CIS-Discovery Certified Implementation Specialist - Discovery Questions and Answers

 According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name.

London Linux Servers is a  CMDB Group with Health Group type .  A CMDB Group is a collection of configuration items (CIs) that share common characteristics or are related in some way 1 .  A Health Group is a type of CMDB Group that is used to monitor and measure the health of a specific set of CIs based on predefined rules and metrics 2 .  The image shows that London Linux Servers is selected from the CMDB Health Group List, which is a dropdown menu that displays all the Health Groups defined in the system 3 . The image also shows the Group Health tab, which displays the health scores and indicators for the selected Health Group.

The correct variable syntax to populate a custom column in a horizontal discovery pattern is  $cmdb_ci_linux_server.u_custom_column.INSERT . This syntax indicates that the value of the custom column will be inserted into the cmdb_ci_linux_server table for the current CI.  The other options are either invalid or incorrect syntaxes for this operation 1 2 .

Discovery finds and maps dependencies for the following types of storage devices:  Direct-attached storage (DAS) ,  network-attached storage (NAS) , or  storage area network (SAN) 1 .  NAS or SAN storage that is discovered via a Storage Management Initiative Specification (SMI-S) and Common Information Model (CIM) is also supported 2 .  Discovery collects information about storage area networks from specialized devices, such as storage arrays and Fibre Channel (FC) switches, and creates specific references between the tables in the SAN 3 . Discovery does not support Multiple area network (MAN) or Redundant Array of Independent Disks (RAID) as types of storage devices.

 File Based Discovery is used to discover file paths to recognize the signature of installed software.  File Based Discovery helps to identify what software is running on Windows and UNIX servers and devices by scanning the file system for specific files or directories that indicate the presence of a software product 1 .  File Based Discovery can also check the file size, version, and checksum of the discovered files to verify the software installation 2 .  File Based Discovery can be configured using file signatures, which are patterns that match the file paths of software products 3 .

Horizontal pattern types are used to discover the configuration items (CIs) that belong to a specific category or class, such as infrastructure or application. They define the operations that Discovery performs to identify and classify the CIs, and the attributes that Discovery populates for each CI.  Horizontal patterns can be applied to any operating system or platform that supports the required protocols and commands 1 2 .

The Automation Error Messages list displays the errors that occurred during the execution of Discovery automation scripts. From this list, you can view the details of each error, such as the script name, the error message, the device, and the time. You can also perform actions on the errors, such as retrying the script, ignoring the error, or creating an incident.  To do so, you can use the options on the right navigation pane, which are categorized as follows 1 :

SELECT ALL : This option allows you to select all the errors in the list.

SELECT ONE : This option allows you to select one error in the list by clicking on the checkbox next to it.

ACTION ON SELECTED : This option allows you to perform an action on the selected errors, such as Retry, Ignore, or Create Incident. You can also choose to perform the action on all the errors in the list by selecting the All option from the drop-down menu.

ACTION ON ALL : This option allows you to perform an action on all the errors in the list, regardless of the selection. You can choose from the same actions as the ACTION ON SELECTED option.

On the ECC Queue, sensor records have a Queue value of  output  and probe records have a Queue value of  input .  The ECC Queue is the connection point between the instance and the MID Server, and it displays the input and output messages from and to the MID Server 1 .  A probe is a message that the instance sends to the MID Server to request information from a device or application 2 .  A sensor is a script that the MID Server runs to process the results returned by the probe 3 .  When a probe is created, it is inserted into the ECC Queue with a Queue value of  input , which means that it is waiting to be picked up by the MID Server 4 . When a sensor is created, it is inserted into the ECC Queue with a Queue value of  output , which means that it is waiting to be processed by the instance.

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network.  The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI) 1 2 .

References

1 : Set a deletion strategy - Product Documentation: San Diego - ServiceNow

2 : Network adapter status setting to “Absent” in EMC … - ServiceNow …

The Parse File operation is used to extract information from a file and create variables to contain the extracted information 1 .  The two main options within a Parse File operation are  Select File  and  Define Parsing 2 . Select File allows you to specify the file path or browse to the file.  Define Parsing allows you to select the relevant parsing strategy and define parsing criteria 2 .

A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores information about web servers 1 .

B is true because the merge table operation is typically used for application patterns, which are horizontal patterns that discover applications and their dependencies. The condition on the process.executablePath variable suggests that the operation is looking for a specific application (mongoose) running on the web servers.

D is true because the merge table operation requires at least one matching field value between the two source tables 1 . In this case, the process.executablePath variable is the matching field, and it must contain “mongoose” for the operation to run.

The Discovery pattern log is a log that records the execution of a pattern during Discovery or Service Mapping 1 .  It shows the success or failure of the individual pattern steps, as well as the input and output variables, the CI attributes and relationships, and the errors or warnings 2 .  The ECC Queue is a table that displays the input and output messages from and to MID Servers 3 .  It shows the payload of CI attributes and relationships, the Shazzam probe payload, and the relationships created, but not the success or failure of the individual pattern steps 4 .  The success or failure of the individual pattern steps is specific to the Discovery pattern log and can be used to debug or troubleshoot the pattern execution 2 .

Credential-less Discovery is a feature of ServiceNow Discovery that allows the instance to identify configuration items (CIs) without using credentials. Credential-less Discovery uses Network Mapper (Nmap), a free and open-source network scanner, to collect information about the CIs by sending packets and analyzing the responses. Nmap must be installed on the MID Server that runs Credential-less Discovery.  Credential-less Discovery can be used as a fallback option when credential-based probes fail, or as a primary option for scanning certain types of devices, such as network devices, printers, or IoT devices 1 2 .

 The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI.

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable.  Get Process executes a command to list the processes running on a target and stores the results in a variable 1 2 .

 The Shazzam probe is placed in the ECC queue as a first step in horizontal discovery.  The ECC queue is a table that stores requests and responses for communication between the MID Server and the ServiceNow instance 1 .  The Shazzam probe is a script that performs port scanning on a target host to determine what protocols are available and what classifiers to trigger 2 .  The Shazzam probe is sent from the ServiceNow instance to the MID Server, which executes it on the target host and returns the results to the ECC queue 3 .

According to the ServiceNow website 1 , the key capabilities of a ServiceNow ITOM Enterprise solution are:

Manage hybrid clouds: Gain visibility and control across your hybrid cloud environment with a single system of action for IT.

Proactively eliminate service outages: Identify issues and anomalies before they cause service outages with AIOps and machine learning.

Automate IT service operations: Automate common service requests, processes, and tasks with digital workflows and virtual agents.

Optimize IT service delivery: Align your IT resources and investments with business priorities and optimize service delivery performance.

Based on the image, the value assigned to the label “Value” is a concatenation of variables and strings.  One of the variables is  $name_details[1].exec_info , which indicates that  $name_details  is a tabular variable, meaning an array or a map that can store multiple values 1 . The  [1]  is the index or the key that accesses the element of the tabular variable. The  .exec_info  is the attribute or the property of the element. Therefore, the choice D is true.

The other choices are not true based on the image. The choice A is false because the image does not show any WMI query operation step.  A WMI query operation step is a pattern step that executes a WMI query on a Windows device and returns the results as a tabular variable 2 . The image does not show any WMI query syntax or result. The choice B is false because there is no scalar variable labeled ‘1’.  A scalar variable is a variable that can store only one value 1 . The image shows a label “Value” but not a variable name. The choice C is false because the value can be used in a pattern step.  A pattern step is a unit of logic that performs a specific action during Discovery or Service Mapping 3 . The value can be used as an input or an output of a pattern step, depending on the context.

