The Application Pattern Type is a pattern that discovers applications and their dependencies by using probes and sensors1. It has two main components: the Run Order and the Identification Section2. The Run Order defines the sequence of probes and sensors that Discovery uses to find and classify CIs2. The Identification Section specifies the criteria that Discovery uses to identify CIs and their relationships2. The other options, CI Type and Operating System, are not specific to the Application Pattern Type. They are used for other pattern types, such as the Horizontal Pattern Type and the Service Mapping Pattern Type3 .

References: 1: Application Pattern Type 2: Application Pattern Type components 3: Horizontal Pattern Type : Service Mapping Pattern Type

 According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name.

References:

• Create a Discovery CI classification - Product Documentation: Tokyo - Now Support Portal
• Identification rules - Product Documentation: Tokyo - Now Support Portal
• ServiceNow IRE: Identification Rules Explained — Cookdown

The CMDB contains records of configuration items (CIs) and their relationships. A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A relation type defines the nature of the connection between two CIs, such as depends on, uses, or contains. A model is a template for a CI that defines its attributes and default values. An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract.

References:

• Configuration Item (CI) types: Attributes and relationships
• What is a configuration management database (CMDB)?
• CSA Challenge Questions Flashcards

In configuring the MID Server Service Settings in ServiceNow, the MID Server name must adhere to certain naming conventions. Among the options provided, "mid server1" (D) is not a valid MID Server name because it contains a space. MID Server names should not include spaces or special characters that are not typically used in naming conventions. Names like "mymidserver1," "mid.server1," and "midserver1" are more in line with the standard naming practices. References = ServiceNow MID Server documentation, specifically the sections detailing MID Server configuration and naming conventions.

 A scheduled job is a background process that runs at a specified time or interval to perform a specific task1. It is not a method for deleting specific CIs that are not discovered in 30 days. The other options are methods for deleting or updating CIs based on discovery data. A UI policy is a script that can dynamically change the behavior of a form or list2. A service mapping is a process that creates a map of the relationships between CIs that support a business service3. A data policy is a rule that enforces data consistency and accuracy by validating the data entered into a record.

References: 1: Scheduled Jobs 2: UI Policies 3: Service Mapping : Data Policies

Discovery and Service Mapping are both products that help to identify and map the IT infrastructure and services in an organization. However, they have different approaches and objectives. Discovery uses IP address ranges as the starting point for finding devices and applications on the network, and then runs probes and sensors to collect information and classify them. Discovery focuses on inventory-related use-cases, such as asset management, configuration management, and compliance. Service Mapping uses entry points, such as URLs or host names, as the starting point for mapping business services and their dependencies. Service Mapping runs patterns, which are sequences of operations that follow the traffic connections between devices and applications, and then creates a service map that shows the logical and semantic relationships. Service Mapping focuses on service-related use-cases, such as service availability, impact analysis, and root cause analysis12.

References:

• 1: ServiceNow Discovery Overview, page 9
• 2: ServiceNow Discovery Documentation, Service Mapping section

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• Load a MIB file - Product Documentation: Vancouver - ServiceNow
• How Loading of MIB file works on SNMP Browser ( Pattern Step - SNMP Query) - Support and Troubleshooting

 When Discovery or Service Mapping identifies a CI that matches an existing CI in the CMDB, it checks whether the CIs are duplicates or not. If they are duplicates, Discovery adds them to a de-duplication task, which is a record that groups duplicate CIs and allows you to review and remediate them. You can use the Duplicate CI Remediator wizard to merge, flag, retire, or delete the duplicate CIs. By default, Discovery does not send notifications, create identification rules, or stop the next discovery for duplicate CIs.

References: Handle Duplicate CIs in your CMDB, De-duplication tasks, How to de-duplicate 2 ESX servers with same name?

In the context of ServiceNow Discovery patterns, the types of temporary variables include Scalar/List and Tabular/Table. Scalar/List variables are used to store single values or lists of values, while Tabular/Table variables are used to store structured data in a table format. Command and SQL statement are not types of temporary variables; rather, they are types of operations or steps that can be used within a pattern to execute commands or SQL queries. References = ServiceNow Discovery documentation, especially sections related to Discovery Patterns and the use of temporary variables within patterns.

