Free Practice Questions for ServiceNow CIS-Discovery Exam

The Parse File operation is used to extract information from a file and create variables to contain the extracted information1. The two main options within a Parse File operation are Select File and Define Parsing2. Select File allows you to specify the file path or browse to the file. Define Parsing allows you to select the relevant parsing strategy and define parsing criteria2.

References:

1: Parse a file

2: Define discovery steps

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping1. It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings2. The ECC Queue is a table that displays the input and output messages from and to MID Servers3. It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps4. The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution2.

References: 1: Discovery pattern log 2: View the Discovery pattern log 3: ECC Queue 4: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example

The Automation Error Messages list displays the errors that occurred during the execution of Discovery automation scripts. From this list, you can view the details of each error, such as the script name, the error message, the device, and the time. You can also perform actions on the errors, such as retrying the script, ignoring the error, or creating an incident. To do so, you can use the options on the right navigation pane, which are categorized as follows1:

SELECT ALL: This option allows you to select all the errors in the list.

SELECT ONE: This option allows you to select one error in the list by clicking on the checkbox next to it.

ACTION ON SELECTED: This option allows you to perform an action on the selected errors, such as Retry, Ignore, or Create Incident. You can also choose to perform the action on all the errors in the list by selecting the All option from the drop-down menu.

ACTION ON ALL: This option allows you to perform an action on all the errors in the list, regardless of the selection. You can choose from the same actions as the ACTION ON SELECTED option.

References:

Discovery error messages: This article explains the different types of error messages and warnings in Discovery, and how to access and manage them.

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

References:

Discovery Schedule form

Shazzam Probe

Discovery IP range

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Pattern is a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

References:

1: Tracked Configuration files - Product Documentation: San Diego - ServiceNow

2: Tracked Configuration files pattern - Product Documentation: San Diego - ServiceNow

3: Patterns and horizontal discovery - Product Documentation: Tokyo - ServiceNow

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable. Get Process executes a command to list the processes running on a target and stores the results in a variable12.

References:

Pattern operations - Product Documentation: Vancouver - ServiceNow

Pattern operations - Product Documentation: San Diego - Now Support Portal

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context. References = ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

A Discovery schedule of type Configuration Item collects complete information from the scanned IP ranges and sends it to the CMDB. This type of schedule runs a series of probes and sensors to identify and classify the devices and applications on the network, and to create or update the corresponding configuration items in the CMDB. A Discovery schedule of type Configuration Item can also run patterns to discover more details and relationships about the configuration items.

References:

ServiceNow Discovery Overview

Create a Discovery schedule

Discovery schedule types

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References1: Agent Client Collector - Product Documentation: San Diego - ServiceNow2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow