Hot & New
CIS Event Management - ServiceNow Practice Test 2026
Event Management is less about memorizing menus and more about understanding rules, alerts, connectors, and noise reduction. This 200-question set drills the workflows that make or break the CIS-EM exam. Explanations stay tied to Zurich docs so you can verify each call.
Price is shown at checkout on Udemy. 30-day money-back guarantee.
Start practicing nowNext step: CIS-Discovery / RISCO.
What's included
- 200 questions on event rules, connectors, alert logic, and noise reduction
- Every answer links to the official ServiceNow documentation so you can verify it yourself.
- Wrong answers are explained too. You see why each option fails, not just which one wins.
- Current for the Zurich release and the 2026 exam blueprint.
- Lifetime access. When new questions are added, you get them at no extra charge.
- Written by an author who passed all 18 ServiceNow exams on the first attempt.
- 30-day money-back guarantee through Udemy.
15 Free Preview Questions
Answer 5 questions free. Enter your email to continue through question 15. The full course has 200 questions on Udemy.
- ATransform and Compose Alert Output tab
- BEvent rule info tab
- CCI Binding tab
- DEvent Filter tab
Show full explanation
Correct Answer
A) Transform and Compose Alert Output tab
Source
ServiceNow Zurich Docs: Configure Event Rules
(If the link fails, search Google for: ServiceNow Zurich Event Rule Transform Compose Alert Output)
Expert Explanation
The Transform and Compose Alert Output tab in an event rule controls how event fields are mapped to alert fields. When an event with Source "Trap from Enterprise 111" creates an alert showing Source "Oracle EM," the mapping on this tab is overriding the original source value. To change what appears in the alert Source field, you modify the field mapping on this tab.
Why the Others Are Wrong
- Event rule info tab contains metadata about the rule itself, not field transformations
- CI Binding tab handles CMDB association, not alert field values
- Event Filter tab determines which events match, not how alert output is composed
Memory Tip
Transform and Compose = transforming event data into alert output. If the alert shows wrong values, check the Transform tab.
Real-World Example
A monitoring team notices alerts showing "Oracle EM" as the source even though events come from SNMP traps. They open the matching event rule, go to the Transform and Compose Alert Output tab, and find a hardcoded "Oracle EM" value. They change it to use the original event source field.
- AOnce every minute
- BEvery 2 minutes
- CTwice every minute
- DEvery 5 minutes
Show full explanation
Correct Answer
B) Every 2 minutes
Source
ServiceNow Zurich Docs: Event Management Connectors
(If the link fails, search Google for: ServiceNow Zurich Event Management connector polling interval default)
Expert Explanation
Baseline event connectors in ServiceNow are configured to poll event sources every 2 minutes by default. This interval balances the need for timely event detection with system performance. The polling interval can be adjusted per connector based on the criticality of the monitored source.
Why the Others Are Wrong
- Every minute is more frequent than the default setting
- Twice every minute (30 seconds) would cause excessive load on both the MID Server and event source
- Every 5 minutes is longer than the default, which could delay critical event detection
Memory Tip
Default = 2 minutes. Think of it as the "standard heartbeat" for event collection.
Real-World Example
A network monitoring team deploys a new SNMP trap connector. Without changing any settings, it starts collecting events every 2 minutes. For their critical production firewall, they reduce the interval to 1 minute for faster detection.
- AIt defines the login credentials for the service.
- BIt defines the first tier of the application connection (e.g. a URL or IP/Port) to begin discovery.
- CIt defines the person responsible for the service.
- DIt defines the API endpoint for the Event Connector.
Show full explanation
Correct Answer
B) It defines the first tier of the application connection to begin discovery
Source
ServiceNow Zurich Docs: Service Mapping Entry Points
(If the link fails, search Google for: ServiceNow Zurich Service Mapping Entry Points)
Expert Explanation
In Service Mapping, an Entry Point defines the starting connection point for discovering a Mapped Application Service. It specifies how to reach the first tier of the application, typically through a URL for web applications or an IP/port combination for other services. From this starting point, Service Mapping discovers downstream dependencies automatically.
