CIS-Discovery Certified Implementation Specialist - Discovery Questions and Answers

According to the ServiceNow website1, the key capabilities of a ServiceNow ITOM Enterprise solution are:

Manage hybrid clouds: Gain visibility and control across your hybrid cloud environment with a single system of action for IT.

Proactively eliminate service outages: Identify issues and anomalies before they cause service outages with AIOps and machine learning.

Automate IT service operations: Automate common service requests, processes, and tasks with digital workflows and virtual agents.

Optimize IT service delivery: Align your IT resources and investments with business priorities and optimize service delivery performance.

 Based on the web search results from the search_web tool, the following choices best represent key capabilities of a ServiceNow ITOM Enterprise solution:

Manage Hybrid Clouds: ServiceNow ITOM enables organizations to gain visibility into their IT environment, on-premises to cloud, and see the impact of their applications on business services12. It also helps to plan, track, and secure cloud implementation through best-practice governance1. Four apps comprise Cloud Accelerate to help prepare for cloud migration, streamline provisioning requests, and manage cloud resources1.

Proactively Eliminate Service Outages: ServiceNow ITOM helps to predict issues, reduce user impact, and automate resolutions with predictive AIOps and automation13. It analyzes telemetry and log data using AI to reduce noise, expeditemapping and predict issues1. It also delivers proactive digital operations with real-time log data to solve problems quickly1.

The other choices are not specific to ServiceNow ITOM Enterprise solution, but rather general features of the ServiceNow platform. The ServiceNow platform allows users to create an engaging user experience with intuitive interfaces and workflows. It also enables users to build new apps fast with low-code development tools and pre-built components.

London Linux Servers is a CMDB Group with Health Group type. A CMDB Group is a collection of configuration items (CIs) that share common characteristics or are related in some way1. A Health Group is a type of CMDB Group that is used to monitor and measure the health of a specific set of CIs based on predefined rules and metrics2. The image shows that London Linux Servers is selected from the CMDB Health Group List, which is a dropdown menu that displays all the Health Groups defined in the system3. The image also shows the Group Health tab, which displays the health scores and indicators for the selected Health Group.

In ServiceNow Discovery, the reconciliation process is governed by precedence rules. These rules determine which data source’s information will be retained if there are conflicts when multiple sources discover the same CI. In this case, Altiris has a higher order of precedence (300) compared to ServiceNow (100), as seen in the “Data Source Precedents” section of the image. Therefore, if Altiris discovers ‘Windows2’ for the name attribute on the same CI after ServiceNow sets it to ‘Windows1’, the name will change to ‘Windows2’ due to Altiris’s higher precedence.

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

The CMDB contains records of configuration items (CIs) and their relationships. A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A relation type defines the nature of the connection between two CIs, such as depends on, uses, or contains. A model is a template for a CI that defines its attributes and default values. An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract.

 A Behavior is a set of rules that determines which MID Servers launch which types of probes during a Discovery1. It can be assigned to a Discovery IP Range, which is a range of IP addresses that Discovery scans for CIs2. By using the Behavior drop-down menu on a Discovery IP Range, one can control how Discovery behaves for each IP address in that range3. The other options are not related to using a Behavior for discovery. The MID Server selection method on a Discovery Schedule is a way to specify which MID Servers are eligible to run Discovery for a given schedule4. The Behavior drop-down menu on a Discovery Status is a way to filter the Discovery Status records by the Behavior used. The Behavior checkbox on a CI is a way to indicate whether the CI was discovered using a Behavior or not.

The SNMP Query pattern operation executes an SNMP query on a target device and stores the results in a variable. The Variable Type field determines the format of the results. There are two valid Variable Types for this operation: Table and Scalar. Table is used when the query returns multiple values, such as a list of interfaces or processes. Scalar is used when the query returns a single value, such as the system name or uptime12.

A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores information about web servers1.

B is true because the merge table operation is typically used for application patterns, which are horizontal patterns that discover applications and their dependencies. The condition on the process.executablePath variable suggests that the operation is looking for a specific application (mongoose) running on the web servers.

D is true because the merge table operation requires at least one matching field value between the two source tables1. In this case, the process.executablePath variable is the matching field, and it must contain “mongoose” for the operation to run.

Step 25 uses a shared library called Windows - Storage, which is a reusable component that can be invoked by multiple patterns to discover the storage information of Windows servers. A shared library is a collection of steps that can be referenced by a pattern name and can accept input parameters and return output values. Shared libraries help to avoid duplication of code and simplify the maintenance of patterns.

The Automation Error Messages list displays the errors that occurred during the execution of Discovery automation scripts. From this list, you can view the details of each error, such as the script name, the error message, the device, and the time. You can also perform actions on the errors, such as retrying the script, ignoring the error, or creating an incident. To do so, you can use the options on the right navigation pane, which are categorized as follows1:

SELECT ALL: This option allows you to select all the errors in the list.

SELECT ONE: This option allows you to select one error in the list by clicking on the checkbox next to it.

ACTION ON SELECTED: This option allows you to perform an action on the selected errors, such as Retry, Ignore, or Create Incident. You can also choose to perform the action on all the errors in the list by selecting the All option from the drop-down menu.

ACTION ON ALL: This option allows you to perform an action on all the errors in the list, regardless of the selection. You can choose from the same actions as the ACTION ON SELECTED option.

