CIS-Discovery Certified Implementation Specialist - Discovery Question and Answers

CI identifiers can be viewed under the CI record1. A CI identifier is a set of attributes that uniquely identify a CI of a specific class2. CI identifiers are used by the identification and reconciliation engine (IRE) to match incoming data with existing CIs in the CMDB3. CI identifiers can be viewed and edited in the CI record by clicking the Identification Information related link1.

References:

• 1: View and edit CI identifiers
• 2: Create or edit a CI identification rule
• 3: Identification rules

The reconciliation process in ServiceNow refers to the method of ensuring data integrity and consistency in the Configuration Management Database (CMDB) by allowing only designated authoritative data sources to write or update information at the CI (Configuration Item) table and attribute level. This process helps maintain accurate and reliable data in the CMDB by controlling how and from where data is sourced and updated. The other options describe different processes or aspects of CMDB management and are not directly related to the reconciliation process. References = ServiceNow CMDB documentation, particularly the sections on CI data management and reconciliation processes.

Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures.

References: Credential affinity for Discovery and Orchestration, Credential Management in ServiceNow discovery

The Put file operation allows the transfer of a file from the MID Server to a target1. This operation can be used to copy files from the MID Server to a target device, such as configuration files, scripts, or binaries2. The Put file operation requires the file path on the MID Server and the file path on the target as inputs2.

References:

• 1: Put file
• 2: Define discovery steps

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context. References = ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

Agent Collector is the component that executes the osquery commands on agents to gather attribute details from a CI. Agent Collector is a feature of the Agent Client Collector (ACC) for Discovery, which is an integration that enables ServiceNow Discovery to use osquery to collect data from Linux and Windows devices that have the Elastic Agent installed1. Agent Collector allows you to define osquery queries and assign them to policies that target specific devices or groups of devices2. Agent Collector then runs the queries on the agents and sends the results back to the instance, where they are processed by the Agent Listener and stored in the CMDB3.

References: 1: Agent Client Collector for Discovery - ServiceNow 2: Create an Agent Collector policy - ServiceNow 3: Agent Client Collector for Discovery architecture - ServiceNow

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References1: Agent Client Collector - Product Documentation: San Diego - ServiceNow2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow

Discovery Range Sets in ServiceNow Discovery offer a flexible way to manage and identify networks. They simplify the administration of network discovery by allowing administrators to define groups of IP ranges. This organization helps in effectively managing and targeting different network segments without needing to define each IP range in individual Discovery Schedules. Range Sets do not necessarily show the number of IPs in a subnet, nor are they the only way to define multiple IP ranges in a schedule.

Global variables are variables that are automatically available for all steps in horizontal discovery patterns. They store information about the target CI, such as its IP address, host name, operating system, and credentials. There are two global variables that may be used for steps in horizontal discovery patterns: system and computer_system. The system variable contains the information about the target CI’s IP address, host name, and credentials. The computer_system variable contains the information about the target CI’s operating system, such as its name, version, and architecture12.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

References: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

Hardware Models are templates that define the attributes and default values for a specific type of hardware configuration item (CI). Hardware Models can have a one-to-many relationship with the following entities:

• Assets: An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract. A Hardware Model can be associated with multiple assets that share the same characteristics and specifications.
• Configuration Items: A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A Hardware Model can be associated with multiple CIs that share the same characteristics and specifications.
• Model Categories: A model category is a classification of Hardware Models based on their function, such as network, storage, or server. A Hardware Model can belong to one or more model categories that define its scope and usage.

References:

• Hardware Model
• Asset
• Configuration Item (CI)
• [Model Category]

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping1. It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings2. The ECC Queue is a table that displays the input and output messages from and to MID Servers3. It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps4. The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution2.

References: 1: Discovery pattern log 2: View the Discovery pattern log 3: ECC Queue 4: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example

The Extension section in a horizontal pattern is executed after the Identification sections have completed and the CI has been identified. The Extension section allows adding additional attributes or relationships to the CI, or launching other patterns for further discovery12.

References:

• 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow
• 2: Horizontal Pattern probe - Product Documentation: San Diego - ServiceNow

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

References: The explanation is based on the following sources:

• Activate pattern Debug mode: This document explains how to activate the Debug mode and use the Debug Identification Section to debug a pattern.
• ServiceNow Exam CIS-Discovery Topic 6 Question 9 Discussion: This discussion provides a similar question and answer about the Debug Identification Section in Debug Mode.

Tracked configuration files are files that contain settings and parameters of certain applications or devices that Discovery can find and add to the CMDB. Some of the benefits of tracked configuration files are:

• Content version comparison: You can compare the content of different versions of the same configuration file and see the changes that occurred over time. This can help you troubleshoot issues, audit changes, and restore previous configurations if needed.
• Files tracked as CIs: You can view the configuration files as configuration items (CIs) in the CMDB and see their relationships with other CIs, such as the applications or devices they belong to. This can help you understand the dependencies and impact of the configuration files on your IT environment.