Why the Others Are Wrong
- Login credentials are managed in the Credentials table, not Entry Points
- Person responsible is defined on the service record in the CMDB
- API endpoint for Event Connector is a completely different concept unrelated to Service Mapping
Memory Tip
Entry Point = the front door of your application. Service Mapping walks in through this door and discovers everything inside.
Real-World Example
To map an e-commerce application, the admin creates an Entry Point with URL https://shop.example.com:443. Service Mapping starts at this web server and discovers the load balancer, application servers, databases, and storage systems behind it.
- Acurrent
- Bevent_class
- Cevt
- Dbinding
Show full explanation
Correct Answer
B) event_class
Source
ServiceNow Zurich Docs: Scripting in Event Rules
(If the link fails, search Google for: ServiceNow Zurich Event Rule scripting variables event_class)
Expert Explanation
When writing custom JavaScript in an Event Rule, the event_class variable gives you access to the classification object of the event being processed. This allows you to read classification properties, modify how the event is categorized, and make decisions based on the event classification within your rule logic.
Why the Others Are Wrong
- current refers to the event GlideRecord, not the classification object specifically
- evt is not the standard variable name for classification access in Event Rules
- binding relates to CI binding, a separate concern from event classification
Memory Tip
event_class = the class/category of the event. The variable name literally tells you what it contains.
Real-World Example
An Event Rule needs to set a custom severity based on the event class. The script uses event_class to check the classification and conditionally set the alert severity to Critical for production infrastructure classes.
- AFluctuating
- BSwinging
- CFlipping
- DFlapping
Show full explanation
Correct Answer
D) Flapping
Source
ServiceNow Zurich Docs: Alert Flapping
(If the link fails, search Google for: ServiceNow Zurich Event Management alert flapping)
Expert Explanation
Flapping occurs when an alert repeatedly transitions between open and closed states within a configured time window. This typically indicates an intermittent issue, such as a network link going up and down. ServiceNow detects flapping and can keep the alert open to prevent alert fatigue from constant open/close notifications.
Why the Others Are Wrong
- Fluctuating is a common English word but not the ServiceNow term
- Swinging is not used in ServiceNow Event Management terminology
- Flipping sounds similar but is not the correct ServiceNow term
Memory Tip
Think of a fish flapping on a dock, going up and down rapidly. A flapping alert does the same thing between open and closed states.
Real-World Example
A failing network switch causes a link to drop and reconnect every 3 minutes. Without flapping detection, agents would receive dozens of open/close alert pairs per hour. With flapping detection enabled, ServiceNow keeps the alert open and marks it as flapping, sending a single notification to investigate the unstable link.
- AIt uses back-end tables separate from those in event management rules
- BIt offers a simplified experience for creating and managing event and alert-related rules
- CIt enables centralized administration for all alert management
- DIt allows for the use of JavaScript in all fields
Show full explanation
Correct Answer
B) It offers a simplified experience for creating and managing rules
Source
ServiceNow Zurich Docs: Alert Automation
(If the link fails, search Google for: ServiceNow Zurich Alert Automation Service Operations Workspace)
Expert Explanation
Alert Automation provides a streamlined, user-friendly interface within the Service Operations Workspace for creating and managing event and alert rules. Compared to legacy Alert Management Rules, it reduces complexity by offering guided workflows, reducing the need for scripting, and consolidating rule management into a single workspace experience.
Why the Others Are Wrong
- Separate back-end tables is incorrect; Alert Automation integrates with the Event Management framework
- Centralized administration is a general benefit, not the primary differentiator
- JavaScript in all fields is the opposite of what Alert Automation does; it simplifies by reducing script requirements
Memory Tip
Alert Automation = making alert rules simpler. The key benefit is simplification, not more features.
Real-World Example
An IT operations manager who previously needed a developer to write JavaScript for alert management rules can now create suppression and grouping rules through a guided, no-code interface in the Service Operations Workspace.
