ServiceNow CIS-Discovery Certified Implementation Specialist - Discovery Exam Practice Test

The main Key Performance Indicators (KPIs) for the CMDB Health scorecard in ServiceNow include Correctness, Completeness, and Staleness. These KPIs are critical for assessing the overall health and quality of the CMDB. Correctness refers to the accuracy of the data in the CMDB, Completeness measures whether all required CI data is present, and Staleness indicates the freshness or timeliness of the CI data. Compliance and Duplicates, while important, are not considered main KPIs in the context of the CMDB Health scorecard.References= ServiceNow CMDB documentation and CMDB Health Dashboard user guide, focusing on the key performance indicators for CMDB health.

A MID Server needs to have access to the install.service-now.com domain to automatically stay up-to-date with instance versions. This domain hosts the MID Server upgrade files that are downloaded and installed by the MID Server when a new version is available. The MID Server checks for updates every 24 hours by default, or when the mid.upgrade.check_interval property is set12.

 When Discovery or Service Mapping identifies a CI that matches an existing CI in the CMDB, it checks whether the CIs are duplicates or not. If they are duplicates, Discovery adds them to a de-duplication task, which is a record that groups duplicate CIs and allows you to review and remediate them. You can use the Duplicate CI Remediator wizard to merge, flag, retire, or delete the duplicate CIs. By default, Discovery does not send notifications, create identification rules, or stop the next discovery for duplicate CIs.

When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's often necessary to also increase the memory allocated to the MID Server application. This is because more threads can result in higher memory usage as each thread may consume resources while performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing the MID Server max payload size are not directly related to the number of threads used by a MID Server.References= ServiceNow Discovery documentation, especially sections discussing MID Server configuration and performance tuning.

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

 The Shazzam probe is placed in the ECC queue as a first step in horizontal discovery. The ECC queue is a table that stores requests and responses for communication between the MID Server and the ServiceNow instance1. The Shazzam probe is a script that performs port scanning on a target host to determine what protocols are available and what classifiers to trigger2. The Shazzam probe is sent from the ServiceNow instance to the MID Server, which executes it on the target host and returns the results to the ECC queue3.

 Discovery can provide information about the relationships between configuration items (CIs), including applications and hosts. Application relationships are the connections between applications that run on different hosts or servers, such as web servers, databases, load balancers, etc. Host relationships are the connections between applications and the hosts or servers that they run on, such as Windows, Linux, Unix, etc. Discovery can identify these relationships using various methods, such as probes, sensors, patterns, file-based discovery, etc. Discovery can also create and update these relationships in the CMDB, using the Depends on::Used by or Runs on::Runs relationship types.

Discovery and Service Mapping are both products that help to identify and map the IT infrastructure and services in an organization. However, they have different approaches and objectives. Discovery uses IP address ranges as the starting point for finding devices and applications on the network, and then runs probes and sensors to collect information and classify them. Discovery focuses on inventory-related use-cases, such as asset management, configuration management, and compliance. Service Mapping uses entry points, such as URLs or host names, as the starting point for mapping business services and their dependencies. Service Mapping runs patterns, which are sequences of operations that follow the traffic connections between devices and applications, and then creates a service map that shows the logical and semantic relationships. Service Mapping focuses on service-related use-cases, such as service availability, impact analysis, and root cause analysis12.

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

In ServiceNow Discovery, when encountering the error 'Active, couldn't classify' during the discovery of a new SNMP network device, it typically indicates an issue with the classification process. Classification is a crucial initial step in the Discovery process, where the system determines the type of device it is interacting with. If an SNMP Classification rule for the new device type does not exist or needs updating, Discovery will be unable to classify and thus properly discover the device. Incorrect SNMP credentials or firewall issues usually result in different types of errors, such as authentication failures or no response from the device.

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Patternis a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

To troubleshoot discovery issues from a discovery status in ServiceNow, the following related lists can be particularly useful:

Discovery Log- Provides detailed logs of the discovery process, helping to identify errors or issues encountered during discovery.