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

The Credential Affinity table is a table that associates an IP address and a credential in Discovery1. It is used to store the credential that was successfully used to access a device during Discovery2. It can also be used to manually assign a credential to an IP address or a range of IP addresses3. The other options are not tables that associate an IP address and a credential in Discovery. The Service Affinity table is a table that associates a business service and a credential. The Service CI Association table is a table that associates a business service and a configuration item (CI). The Tags table is a table that stores tags that can be applied to records in any table.

The Duplicate CI Remediator is a feature of ServiceNow Discovery that helps to identify and merge duplicate CIs in the CMDB. It uses predefined rules and criteria to compare CIs across different data sources and determine if they are duplicates. It also provides a user interface to review and approve the suggested merges, or to manually merge CIs as needed. The Duplicate CI Remediator helps to improve the accuracy and quality of the CMDB data and reduce the maintenance efforts.

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References

1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow

2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

For a MID Server to access servers using Windows Remote Management (WinRM), it's necessary to specify that WinRM should be used as the protocol for Windows management. This is typically done by setting the appropriate MID Server parameter, such asmid.windows.management_protocol, to WinRM. This configuration tells the MID Server to use the WinRM protocol when communicating with the target servers for executing commands and collecting data. The answer is derived from understanding how ServiceNow Discovery uses MID Servers to perform remote operations and the need to configure these MID Servers appropriately to communicate using different protocols like WinRM. It is not sufficient to just add the WinRM parameter on target servers or simply add the MID Servers as a trusted source with DNS; the MID Server itself must be configured to use WinRM. Setting a 'JEA Property' to true is not relevant to the basic configuration of a MID Server for WinRM access.

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload. The thread count can be configured by changing the MID Server parameters in the ServiceNow instance12. References = 1: MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow 2: Product Documentation | ServiceNow

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References

1: Agent Client Collector - Product Documentation: San Diego - ServiceNow

2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow

One method for deleting specific CIs not discovered in 30 days is to use a scheduled job that runs a script to query the CMDB for CIs that have not been updated by Discovery for a certain period of time, and then delete them or mark them as retired. This method can help you keep your CMDB clean and accurate, and avoid having stale or obsolete CIs. You can configure the scheduled job to run at a specific frequency and time, and specify the criteria for selecting the CIs to delete.

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.

A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.

An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.

The image shows a part of a horizontal pattern in Pattern Designer that uses the WMI Query operation to retrieve information about the processes running on a Windows server. The operation takes a WQL query as an input parameter and returns a tabular variable that contains the results of the query. The tabular variable is named ‘WMI Query’ by default, but it can be renamed by the user. The WQL query in the image selects four attributes from the Win32_Process class: Name, MaximumWorkingSetSize, PageFaults, and PeakVirtualSize. These attributes are stored as scalar variables in the tabular variable, and they can be accessed by using the dot notation, such as WMI Query.Name or WMI Query.MaximumWorkingSetSize. Therefore, the most probable results of the image are a tabular variable named ‘WMI Query’ and two scalar variables named ‘MaximumWorkingSetSize’ and ‘PeakVirtualSize’.

Global variables are variables that are automatically available for all steps in horizontal discovery patterns. They store information about the target CI, such as its IP address, host name, operating system, and credentials. There are two global variables that may be used for steps in horizontal discovery patterns: system and computer_system. The system variable contains the information about the target CI’s IP address, host name, and credentials. The computer_system variable contains the information about the target CI’s operating system, such as its name, version, and architecture12.

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Patternis a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

 Reconciliation rules are used to determine which data sources can update CI attributes in ServiceNow. Reconciliation rules can be static or dynamic, and they can be applied to specific CI classes, attributes, or discovery sources. Reconciliation rules can also specify the actions to take when there are unmatched values, such as removing, ignoring, or updating them1.

Without seeing the specific image, it's challenging to definitively identify the operation. However, based on the options provided, if the image shows an operation that involves interpreting or extracting data from a variable, then "Parse Variable" is the most likely answer. "Parse Variable" is used in ServiceNow Discovery patterns to analyze and extract data from variables collected during the discovery process.References= ServiceNow Discovery documentation, particularly the sections on Discovery Pattern Designer and the various operations that can be used in patterns.

In configuring the MID Server Service Settings in ServiceNow, the MID Server name must adhere to certain naming conventions. Among the options provided, "mid server1" (D) is not a valid MID Server name because it contains a space. MID Server names should not include spaces or special characters that are not typically used in naming conventions. Names like "mymidserver1," "mid.server1," and "midserver1" are more in line with the standard naming practices.References= ServiceNow MID Server documentation, specifically the sections detailing MID Server configuration and naming conventions.

Discovery Range Sets in ServiceNow Discovery offer a flexible way to manage and identify networks. They simplify the administration of network discovery by allowing administrators to define groups of IP ranges. This organization helps in effectively managing and targeting different network segments without needing to define each IP range in individual Discovery Schedules. Range Sets do not necessarily show the number of IPs in a subnet, nor are they the only way to define multiple IP ranges in a schedule.

To troubleshoot discovery issues from a discovery status in ServiceNow, the following related lists can be particularly useful:

Discovery Log- Provides detailed logs of the discovery process, helping to identify errors or issues encountered during discovery.

ECC Queue- Shows the messages and data passed between the ServiceNow instance and the MID Server, offering insights into the communication and data exchange during discovery.

Devices- Lists the devices discovered in the process, allowing for a direct view of the results and any potential issues with specific devices.

The "Running Processes" list is not typically used for troubleshooting discovery processes as it relates more to the operational aspects of the server or device rather than the discovery process itself.References= ServiceNow Discovery documentation, specifically the sections on Discovery troubleshooting and analysis, and the use of related lists for monitoring and troubleshooting purposes.