- Aexecute()
- Bcollect()
- CtestConnection()
- DvalidateAuth()
Show full explanation
Correct Answer
C) testConnection()
Source
ServiceNow Zurich Docs: Create Custom Event Connector
(If the link fails, search Google for: ServiceNow Zurich custom Event Connector testConnection JavaScript)
Expert Explanation
When building a custom JavaScript-based Event Connector, you must define the testConnection() function to enable the Test Connector button in the connector configuration UI. This function validates that the provided credentials and endpoint are correct without pulling actual event data. The collect() function handles the actual data retrieval during scheduled collection runs.
Why the Others Are Wrong
- execute() is not the designated function for connection testing in the connector framework
- collect() handles actual event data collection, not credential validation
- validateAuth() is not a function defined in the ServiceNow connector API
Memory Tip
testConnection() = test the connection. The function name tells you exactly what it does.
Real-World Example
A developer builds a custom connector to pull events from a legacy mainframe REST API. They define testConnection() to make a simple GET /health call to verify the endpoint responds with 200 OK using the provided credentials. The admin clicks Test Connector in the UI, and the function executes without pulling actual events.
- AA MID Server
- BA cluster of Agent Client Collector (ACC) agents
- CA ServiceNow Glide instance (for public endpoints)
- DThe end-user's browser
- EA third-party cloud monitoring agent
Show full explanation
Correct Answer
A) MID Server, B) ACC agents, C) ServiceNow Glide instance
Source
ServiceNow Zurich Docs: Synthetic Monitoring
(If the link fails, search Google for: ServiceNow Zurich Synthetic Monitoring hosting locations)
Expert Explanation
Synthetic monitors can be hosted from three locations: MID Servers (for internal network testing), ACC agent clusters (for distributed endpoint monitoring), and the ServiceNow Glide instance itself (for public-facing endpoints). Each location provides different visibility depending on where the monitored service is accessible from.
Why the Others Are Wrong
- End-user browser is not a native synthetic monitoring host
- Third-party cloud agents are not part of the ServiceNow synthetic monitoring framework
Memory Tip
Three hosts: MID (internal), ACC (distributed), Glide (public). Think inside, across, and outside the network.
Real-World Example
A company monitors their internal HR portal via MID Server, tests distributed office connectivity via ACC agents, and checks their public website availability directly from the ServiceNow instance.
- A.*(\w+\.\w+\.\w+).*
- BThe server (.*)\s.*
- C.*\s(\w+\.\w+\.\w+).*
- Dthe server (.*).*
Show full explanation
Correct Answer
C) .*\s(\w+\.\w+\.\w+).*
Source
ServiceNow Zurich Docs: Regular Expressions in Event Management
(If the link fails, search Google for: ServiceNow Zurich Event Management regex parsing)
Expert Explanation
The regex .*\s(\w+\.\w+\.\w+).* works by first consuming any characters up to a whitespace character, then capturing a three-part dotted name pattern (like webserver3.domain.com). The \w+ matches word characters and the \. matches literal dots, correctly isolating the FQDN from the surrounding text.
Why the Others Are Wrong
- Option A starts greedy matching from position zero, potentially capturing wrong text
- Option B uses a fixed text prefix and greedy (.*) capture that grabs too much
- Option D is case-sensitive to "the" and uses greedy capture that would match beyond the server name
Memory Tip
Look for the pattern that uses \s before the capture group. The space anchors the start of the server name.
Real-World Example
An event rule needs to extract the server FQDN from free-text event messages. The regex captures "webserver3.domain.com" from "the server webserver3.domain.com is down" and maps it to the alert Node field for CI binding.
- AEnsure all Event Management - process events jobs are set to a Ready state
- BVerify that the Bucket field in the event table is set to zero (0)
- CAdd additional event processor jobs
- DEnsure multi-node event processing is disabled
Show full explanation
Correct Answer
A) Ensure process events jobs are Ready, C) Add additional event processor jobs
Source
ServiceNow Zurich Docs: Event Processing
(If the link fails, search Google for: ServiceNow Zurich Event Management processing performance large environment)
Expert Explanation
In large networking environments, event processing delays can be resolved by ensuring all event processing scheduled jobs are active (Ready state) and by adding more processor jobs to increase parallel throughput. Both approaches increase the rate at which events are consumed from the queue.
