CIS-DISCOVERY Practice Questions

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service

Mapping1. It shows the success or failure of the individual pattern steps, as well as the input and

output variables, the CI attributes and relationships, and the errors or warnings2. The ECC Queue is a

table that displays the input and output messages from and to MID Servers3. It shows the payload of

CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not

the success or failure of the individual pattern steps4. The success or failure of the individual pattern

steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern

execution2.

Reference: 1: Discovery pattern log 2: View the Discovery pattern log 3: ECC Queue 4: ECC Queue

Processing and Debugging, with “Discovery - Sensors” used as an example

:

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A

Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the

IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in

the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will

round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for

each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend

on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be

launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total

number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

Reference:

Discovery Schedule form

Shazzam Probe

Discovery IP range

According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name. Reference: Create a Discovery CI classification - Product Documentation: Tokyo - Now Support Portal Identification rules - Product Documentation: Tokyo - Now Support Portal ServiceNow IRE: Identification Rules Explained — Cookdown

When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's

often necessary to also increase the memory allocated to the MID Server application. This is because

more threads can result in higher memory usage as each thread may consume resources while

performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing

the MID Server max payload size are not directly related to the number of threads used by a MID

Server. Reference = ServiceNow Discovery documentation, especially sections discussing MID Server

configuration and performance tuning.

A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores

information about web servers1.

B is true because the merge table operation is typically used for application patterns, which are

horizontal patterns that discover applications and their dependencies. The condition on the

process.executablePath variable suggests that the operation is looking for a specific application

(mongoose) running on the web servers.

D is true because the merge table operation requires at least one matching field value between the

two source tables1. In this case, the process.executablePath variable is the matching field, and it

must contain “mongoose” for the operation to run.

Reference:

1: Merge tables - Product Documentation: San Diego - Now Support Portal

3: Product Documentation | ServiceNow

[4]: Discovery Patterns - Product Documentation: San Diego - Now Support Portal

:

To allow a MID Server to access servers using WinRM, the following configurations are required:

MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to

accept WinRM connections from the MID Servers and grant them the necessary permissions to

execute commands and scripts1.

MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for

Discovery and Orchestration and specify the WinRM port, authentication method, and encryption

settings2.

Reference:

Configure Windows servers for WinRM

MID Server Parameters Add WinRM

The Shazzam Batch Size property determines how many IP addresses are scanned by a single

Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a

single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This

property can be configured in the Discovery Properties module under Discovery Definition2.

Reference: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties -

ServiceNow]

Based on the image, the value assigned to the label “Value” is a concatenation of variables and

strings. One of the variables is $name_details[1].exec_info, which indicates that $name_details is a

tabular variable, meaning an array or a map that can store multiple values1. The [1] is the index or

the key that accesses the element of the tabular variable. The .exec_info is the attribute or the

property of the element. Therefore, the choice D is true.

The other choices are not true based on the image. The choice A is false because the image does not

show any WMI query operation step. A WMI query operation step is a pattern step that executes a

WMI query on a Windows device and returns the results as a tabular variable2. The image does not

show any WMI query syntax or result. The choice B is false because there is no scalar variable labeled

‘1’. A scalar variable is a variable that can store only one value1. The image shows a label “Value” but

not a variable name. The choice C is false because the value can be used in a pattern step. A pattern

step is a unit of logic that performs a specific action during Discovery or Service Mapping3. The value

can be used as an input or an output of a pattern step, depending on the context.

Reference: 2: Define a WMI query 3: Pattern steps 1: Pattern variables