CIS-Discovery Sample Questions Answers

A Functionality Definition is a configuration record that defines what protocols to detect from within a Behavior. A Behavior is a set of Functionality Definitions that Discovery uses to identify and explore a device or application. A Functionality Definition specifies the order, type, and parameters of the probes that Discovery launches to gather information about a device or application12.

During the Port Scan phase in ServiceNow Discovery, the warning level error "No results returned from probe" typically indicates a connectivity issue. This error often arises when a logical or physical firewall is blocking the connectivity between the MID Server and the target device. This prevents the probe from successfully scanning the ports and returning results. The other options, such as incorrect process classifier configuration, wrong credentials, or incorrect datasource precedence, would generally lead to different types of errors or issues in the discovery process.References= ServiceNow Discovery documentation, particularly the sections that deal with troubleshooting Port Scan issues and understanding common errors during Discovery phases.

The mid.discovery.max_pattern_payload_size property defines the maximum overall size for the returned payload that comes from patterns. This property is set on the MID Server and applies to all patterns that run on that MID Server. If the payload size exceeds this limit, the pattern execution fails and an error message is logged in the ECC queue. The default value of this property is 10 MB1.

In ServiceNow Discovery, relationships between Configuration Items (CIs) in a horizontal pattern are created using the "Create Relation/Reference" operation. This operation allows the pattern to define and establish relationships or references between discovered CIs, based on the information gathered during the discovery process. Options B and C are incorrect as relationships are not automatically created nor is it true that they cannot be created via patterns. Option D, "Create Connections," is not a standard operation in this context.References= ServiceNow Discovery documentation, specifically the sections on creating and managing horizontal discovery patterns.

Step 25 uses a shared library called Windows - Storage, which is a reusable component that can be invoked by multiple patterns to discover the storage information of Windows servers. A shared library is a collection of steps that can be referenced by a pattern name and can accept input parameters and return output values. Shared libraries help to avoid duplication of code and simplify the maintenance of patterns.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

The main Key Performance Indicators (KPIs) for the CMDB Health scorecard in ServiceNow include Correctness, Completeness, and Staleness. These KPIs are critical for assessing the overall health and quality of the CMDB. Correctness refers to the accuracy of the data in the CMDB, Completeness measures whether all required CI data is present, and Staleness indicates the freshness or timeliness of the CI data. Compliance and Duplicates, while important, are not considered main KPIs in the context of the CMDB Health scorecard.References= ServiceNow CMDB documentation and CMDB Health Dashboard user guide, focusing on the key performance indicators for CMDB health.

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

The correct variable syntax to populate a custom column in a horizontal discovery pattern is $cmdb_ci_linux_server.u_custom_column.INSERT. This syntax indicates that the value of the custom column will be inserted into the cmdb_ci_linux_server table for the current CI. The other options are either invalid or incorrect syntaxes for this operation12.

The Extension section in a horizontal pattern is executed after the Identification sections have completed and the CI has been identified. The Extension section allows adding additional attributes or relationships to the CI, or launching other patterns for further discovery12.

From the Discovery Status record, a Device record in ServiceNow Discovery contains a link to the discovered Configuration Item (CI). This link provides direct access to the CI record that was discovered and processed during the discovery cycle. The Device record does not contain the contents of the CI, a link to the discovered Asset, or a link to the CMDB Health Dashboard.References= ServiceNow Discovery documentation, focusing on the details of Discovery Status records and the information contained within Device records.

Discovery uses the ping method to determine if a host IP is active or alive. Ping is a network utility that sends an ICMP echo request packet to a target IP address and waits for an ICMP echo reply packet. If the target IP address responds, it means that the host is active or alive12.

 According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name.

 To allow a MID Server to access servers using WinRM, the following configurations are required:

MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.

MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

 The WMI service is a Windows service that enables remote management of Windows devices using the WMI protocol. The WMI service is required for Discovery to access the configuration and status information of Windows devices using WMI queries. If the WMI service is not running on a host, it will prevent the discovery of Windows devices, as Discovery will not be able to communicate with the WMI Collector or execute WMI queries on the target device123.