References: Configuration file tracking, Modify tracking changes in configuration files

In configuring the MID Server Service Settings in ServiceNow, the MID Server name must adhere to certain naming conventions. Among the options provided, "mid server1" (D) is not a valid MID Server name because it contains a space. MID Server names should not include spaces or special characters that are not typically used in naming conventions. Names like "mymidserver1," "mid.server1," and "midserver1" are more in line with the standard naming practices. References = ServiceNow MID Server documentation, specifically the sections detailing MID Server configuration and naming conventions.

One method for deleting specific CIs not discovered in 30 days is to use a scheduled job that runs a script to query the CMDB for CIs that have not been updated by Discovery for a certain period of time, and then delete them or mark them as retired. This method can help you keep your CMDB clean and accurate, and avoid having stale or obsolete CIs. You can configure the scheduled job to run at a specific frequency and time, and specify the criteria for selecting the CIs to delete.

References: Automated way to disable/retire CIs not updated for 45 days, ServiceNow CIS-Discovery Sample Questions

For a MID Server to access servers using Windows Remote Management (WinRM), it's necessary to specify that WinRM should be used as the protocol for Windows management. This is typically done by setting the appropriate MID Server parameter, such as mid.windows.management_protocol, to WinRM. This configuration tells the MID Server to use the WinRM protocol when communicating with the target servers for executing commands and collecting data. The answer is derived from understanding how ServiceNow Discovery uses MID Servers to perform remote operations and the need to configure these MID Servers appropriately to communicate using different protocols like WinRM. It is not sufficient to just add the WinRM parameter on target servers or simply add the MID Servers as a trusted source with DNS; the MID Server itself must be configured to use WinRM. Setting a 'JEA Property' to true is not relevant to the basic configuration of a MID Server for WinRM access.

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• Load a MIB file - Product Documentation: Vancouver - ServiceNow
• How Loading of MIB file works on SNMP Browser ( Pattern Step - SNMP Query) - Support and Troubleshooting

From the Discovery Status record, a Device record in ServiceNow Discovery contains a link to the discovered Configuration Item (CI). This link provides direct access to the CI record that was discovered and processed during the discovery cycle. The Device record does not contain the contents of the CI, a link to the discovered Asset, or a link to the CMDB Health Dashboard. References = ServiceNow Discovery documentation, focusing on the details of Discovery Status records and the information contained within Device records.

Discovery finds and maps dependencies for the following types of storage devices: Direct-attached storage (DAS), network-attached storage (NAS), or storage area network (SAN)1. NAS or SAN storage that is discovered via a Storage Management Initiative Specification (SMI-S) and Common Information Model (CIM) is also supported2. Discovery collects information about storage area networks from specialized devices, such as storage arrays and Fibre Channel (FC) switches, and creates specific references between the tables in the SAN3. Discovery does not support Multiple area network (MAN) or Redundant Array of Independent Disks (RAID) as types of storage devices.

References:

• 1: Storage device discovery
• 2: Storage Discovery via SMI-S and CIM
• 3: Discovery of storage area networks (SAN)

Without seeing the specific image, it's challenging to definitively identify the operation. However, based on the options provided, if the image shows an operation that involves interpreting or extracting data from a variable, then "Parse Variable" is the most likely answer. "Parse Variable" is used in ServiceNow Discovery patterns to analyze and extract data from variables collected during the discovery process. References = ServiceNow Discovery documentation, particularly the sections on Discovery Pattern Designer and the various operations that can be used in patterns.

In a Merge Table pattern operation within ServiceNow Discovery, the editable fields typically include the Target Table, Second Table, and First Table. These fields are configurable and allow users to specify the tables involved in the merge operation. The Target Table is where the merged data will be stored, while the First and Second Tables are the source tables whose data is being merged. The Primary Table is not typically an editable field in this context. References = ServiceNow Discovery documentation, particularly the sections discussing pattern design and operations, including Merge Table operations within Discovery Patterns.

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

• A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.
• A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.
• An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.

References:

• 1: IfTable - Product Documentation: San Diego - ServiceNow
• 2: InstanceID - Product Documentation: San Diego - ServiceNow

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Pattern Designer - Product Documentation: Vancouver - ServiceNow
• Discovery pattern designer - ServiceNow IT Operations Management [Book]

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Pattern is a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

References:

• 1: Tracked Configuration files - Product Documentation: San Diego - ServiceNow
• 2: Tracked Configuration files pattern - Product Documentation: San Diego - ServiceNow
• 3: Patterns and horizontal discovery - Product Documentation: Tokyo - ServiceNow

The mid.discovery.max_pattern_payload_size property defines the maximum overall size for the returned payload that comes from patterns. This property is set on the MID Server and applies to all patterns that run on that MID Server. If the payload size exceeds this limit, the pattern execution fails and an error message is logged in the ECC queue. The default value of this property is 10 MB1.

References: 1: ServiceNow Docs - MID Server properties for Discovery and Service Mapping 2: ServiceNow Docs - Discovery payload size and processing