switches, and creates specific references between the tables in the SAN3. Discovery does not support Multiple area network (MAN) or Redundant Array of Independent Disks (RAID) as types of storage devices.

References:

• 1: Storage device discovery
• 2: Storage Discovery via SMI-S and CIM
• 3: Discovery of storage area networks (SAN)

In ServiceNow Discovery, relationships between Configuration Items (CIs) in a horizontal pattern are created using the "Create Relation/Reference" operation. This operation allows the pattern to define and establish relationships or references between discovered CIs, based on the information gathered during the discovery process. Options B and C are incorrect as relationships are not automatically created nor is it true that they cannot be created via patterns. Option D, "Create Connections," is not a standard operation in this context. References = ServiceNow Discovery documentation, specifically the sections on creating and managing horizontal discovery patterns.

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

References: The explanation is based on the following sources:

• Activate pattern Debug mode: This document explains how to activate the Debug mode and use the Debug Identification Section to debug a pattern.
• ServiceNow Exam CIS-Discovery Topic 6 Question 9 Discussion: This discussion provides a similar question and answer about the Debug Identification Section in Debug Mode.

An extension section of a discovery pattern is a section that allows you to modify or extend the functionality of an existing pattern without customizing it. An extension section can contain shared libraries, which are reusable code snippets that can be invoked from any pattern or extension section. Shared libraries can be used to define common functions, variables, or constants that are used across multiple patterns or extension sections. Shared libraries can also be used to override the default behavior of some built-in functions, such as identification or classification12. References = 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow 2: How to Create Discovery Pattern Extensions and Why to Use Them

During the Port Scan phase in ServiceNow Discovery, the warning level error "No results returned from probe" typically indicates a connectivity issue. This error often arises when a logical or physical firewall is blocking the connectivity between the MID Server and the target device. This prevents the probe from successfully scanning the ports and returning results. The other options, such as incorrect process classifier configuration, wrong credentials, or incorrect datasource precedence, would generally lead to different types of errors or issues in the discovery process. References = ServiceNow Discovery documentation, particularly the sections that deal with troubleshooting Port Scan issues and understanding common errors during Discovery phases.

The SNMP Query pattern operation executes an SNMP query on a target device and stores the results in a variable. The Variable Type field determines the format of the results. There are two valid Variable Types for this operation: Table and Scalar. Table is used when the query returns multiple values, such as a list of interfaces or processes. Scalar is used when the query returns a single value, such as the system name or uptime12.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• SNMP Query pattern operation - Product Documentation: Vancouver - ServiceNow

In configuring the MID Server Service Settings in ServiceNow, the MID Server name must adhere to certain naming conventions. Among the options provided, "mid server1" (D) is not a valid MID Server name because it contains a space. MID Server names should not include spaces or special characters that are not typically used in naming conventions. Names like "mymidserver1," "mid.server1," and "midserver1" are more in line with the standard naming practices. References = ServiceNow MID Server documentation, specifically the sections detailing MID Server configuration and naming conventions.

Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures.

References: Credential affinity for Discovery and Orchestration, Credential Management in ServiceNow discovery