Why the Others Are Wrong
- Setting Bucket to zero does not address processing capacity
- Disabling multi-node processing would reduce capacity and worsen delays
Memory Tip
Delayed events? Two fixes: make sure existing processors are running (Ready), and add more processors (additional jobs).
Real-World Example
A large enterprise with 50,000 network devices notices event notifications arriving 30 minutes late. Investigation reveals two of four event processor jobs were paused after a maintenance window. Reactivating them and adding two more jobs brings processing latency back under 2 minutes.
- AEnable multi-node processing
- BIncrease the source polling interval
- CEnsure the bucket value in the event table is greater than 0
- DIncrease the number of scheduled jobs processing events
Show full explanation
Correct Answer
A) Enable multi-node processing, D) Increase scheduled jobs processing events
Source
ServiceNow Zurich Docs: Event Processing
(If the link fails, search Google for: ServiceNow Zurich Event Management multi-node processing performance)
Expert Explanation
Two primary methods improve event processing in large environments: enabling multi-node processing (distributes load across application nodes) and increasing the number of scheduled event processor jobs (adds parallel processing threads). Both approaches increase the total processing capacity of the system.
Why the Others Are Wrong
- Increasing polling interval makes collection slower, not processing faster
- Bucket value greater than 0 is related to processing distribution but is not a primary optimization method listed
Memory Tip
More capacity = more nodes + more jobs. Both multiply processing power.
Real-World Example
A cloud provider managing 100,000 VMs enables multi-node processing across 4 application nodes and increases event processor jobs from 2 to 8. Event processing latency drops from 15 minutes to under 1 minute.
- ACMDB identification and reconciliation engine IRE
- BUnified service map
- CDependency view map
- DCMDB class manager
Show full explanation
Correct Answer
B) Unified service map
Source
ServiceNow Zurich Docs: Unified Service Map
(If the link fails, search Google for: ServiceNow Zurich Unified Service Map Service Operations Workspace)
Expert Explanation
The Unified Service Map in Service Operations Workspace provides a dynamic, real-time visualization of CI relationships and active alerts. It shows how alerts on infrastructure components impact business services through detailed impact paths, helping operators quickly understand the blast radius of an issue.
Why the Others Are Wrong
- CMDB IRE processes CI data, not alert visualization
- Dependency View Map shows CI dependencies but lacks real-time alert integration in SOW
- CMDB Class Manager manages table/class definitions, not operational views
Memory Tip
Unified = everything in one map. Service map + alerts + impact paths, all unified in real time.
Real-World Example
A database server triggers a critical alert. An operator opens the Unified Service Map and immediately sees the alert propagating through the application servers to three customer-facing services, with a clear impact path showing which business services are degraded.
- AA valid MID Server User credential
- BThe Agent Registration Key generated on the instance
- CThe public DNS name of the Cloud Services Endpoint
- DThe internal IP of the primary MID Server
Show full explanation
Correct Answer
B) Agent Registration Key, C) Cloud Services Endpoint DNS name
Source
ServiceNow Zurich Docs: MID-less ACC Deployment
(If the link fails, search Google for: ServiceNow Zurich ACC MID-less deployment registration)
Expert Explanation
In a MID-less ACC deployment for roaming laptops, two parameters are required during installation: the Agent Registration Key (to authenticate the agent with the instance) and the Cloud Services Endpoint DNS name (to establish direct communication without a MID Server). This enables discovery of devices that are rarely on the corporate network.
Why the Others Are Wrong
- MID Server User credential is not needed when deploying without a MID Server
- Internal IP of MID Server contradicts the MID-less architecture
Memory Tip
MID-less needs two things: a key (Registration Key) and a door (Cloud Services Endpoint). No MID Server involved.