Without seeing the specific image, it's challenging to definitively identify the operation. However, based on the options provided, if the image shows an operation that involves interpreting or extracting data from a variable, then "Parse Variable" is the most likely answer. "Parse Variable" is used in ServiceNow Discovery patterns to analyze and extract data from variables collected during the discovery process.References= ServiceNow Discovery documentation, particularly the sections on Discovery Pattern Designer and the various operations that can be used in patterns.

CMDB Health measures the quality of the data in the CMDB by testing it against predefined rules and metrics. One of the categories of these rules is Correctness, which tests the data against data integrity rules such as identification rules, orphan CI rules, and stale CI rules1. These rules help identify and flag the existing CMDB relationships that are not compliant with the suggested relationships2.

Duplicate relationships are those that have more than one relationship of the same type between the same two CIs3. For example, if a server CI has two relationships of type “Depends on” with the same network CI, it is a duplicate relationship.

Stale relationships are those that have not been updated for a specified period of time3. For example, if a server CI has a relationship of type “Runs on” with a virtual machine CI that has not been discovered for more than 60 days, it is a stale relationship.

Orphan relationships are those that are missing a defined relationship within the CMDB3. For example, if a server CI has no relationship of type “Depends on” with any network CI, it is an orphan relationship.

The vCenter Event Collector is a MID Server extension that listens for vCenter-related events and updates the CMDB accordingly. The event collector allowsthe CMDB to be updated with changes to virtual machines (VMs), in addition to the updates detected by Discovery1.

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.

Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.

Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

 CI reclassification is the process of changing the class of a CI in the CMDB based on the discovery data. It can be done manually or automatically, depending on the configuration settings. CI reclassification can result in data loss if the new class has fewer or different attributes than the original class, and the existing attribute values are not preserved or mapped to the new class. This can happen when a CI is switched to a different class hierarchy, such as from a Linux Server to a Windows Server, or when a CI is downgraded to a less specific class, such as from a Database to a Software Instance. Therefore, switching and downgrading have a higher chance of leading to lost data during CI reclassification.

Quick Discovery is a wizard that helps you get up and running with Discovery quickly. It discovers both physical and logical components, including virtual machines, servers, storage, databases, applications, and more. To use Quick Discovery, you need to have a MID Server installed and configured, and provide a target IP range or subnet to scan. You do not need to create a Discovery Schedule or a PID for Quick Discovery.

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References

1: Agent Client Collector - Product Documentation: San Diego - ServiceNow

2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow

Horizontal discovery patterns are a series of operations that tell Discovery which CIs to find on your network, what credentials to use, and what tables to populate in the CMDB. Horizontal discovery patterns use variables to store and pass information between the operations. By default, there are two variables that are automatically available for horizontal discovery patterns: infrastructure_system and computer_system. These variables store the information about the infrastructure and the computer system of the target CI, respectively. They are populated by the Horizontal Pattern probe and sensor, which enable Discovery to use patterns for horizontal discovery123.

The ECC Queue tab displays the input and output messages from and to MID Servers. The default fields that are displayed on this tab are:

Topic: The topic of the message, such as Discovery, Orchestration, or MID Server.

Queue: The queue name of the message, such as input, output, or error.

Source: The source of the message, such as the MID Server name, the instance name, or the probe name.

State: The state of the message, such as ready, processed, or ignored.

Created: The date and time when the message was created.

Updated: The date and time when the message was last updated.

Some other fields that can be added to the ECC Queue tab are:

Details: The details of the message, such as the payload, the response, or the error message.

Pattern log link: The link to the pattern log file, if the message is related to a pattern execution.

CMDB CI: The configuration item that is associated with the message, if any.

Discovery schedule name: The name of the discovery schedule that triggered the message, if any.

In ServiceNow Discovery, most properties related to the Discovery module start with the prefix 'glide.discovery'. This naming convention is part of ServiceNow's system property design, where 'glide' typically indicates system properties and 'discovery' specifies that the property is related to the Discovery module. Properties are used to configure various aspects of the Discovery process, such as behavior, timeouts, and performance settings.

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context.References= ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.

A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.

An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.