A Discovery schedule of type Configuration Item collects complete information from the scanned IP ranges and sends it to the CMDB. This type of schedule runs a series of probes and sensors to identify and classify the devices and applications on the network, and to create or update the corresponding configuration items in the CMDB. A Discovery schedule of type Configuration Item can also run patterns to discover more details and relationships about the configuration items.

References:

• ServiceNow Discovery Overview
• Create a Discovery schedule
• Discovery schedule types

In ServiceNow Discovery, relationships between Configuration Items (CIs) in a horizontal pattern are created using the "Create Relation/Reference" operation. This operation allows the pattern to define and establish relationships or references between discovered CIs, based on the information gathered during the discovery process. Options B and C are incorrect as relationships are not automatically created nor is it true that they cannot be created via patterns. Option D, "Create Connections," is not a standard operation in this context. References = ServiceNow Discovery documentation, specifically the sections on creating and managing horizontal discovery patterns.

The $process.executableDir expression correctly calls the value of the executableDir variable from the tabular process variable. The process variable is a tabular variable that contains the output of the ps command, which lists the processes running on a CI. The executableDir variable is a column name that holds the directory path of the executable file for each process. To access the value of a column name from a tabular variable, you need to use the dot notation, such as $variable.columnName12.

References1: Pattern variables - Product Documentation: Tokyo - Now Support Portal2: Examples of EVAL scripts used in Discovery patterns - ServiceNow

In ServiceNow Discovery, a horizontal discovery pattern refers to the logical set of steps that the Discovery process executes to find CI information across the network. Each step in a horizontal discovery pattern performs specific operations such as running probes, executing commands, or querying databases to gather information about the configuration items (CIs). It's about expanding the breadth of discovery across devices and applications, rather than going in-depth into a specific CI's details, which would be vertical discovery. Classifiers, credential depots, and port scanning tools are part of the discovery process but do not describe the horizontal discovery pattern itself.

When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's often necessary to also increase the memory allocated to the MID Server application. This is because more threads can result in higher memory usage as each thread may consume resources while performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing the MID Server max payload size are not directly related to the number of threads used by a MID Server. References = ServiceNow Discovery documentation, especially sections discussing MID Server configuration and performance tuning.

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

A Functionality Definition is a configuration record that defines what protocols to detect from within a Behavior. A Behavior is a set of Functionality Definitions that Discovery uses to identify and explore a device or application. A Functionality Definition specifies the order, type, and parameters of the probes that Discovery launches to gather information about a device or application12.

References:

• Functionality Definition
• Behavior

The recommended method for excluding specific software from discovery on Windows and Unix Servers in ServiceNow Discovery is by modifying the probes. Probes are the components in ServiceNow that collect data from devices. By modifying the probes, specific software can be excluded from the discovery process. Options A, C, and D are less direct methods for achieving this specific requirement. References = ServiceNow Discovery documentation, particularly in the sections related to probe configuration and modification.

The main Key Performance Indicators (KPIs) for the CMDB Health scorecard in ServiceNow include Correctness, Completeness, and Staleness. These KPIs are critical for assessing the overall health and quality of the CMDB. Correctness refers to the accuracy of the data in the CMDB, Completeness measures whether all required CI data is present, and Staleness indicates the freshness or timeliness of the CI data. Compliance and Duplicates, while important, are not considered main KPIs in the context of the CMDB Health scorecard. References = ServiceNow CMDB documentation and CMDB Health Dashboard user guide, focusing on the key performance indicators for CMDB health.

A horizontal discovery pattern is a set of steps that execute operations to identify, classify, and populate attributes for configuration items (CIs) of a specific category or class, such as infrastructure or application. A horizontal pattern can be applied to any operating system or platform that supports the required protocols and commands12.