Real-World Example
IT deploys ACC agents on 500 sales laptops that rarely connect to VPN. During installation, each agent receives the Registration Key and Cloud Services Endpoint URL. Laptops are discovered and inventoried whenever they have internet access, regardless of VPN connectivity.
- AWhat devices are we using?
- BDid we deprecate assets we do not own?
- CWhat is the current state of our IT infrastructure?
- DHow do we know what servers and applications provide services?
- EHow can I automate and prioritize remediation tasks and notifications?
- FHow can we consolidate our monitoring tools into a single management system
Show full explanation
Correct Answer
C) Current state of IT infrastructure, E) Automate remediation, F) Consolidate monitoring tools
Source
ServiceNow Zurich Docs: Event Management Overview
(If the link fails, search Google for: ServiceNow Zurich Event Management overview challenges)
Expert Explanation
Event Management addresses three key customer challenges: understanding the real-time state of IT infrastructure through event monitoring, automating and prioritizing remediation through alert workflows and correlation, and consolidating multiple monitoring tools into a single management platform to reduce tool sprawl and provide a unified operational view.
Why the Others Are Wrong
- What devices are we using is an asset management concern
- Deprecating assets is an asset lifecycle concern
- What servers provide services is a Service Mapping/CMDB concern
Memory Tip
Event Management = See (infrastructure state), Act (automate remediation), Unify (consolidate tools).
Real-World Example
A bank runs 12 different monitoring tools across network, server, and application teams. Event Management consolidates all events into one platform, automatically correlates related alerts, and triggers incident creation with priority-based routing for remediation.
- ALog Listener
- BSource Type Structure
- CMetric Intelligence Policy
- DEvent Rule Transform
Show full explanation
Correct Answer
B) Source Type Structure
Source
ServiceNow Zurich Docs: HLA Source Types
(If the link fails, search Google for: ServiceNow Zurich Health Log Analytics Source Type Structure Grok)
Expert Explanation
In Health Log Analytics (HLA), the Source Type Structure component defines how raw log text is parsed into structured data. It uses Grok patterns (built on regular expressions) to extract meaningful fields such as timestamp, hostname, severity level, and message content from unstructured log lines. Each log source can have its own Source Type Structure tailored to its specific format.
Why the Others Are Wrong
- Log Listener receives logs but does not define parsing rules
- Metric Intelligence Policy handles metric thresholds, not log parsing
- Event Rule Transform maps event fields to alert fields, unrelated to log parsing
Memory Tip
Source Type Structure = the structure definition for a source type. It tells HLA how to break apart raw text into meaningful pieces.
Real-World Example
A Linux syslog feed sends raw text like "Mar 12 09:15:33 webserver01 nginx: 502 Bad Gateway." The Source Type Structure defines a Grok pattern that extracts Mar 12 09:15:33 as timestamp, webserver01 as host, nginx as application, and 502 Bad Gateway as the message.
Free exam updates. No spam. Unsubscribe anytime.
Prefer to skip the email? Get all 200 questions on Udemy. 30-day money-back guarantee.
You scored 0/15 on the 15-question preview.
The full course keeps the same answer breakdown style across all 200 questions.
A failed exam attempt costs $225 to retake.
Many students also study:
Compare all 18 practice tests, or use the cert quiz to plan what to study next.
Common questions
How many questions are in the full EM practice test?
The full course has 200 questions on Udemy. Every answer option has its own explanation, and the explanations link to official ServiceNow documentation.
Is there a refund if the course is not right for me?
Yes. Udemy courses come with a 30-day money-back guarantee.
Will this practice test guarantee I pass?
No. Practice tests show you where you are weak. They do not replace hands-on work, so pair them with a free ServiceNow Personal Developer Instance.
How much does the real EM exam cost?
The exam costs $450 for a first attempt and $225 for a retake. Fees can change, so check ServiceNow University before you register.
Which certification should I take first?
Most people start with CSA. If you are unsure, take the 2-minute recommendation quiz or read the certification path guide.
Next step after EM: CIS-Discovery / RISCO. Not the right exam? Take the 2-minute quiz or compare all 18.
Browse all 18 practice tests →