Question 1

What would you see in the Discovery pattern log that you would not see in the ECC Queue?

Accepted Answer

A

Explanation: The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping1. It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings2. The ECC Queue is a table that displays the input and output messages from and to MID Servers3. It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps4. The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution2. Reference: 1: Discovery pattern log 2: View the Discovery pattern log 3: ECC Queue 4: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example

Question 2

Which must be configured to allow a MID Server to access servers using WinRM?

Accepted Answer

A

Explanation: :

Question 3

A Discovery Schedule contains a /24 subnet IP Range and a Shazzam batch size of 5000. How many times will a Shazzam probe be launched during discovery?

Accepted Answer

C

Explanation: A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N. Reference: Discovery Schedule form Shazzam Probe Discovery IP range

Question 4

A discovery runs against a Windows Server returning the following attribute values for the first time: name = WindowsSN1 serial_number = 12321 A subsequent discovery is ran against a different Windows Server returning the following attribute values: name = WindowsSN2 serial_number = 12321 With only base system CI Identifiers configured, which of the following is true?

Accepted Answer

B

Explanation: According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name. Reference: Create a Discovery CI classification - Product Documentation: Tokyo - Now Support Portal Identification rules - Product Documentation: Tokyo - Now Support Portal ServiceNow IRE: Identification Rules Explained — Cookdown

Question 5

Which of the following best describes what may also be required when increasing the max number of threads for a MID Server?

Accepted Answer

C

Explanation: When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's often necessary to also increase the memory allocated to the MID Server application. This is because more threads can result in higher memory usage as each thread may consume resources while performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing the MID Server max payload size are not directly related to the number of threads used by a MID Server. Reference = ServiceNow Discovery documentation, especially sections discussing MID Server configuration and performance tuning.

Question 6

Refer to the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/ServiceNow_CIS-DISCOVERY/page_2_img_1.jpg Based on this image, which of the following statements are true? (Choose three.)

Accepted Answer

A, B, D

Explanation: A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores information about web servers1. B is true because the merge table operation is typically used for application patterns, which are horizontal patterns that discover applications and their dependencies. The condition on the process.executablePath variable suggests that the operation is looking for a specific application (mongoose) running on the web servers. D is true because the merge table operation requires at least one matching field value between the two source tables1. In this case, the process.executablePath variable is the matching field, and it must contain “mongoose” for the operation to run. Reference: 1: Merge tables - Product Documentation: San Diego - Now Support Portal 3: Product Documentation | ServiceNow [4]: Discovery Patterns - Product Documentation: San Diego - Now Support Portal

Question 7

Which service needs to be running on a host to detect a Windows device?

Accepted Answer

B

Explanation: :

Question 8

Which of the following must be configured to allow a MID Server to access servers using WinRM? (Choose two.)

Accepted Answer

Explanation: To allow a MID Server to access servers using WinRM, the following configurations are required: MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1. MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2. Reference: Configure Windows servers for WinRM MID Server Parameters Add WinRM

Question 9

Which choice allows the following functionality to occur?
If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it
creates 10 Shazzam probes with each probe scanning 1000 IP addresses.

Accepted Answer

C

Explanation: The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2. Reference: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

Question 10

Based on this image, which of the following choices is true? https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/ServiceNow_CIS-DISCOVERY/page_28_img_1.jpg

Accepted Answer

D

Explanation: Based on the image, the value assigned to the label “Value” is a concatenation of variables and strings. One of the variables is $name_details[1].exec_info, which indicates that $name_details is a tabular variable, meaning an array or a map that can store multiple values1. The [1] is the index or the key that accesses the element of the tabular variable. The .exec_info is the attribute or the property of the element. Therefore, the choice D is true. The other choices are not true based on the image. The choice A is false because the image does not show any WMI query operation step. A WMI query operation step is a pattern step that executes a WMI query on a Windows device and returns the results as a tabular variable2. The image does not show any WMI query syntax or result. The choice B is false because there is no scalar variable labeled ‘1’. A scalar variable is a variable that can store only one value1. The image shows a label “Value” but not a variable name. The choice C is false because the value can be used in a pattern step. A pattern step is a unit of logic that performs a specific action during Discovery or Service Mapping3. The value can be used as an input or an output of a pattern step, depending on the context. Reference: 2: Define a WMI query 3: Pattern steps 1: Pattern variables

Question 11

A network device has both an SSH port and an SNMP port open. Discovery tries the SSH probe first
and it fails. This triggers the SNMP probe, which succeeds. Discovery uses SNMP first for subsequent
discoveries on that device.
What discovery functionality allows the above to happen?

Accepted Answer

B

Explanation: Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures. Reference: Credential affinity for Discovery and Orchestration, Credential Management in ServiceNow discovery

Question 12

On the ECC Queue, sensor records have a Queue value of ___________ and probe records have a Queue value of ___________.

Accepted Answer

D

Explanation: On the ECC Queue, sensor records have a Queue value of output and probe records have a Queue value of input. The ECC Queue is the connection point between the instance and the MID Server, and it displays the input and output messages from and to the MID Server1. A probe is a message that the instance sends to the MID Server to request information from a device or application2. A sensor is a script that the MID Server runs to process the results returned by the probe3. When a probe is created, it is inserted into the ECC Queue with a Queue value of input, which means that it is waiting to be picked up by the MID Server4. When a sensor is created, it is inserted into the ECC Queue with a Queue value of output, which means that it is waiting to be processed by the instance. Reference: 1: ECC Queue - ServiceNow 2: Probes - ServiceNow 3: Sensors - ServiceNow 4: How the ECC Queue table records get processed: from output ready to input processed - Support and Troubleshooting - Now Support Portal : [ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example - Support and Troubleshooting - Now Support Portal]

Question 13

As a first step in horizontal discovery, where is the Shazzam probe input placed in a request?

Accepted Answer

D

Explanation: :

Question 14

What is found on the far-right section of the Pattern Designer for horizontal patterns? (Choose two.)

Accepted Answer

A, C

Explanation: The Pattern Designer is a graphical tool that allows users to create and edit horizontal discovery patterns. The Pattern Designer has three main sections: the left section shows the CI type and the pattern type, the middle section shows the pattern steps and the flow diagram, and the far-right section shows the details of the selected step or operation. The far-right section can display the following tabs, depending on the type of step or operation selected12: Operations: This tab shows the list of available operations that can be added to the pattern, such as Execute Command, Parse File, Set Parameter Value, etc. Operations are the basic building blocks of a pattern that perform specific actions on the target device or the MID Server. CI Attributes: This tab shows the list of attributes that can be set or updated for the CI type of the pattern, such as name, serial number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information collected by the pattern. Temporary Variables: This tab shows the list of temporary variables that can be created or used by the pattern, such as $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data within the pattern, such as the output of a command, the value of a parameter, or the result of a calculation. CMDB Dashboard: This tab shows the CMDB dashboard that displays the CI record and its related lists, such as relationships, identification rules, sensors, etc. The CMDB dashboard is used to preview and verify the outcome of the pattern on the CI record in the CMDB. Reference: 1: ServiceNow Discovery Documentation, Pattern Designer section 2: ServiceNow Discovery Overview, page 11

Question 15

Which choice will populate the Location field for a discovered CI?

Accepted Answer

A

Explanation: The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI. Reference: Discovery - How Location field is set for a CI, How to pass discovery schedule fields to a CI record via discovery

Free ServiceNow CIS-Discovery Actual Exam Questions