References:

• Horizontal discovery patterns
• Discovery pattern types

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

References:

• Correcting MID Server Windows service account user and permissions
• What is a ServiceNow MID Server and how does it work?
• Configure Windows MID Server service credentials

Discovery finds and maps dependencies for the following types of storage devices: Direct-attached storage (DAS), network-attached storage (NAS), or storage area network (SAN)1. NAS or SAN storage that is discovered via a Storage Management Initiative Specification (SMI-S) and Common Information Model (CIM) is also supported2. Discovery collects information about storage area networks from specialized devices, such as storage arrays and Fibre Channel (FC) switches, and creates specific references between the tables in the SAN3. Discovery does not support Multiple area network (MAN) or Redundant Array of Independent Disks (RAID) as types of storage devices.

References:

• 1: Storage device discovery
• 2: Storage Discovery via SMI-S and CIM
• 3: Discovery of storage area networks (SAN)

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

References: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

According to the ServiceNow website1, the key capabilities of a ServiceNow ITOM Enterprise solution are:

• Manage hybrid clouds: Gain visibility and control across your hybrid cloud environment with a single system of action for IT.
• Proactively eliminate service outages: Identify issues and anomalies before they cause service outages with AIOps and machine learning.
• Automate IT service operations: Automate common service requests, processes, and tasks with digital workflows and virtual agents.
• Optimize IT service delivery: Align your IT resources and investments with business priorities and optimize service delivery performance.

References:

• 1: ITOM - Enterprise IT Operations Management - ServiceNow

• A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores information about web servers1.
• B is true because the merge table operation is typically used for application patterns, which are horizontal patterns that discover applications and their dependencies. The condition on the process.executablePath variable suggests that the operation is looking for a specific application (mongoose) running on the web servers.
• D is true because the merge table operation requires at least one matching field value between the two source tables1. In this case, the process.executablePath variable is the matching field, and it must contain “mongoose” for the operation to run.

References:

• 1: Merge tables - Product Documentation: San Diego - Now Support Portal
• 3: Product Documentation | ServiceNow
• [4]: Discovery Patterns - Product Documentation: San Diego - Now Support Portal

During the Port Scan phase in ServiceNow Discovery, the warning level error "No results returned from probe" typically indicates a connectivity issue. This error often arises when a logical or physical firewall is blocking the connectivity between the MID Server and the target device. This prevents the probe from successfully scanning the ports and returning results. The other options, such as incorrect process classifier configuration, wrong credentials, or incorrect datasource precedence, would generally lead to different types of errors or issues in the discovery process. References = ServiceNow Discovery documentation, particularly the sections that deal with troubleshooting Port Scan issues and understanding common errors during Discovery phases.

File-based Discovery is a process that helps identify what software is running on your Windows and UNIX servers and devices, even if there is no registration information available. File-based Discovery is triggered in the exploration phase of normal Discovery, after the target device has been classified and identified. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe.

References: File-based Discovery, File Based Discovery - Support and Troubleshooting

The ECC Queue is the normal connection point between an instance and other systems that integrate with ServiceNow, such as MID Servers1. The ECC Queue displays input and output messages from and to MID Servers2. The actual XML payload that is sent to or from an instance is stored in the ECC Queue3. The ECC Queue also provides a connected flow of probe and sensor activity, as probes are sent from the instance to the MID Server, and sensors are sent from the MID Server to the instance2.

References:

• 1: ServiceNow Discovery Overview
• 2: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example
• 3: Manage ECC Queue content for a MID Server

 The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI.

References: Discovery - How Location field is set for a CI, How to pass discovery schedule fields to a CI record via discovery

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Pattern Designer - Product Documentation: Vancouver - ServiceNow
• Discovery pattern designer - ServiceNow IT Operations Management [Book]

 The WMI service is a Windows service that enables remote management of Windows devices using the WMI protocol. The WMI service is required for Discovery to access the configuration and status information of Windows devices using WMI queries. If the WMI service is not running on a host, it will prevent the discovery of Windows devices, as Discovery will not be able to communicate with the WMI Collector or execute WMI queries on the target device123.

References:

• How to resolve a failure to communicate with the WMI Collector during top-down discovery - Support and Troubleshooting - Now Support Portal
• Windows discovery without ‘domain admin’ or ‘local admin’ privileges ? - Support and Troubleshooting - Now Support Portal
• Discovery — ServiceNow Elite