CIS-Discovery / RISCO - ServiceNow Practice Test 2026

Correct Answer

D. The ServiceNow instance is on Orlando patch 3, but the MID Server is on Orlando patch 1.

Source

ServiceNow Zurich - MID Server Version Status

If the link fails, search Google for: ServiceNow Zurich MID Server version status yellow icon patch mismatch

Expert Explanation

ServiceNow uses a color-coded icon system to indicate MID Server version alignment with the instance:

• Green: The MID Server version exactly matches the instance version (same release, same patch)
• Yellow: The MID Server is on the same release family but a different patch level (e.g., both Orlando, but different patches)
• Red: The MID Server is on a completely different release family (e.g., instance on Orlando, MID Server on New York)

The yellow icon is a warning, not a critical alert. It means the MID Server is functional but may lack bug fixes or features introduced in the newer patch. ServiceNow recommends upgrading the MID Server to match the instance patch level to ensure full compatibility and access to the latest fixes.

MID Server auto-upgrade can resolve this automatically if enabled, but organizations that control MID Server updates manually may see yellow icons after instance patching.

Why the Others Are Wrong

• A - MID Server unavailable: Unavailability is shown through the MID Server status field (Down/Up), not the version icon color. A down MID Server would display differently from a version mismatch warning.
• B - Slower than usual: Performance degradation is not tracked by the version icon. Response time issues would appear in MID Server performance metrics or ECC queue monitoring.
• C - Orlando vs New York: A cross-release mismatch (Orlando vs New York) is a major version difference, which would result in a red icon, not yellow. Yellow is reserved for same-release, different-patch scenarios.

Memory Tip

Traffic light logic: Green = perfect match, go. Yellow = caution, same family but different patch (like siblings with different birthdays - same family, slightly different). Red = stop, completely different release. Yellow = "same release, different patch."

Real-World Example

After a weekend maintenance window, the platform team at FinServ Inc upgrades their ServiceNow instance from Orlando Patch 1 to Orlando Patch 3. On Monday, the discovery admin notices 8 MID Servers showing yellow version icons. All 8 are still on Orlando Patch 1. She enables auto-upgrade for the MID Server cluster, and within 2 hours all icons turn green as the MID Servers pull down Patch 3 binaries and restart.

Correct Answer

D. New Configuration Items (CIs) identified from products currently in use.

Source

ServiceNow Zurich - ITOM Content Service

If the link fails, search Google for: ServiceNow Zurich ITOM Content Service weekly updates patterns classifiers

Expert Explanation

The ITOM Content Service is a cloud-based delivery mechanism that provides weekly updates to ServiceNow customers. These updates include:

• New CI classifications for recently released software, hardware, and cloud services
• Updated discovery patterns that can identify new product versions
• New classifiers for identifying device types based on open ports and services
• Pattern improvements based on field feedback from the ServiceNow customer base

The key value is that customers do not need to wait for a major platform release to discover new products. When a vendor releases a new software version or a new cloud service appears, ServiceNow's content team can push recognition capability to all customers within the weekly update cycle.

These updates are delivered automatically and do not require instance upgrades or MID Server restarts. They are applied through the content subscription mechanism.

Why the Others Are Wrong

• A - Software installation packages: ITOM Content Service delivers discovery content (patterns, classifiers), not software packages for installation on customer infrastructure.
• B - Physical server updates: The service operates entirely in the ServiceNow domain - it updates what discovery can recognize, not the physical infrastructure itself.
• C - Tutorials and manuals: Documentation is maintained on docs.servicenow.com and Now Learning. The Content Service is an operational tool, not an educational resource.

Memory Tip

ITOM Content Service = Weekly CI Menu Updates. Just like a restaurant updates its menu weekly with new dishes, ITOM Content Service updates the "menu" of CIs that discovery can recognize. New products in the market- Content Service adds them to the menu so discovery can find them.

Real-World Example

A cloud architect at TechStart Inc notices that ServiceNow discovery suddenly recognizes their newly deployed Redis 7.2 instances, even though they had not updated their discovery patterns manually. This happened because the ITOM Content Service pushed a new classifier and pattern for Redis 7.2 in the weekly update cycle. Within one week of Redis 7.2 being generally available, ServiceNow could discover and classify it across all customer environments.

Correct Answer

A. Credentials

Source

ServiceNow Zurich - Configure a Discovery Schedule

If the link fails, search Google for: ServiceNow Zurich Discovery Schedule configuration credentials separate

Expert Explanation

A Discovery Schedule controls the operational aspects of a discovery run - when it runs, where it scans, and which MID Server executes it. However, credentials are managed in a completely separate part of the platform.

What you CAN configure in a Discovery Schedule:

• IP Range Sets - which network segments to scan
• MID Server selection - which MID Server runs the discovery
• Run interval/frequency - when and how often it runs
• Discovery type - IP-based, CI-based, cloud, etc.
• Behaviors - what to do on completion

What you CANNOT configure in a Discovery Schedule:

• Credentials - these are managed in the Credentials table and linked through credential rules, credential order, or credential affinity

This separation exists by design. Credentials are sensitive security objects that may be shared across multiple schedules and are subject to access controls. Embedding them in schedules would create duplication and security management complexity.