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload.  The thread count can be configured by changing the MID Server parameters in the ServiceNow instance 1 2 .  References  =  1 : MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow  2 : Product Documentation | ServiceNow

One method for deleting specific CIs not discovered in 30 days is to use a scheduled job that runs a script to query the CMDB for CIs that have not been updated by Discovery for a certain period of time, and then delete them or mark them as retired. This method can help you keep your CMDB clean and accurate, and avoid having stale or obsolete CIs. You can configure the scheduled job to run at a specific frequency and time, and specify the criteria for selecting the CIs to delete.

Agent Collector is the component that executes the osquery commands on agents to gather attribute details from a CI.  Agent Collector is a feature of the Agent Client Collector (ACC) for Discovery, which is an integration that enables ServiceNow Discovery to use osquery to collect data from Linux and Windows devices that have the Elastic Agent installed 1 .  Agent Collector allows you to define osquery queries and assign them to policies that target specific devices or groups of devices 2 .  Agent Collector then runs the queries on the agents and sends the results back to the instance, where they are processed by the Agent Listener and stored in the CMDB 3 .

Quick Discovery is a wizard that helps you get up and running with Discovery quickly. It discovers both physical and logical components, including virtual machines, servers, storage, databases, applications, and more. To use Quick Discovery, you need to have a MID Server installed and configured, and provide a target IP range or subnet to scan. You do not need to create a Discovery Schedule or a PID for Quick Discovery.

In a Merge Table pattern operation within ServiceNow Discovery, the editable fields typically include the Target Table, Second Table, and First Table. These fields are configurable and allow users to specify the tables involved in the merge operation. The Target Table is where the merged data will be stored, while the First and Second Tables are the source tables whose data is being merged. The Primary Table is not typically an editable field in this context. References = ServiceNow Discovery documentation, particularly the sections discussing pattern design and operations, including Merge Table operations within Discovery Patterns.

During the Port Scan phase in ServiceNow Discovery, the warning level error "No results returned from probe" typically indicates a connectivity issue. This error often arises when a logical or physical firewall is blocking the connectivity between the MID Server and the target device. This prevents the probe from successfully scanning the ports and returning results. The other options, such as incorrect process classifier configuration, wrong credentials, or incorrect datasource precedence, would generally lead to different types of errors or issues in the discovery process. References = ServiceNow Discovery documentation, particularly the sections that deal with troubleshooting Port Scan issues and understanding common errors during Discovery phases.

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device.  Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues 1 2 3 .

The Pattern Designer is a graphical tool that allows users to create and edit horizontal discovery patterns. The Pattern Designer has three main sections: the left section shows the CI type and the pattern type, the middle section shows the pattern steps and the flow diagram, and the far-right section shows the details of the selected step or operation.  The far-right section can display the following tabs, depending on the type of step or operation selected 1 2 :

Operations : This tab shows the list of available operations that can be added to the pattern, such as Execute Command, Parse File, Set Parameter Value, etc. Operations are the basic building blocks of a pattern that perform specific actions on the target device or the MID Server.

CI Attributes : This tab shows the list of attributes that can be set or updated for the CI type of the pattern, such as name, serial number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information collected by the pattern.

Temporary Variables : This tab shows the list of temporary variables that can be created or used by the pattern, such as $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data within the pattern, such as the output of a command, the value of a parameter, or the result of a calculation.

CMDB Dashboard : This tab shows the CMDB dashboard that displays the CI record and its related lists, such as relationships, identification rules, sensors, etc. The CMDB dashboard is used to preview and verify the outcome of the pattern on the CI record in the CMDB.

In the context of ServiceNow Discovery patterns, the types of temporary variables include Scalar/List and Tabular/Table. Scalar/List variables are used to store single values or lists of values, while Tabular/Table variables are used to store structured data in a table format. Command and SQL statement are not types of temporary variables; rather, they are types of operations or steps that can be used within a pattern to execute commands or SQL queries. References = ServiceNow Discovery documentation, especially sections related to Discovery Patterns and the use of temporary variables within patterns.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context. References = ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

The  Shazzam Batch Size  property determines how many IP addresses are scanned by a single Shazzam probe 1 . If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses.  This property can be configured in the  Discovery Properties  module under  Discovery Definition 2 .