ECC Queue- Shows the messages and data passed between the ServiceNow instance and the MID Server, offering insights into the communication and data exchange during discovery.

Devices- Lists the devices discovered in the process, allowing for a direct view of the results and any potential issues with specific devices.

The "Running Processes" list is not typically used for troubleshooting discovery processes as it relates more to the operational aspects of the server or device rather than the discovery process itself.References= ServiceNow Discovery documentation, specifically the sections on Discovery troubleshooting and analysis, and the use of related lists for monitoring and troubleshooting purposes.

ServiceNow Discovery can be extended in three main ways: Classifiers, Probes & Sensors, and Discovery Patterns. Classifiers are used to identify the type of device or application that is being discovered, based on the information returned by a probe. Probes are commands or scripts that are executed on the target device or application to collect data. Sensors are scripts that process the data collected by probes and create or update configuration items (CIs) in the CMDB. Discovery Patterns are graphical representations of the discovery process that can be customized or created to discover specific types of devices or applications, using classifiers, probes, and sensors as building blocks.

 The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI.

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

 To allow a MID Server to access servers using WinRM, the following configurations are required:

MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.

MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context.References= ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

A horizontal discovery pattern is a sequence of operations that collects information about a specific type of configuration item (CI), such as an operating system, a database, or a web server1. A horizontal discovery pattern does not use the connectivity section, which is only used for the application pattern type2. The connectivity section defines how to connect to a CI and run commands on it3. A horizontal discovery pattern uses the following sections1:

Variables: Defines the variables that store the data collected by the pattern and map them to the target table fields.

Identification: Defines the criteria to identify a CI and update or create a record in the CMDB.

Operations: Defines the actions to perform on the target CI, such as running commands, querying databases, or parsing files.

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.

A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.

An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.

Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.

Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

In a Merge Table pattern operation within ServiceNow Discovery, the editable fields typically include the Target Table, Second Table, and First Table. These fields are configurable and allow users to specify the tables involved in the merge operation. The Target Table is where the merged data will be stored, while the First and Second Tables are the source tables whose data is being merged. The Primary Table is not typically an editable field in this context.References= ServiceNow Discovery documentation, particularly the sections discussing pattern design and operations, including Merge Table operations within Discovery Patterns.

CI identifiers can be viewed under the CI record1. A CI identifier is a set of attributes that uniquely identify a CI of a specific class2. CI identifiers are used by the identification and reconciliation engine (IRE) to match incoming data with existing CIs in the CMDB3. CI identifiers can be viewed and edited in the CI record by clicking the Identification Information related link1.

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

 Reconciliation rules are used to determine which data sources can update CI attributes in ServiceNow. Reconciliation rules can be static or dynamic, and they can be applied to specific CI classes, attributes, or discovery sources. Reconciliation rules can also specify the actions to take when there are unmatched values, such as removing, ignoring, or updating them1.

A horizontal pattern must have a TCP entry point type or an ALL entry point type to execute from a process classifier. A process classifier is a rule that matches a process running on a host and triggers a horizontal pattern to discover the application associated with that process1. The entry point type determines the type of connection that the pattern uses to access the target host. A TCP entry point type means that the pattern uses a TCP port to connect to the host, while an ALL entry point type means that the pattern can use any available connection method2.

The reconciliation process in ServiceNow refers to the method of ensuring data integrity and consistency in the Configuration Management Database (CMDB) by allowing only designated authoritative data sources to write or update information at the CI (Configuration Item) table and attribute level. This process helps maintain accurate and reliable data in the CMDB by controlling how and from where data is sourced and updated. The other options describe different processes or aspects of CMDB management and are not directly related to the reconciliation process.References= ServiceNow CMDB documentation, particularly the sections on CI data management and reconciliation processes.

The recommended method for excluding specific software from discovery on Windows and Unix Servers in ServiceNow Discovery is by modifying the probes. Probes are the components in ServiceNow that collect data from devices. By modifying the probes, specific software can be excluded from the discovery process. Options A, C, and D are less direct methods for achieving this specific requirement.References= ServiceNow Discovery documentation, particularly in the sections related to probe configuration and modification.