Why the Others Are Wrong

• B - IP Range Sets: These are a core component of schedule configuration. Every IP-based discovery schedule needs at least one IP range set defining its scan targets.
• C - MID Server selection: The schedule includes a MID Server field where you specify which MID Server should handle the scan, making this fully configurable within the schedule.
• D - Run interval: The schedule frequency is the most fundamental schedule setting - it determines when and how often the discovery executes.

Memory Tip

A Discovery Schedule answers W-W-W: When (frequency), Where (IP ranges), Which MID (server selection). Credentials are the HOW you authenticate - and that lives in a different place. Schedule = When/Where/Which. Credentials = separate.

Real-World Example

An administrator at HealthNet creates a nightly discovery schedule for the 10.100.0.0/16 subnet using MID Server MID-EAST-01, running daily at 2:00 AM. When she tries to add SSH credentials directly to the schedule, she realizes there is no credential field. She navigates to Discovery > Credentials, creates an SSH credential record with the service account, and then creates a credential rule that matches the 10.100.0.0/16 range. The schedule and credentials work together but are configured in separate locations.

Correct Answer

D. discovery_admin

Source

ServiceNow Zurich - Discovery Admin Workspace

If the link fails, search Google for: ServiceNow Zurich Discovery Admin Workspace role discovery_admin access

Expert Explanation

The Discovery Admin Workspace is a dedicated workspace for managing all aspects of ServiceNow Discovery. Access requires the discovery_admin role, which is the administrative role for the discovery module.

The ServiceNow discovery role hierarchy works as follows:

• discovery_admin: Full access to all discovery functions including the Discovery Admin Workspace, schedules, patterns, credentials, MID Servers, and discovery configuration
• discovery_user: Read-only access to discovery statuses, results, and CI data. Cannot modify discovery configuration or access the admin workspace

The discovery_admin role provides permissions for:

• Creating and modifying discovery schedules
• Managing MID Server configuration
• Editing discovery patterns
• Configuring credentials and credential rules
• Accessing the Discovery Admin Workspace and all its features
• Viewing and resolving discovery errors

Why the Others Are Wrong

• A - it_service_manager: This ITSM role manages service delivery processes. It operates in a different domain (ITSM vs ITOM) and has no discovery administrative permissions.
• B - network_operator: This role is focused on network operations and monitoring. While network operators may benefit from discovery data, they need the discovery_admin role specifically to access the workspace.
• C - discovery_user: This role provides read-only discovery access. The Admin Workspace requires administrative privileges that only discovery_admin provides. Think of discovery_user as "viewer" and discovery_admin as "manager."

Memory Tip

The workspace is called Discovery ADMIN Workspace - the role is discovery_admin. The name tells you the answer. Admin workspace = admin role. If you see "admin" in the workspace name, the role has "admin" in it too.

Real-World Example

A new hire at CloudFirst Corp is assigned the discovery_user role during onboarding. She can view discovery statuses and see which CIs were found, but when she tries to open the Discovery Admin Workspace from the navigator, she gets an "insufficient privileges" error. Her manager submits a request to add the discovery_admin role to her account. After approval, she can access the full workspace with dashboards, schedule management, and error resolution tools.

Correct Answer

B. From a Discovery Pattern

Source

ServiceNow Zurich - Tracked Files in Discovery Patterns

If the link fails, search Google for: ServiceNow Zurich discovery pattern tracked files tab configuration

Expert Explanation

The Tracked Files feature in ServiceNow Discovery allows administrators to monitor specific files on discovered devices for changes. This functionality is configured and modified directly from the Discovery Pattern form.

The image in the question shows the Tracked Files tab on a Discovery Pattern record. From this tab, you can:

• Add files to track by specifying file paths and file names
• Set tracking parameters like checksum monitoring, size tracking, and modification time detection
• Define file patterns using wildcards to match multiple files
• Configure what attributes to collect for each tracked file (permissions, ownership, content hash)

When discovery runs and executes the pattern, it checks the specified files on the target device and records their current state in the CMDB. Subsequent discovery runs detect changes by comparing the new state against the previously recorded values.

This is part of ServiceNow's modern pattern-based discovery architecture, where patterns are the central configuration point for all discovery behavior.

Why the Others Are Wrong

• A - From a Classifier: Classifiers determine CI types during the classification phase of discovery. They answer "what is this device-" but do not define file tracking behavior. Tracked Files is a data collection feature, not a classification feature.
• C - From the MID Server: The MID Server is the execution engine that runs discovery operations. It does not store configuration for what files to track. Configuration lives in the pattern on the ServiceNow instance; the MID Server simply executes the pattern instructions.
• D - From a Probe: Probes are legacy discovery components. The Tracked Files feature was built as part of the modern pattern framework. The image clearly shows a pattern form, not a probe configuration.

Memory Tip

The image shows a tab on a Pattern - and the answer is Pattern. When you see a tab that is part of a form, the answer is always the form it belongs to. Tracked Files TAB lives on the PATTERN form. Tab on Pattern = modify from Pattern.

Real-World Example

A security-conscious administrator at SecureBank wants to monitor critical configuration files on 500 Linux servers. She opens the Linux Server discovery pattern, navigates to the Tracked Files tab, and adds entries for /etc/passwd, /etc/shadow, /etc/ssh/sshd_config, and /etc/sudoers. After the next discovery cycle, the CMDB records checksums for all these files across 500 servers. When an unauthorized change is detected on /etc/sudoers on server SEC-APP-14 three days later, the change appears in the CMDB diff report - triggering a security incident investigation that reveals a compromised service account.