ServiceNow CIS-ITSM Implementation Specialist

In base ServiceNow ITSM configuration, what happens to a resolved incident if no one reopens it?

• AIt is deleted after 7 days
• BIt automatically moves to Closed after 7 days
• CIt remains Resolved until an agent closes it manually
• DIt converts to a problem after 7 days

A widespread outage requires networking, identity, and messaging teams to work in parallel while leadership wants one communication hub. What is the best record design?

• AOne major incident with child incidents for the specialist teams
• BThree unrelated major incidents, one for each resolver group
• COne problem record with no incident records
• DOne catalog request with fulfillment tasks

In the out-of-box incident priority design, which fields should analysts set to drive priority?

• AImpact and urgency
• BCategory and subcategory
• CState and assignment group
• DCaller and configuration item

Before configuring incident assignment rules, which requirement should be documented first?

• AWhich support groups own specific services, categories, or CI types
• BWhich colors the service desk dashboard should use
• CHow many closed incidents to archive each month
• DWhich managers prefer email instead of notifications

The business wants one target for first response and a separate target for restoring service. What should be configured?

• AA single resolution SLA only
• BSeparate response and resolution SLAs
• CA problem task for every incident
• DA CAB approval before assignment

A service desk restores email by restarting a service, but the outage has happened several times this month and the root cause is unknown. What should happen next?

• ACreate a problem and relate the recurring incidents to it
• BClose the incident and take no further action
• COpen a catalog item for the email team
• DConvert the incident directly into a standard change

Service has been restored, but the team wants a short period for user confirmation before final closure. Which incident state is the best fit?

• ANew
• BOn Hold
• CResolved
• DCanceled

One incident requires the desktop team to replace a laptop and the security team to revoke tokens at the same time. What is the best design?

• ACreate two unrelated incidents
• BUse incident tasks under the same incident
• CUse a request and requested items instead of an incident
• DClose the incident and open a problem

During a major incident, which record should normally act as the main status and stakeholder communication hub?

• AThe parent major incident
• BThe oldest child incident
• CA related problem record
• DA change request

A regional network outage affects 12 branch offices, and each office needs its own field dispatch notes and local ownership. What is the most scalable approach?

• ACreate one incident with all branch notes mixed together
• BCreate a parent incident with a child incident for each branch
• CCreate one problem record only
• DCreate a separate catalog request for each branch

An outage needs separate assignment groups and independent state tracking for network and database teams under one event. Which design fits best?

• AOne incident with work notes only
• BChild incidents under a coordinating parent incident
• COne incident with no assignments
• DA standard change template

An incident is waiting on a third-party vendor before work can continue. Which state choice is most appropriate?

• AResolved
• BClosed
• COn Hold with an appropriate hold reason
• DCanceled

When designing incident intake, which data set is most important for routing and prioritization?

• ACaller, short description, affected service or CI, impact, and urgency
• BOnly the caller's department and manager name
• CThe analyst's preferred assignment group
• DCAB agenda and release version

What is the main difference between a Resolved incident and a Closed incident?

• AResolved is final, while Closed is temporary
• BResolved means service is restored pending confirmation or auto-close; Closed is final
• CClosed means work is paused pending vendor input
• DThere is no difference in the base process

What should primarily determine whether an incident is treated as a major incident?

• AThe assignee's personal preference
• BPredefined business impact criteria and governance rules
• CWhether the caller is from IT
• DHow many work notes already exist

An organization added manager approval before every incident can be assigned, and restoration times have worsened. What is the best recommendation?

• AKeep the approval because all task records should require approval
• BRemove approval from the incident path and reserve approvals for processes such as change…
• CConvert every incident to a problem before work starts
• DMake all incidents major incidents to increase visibility

A user reports that the issue is still happening after the analyst marked the incident Resolved. What should happen?

• ACreate a brand new incident every time
• BReactivate or reopen the existing incident for continued work
• CDelete the resolved incident and start over
• DConvert the incident directly into a change

Teams say incidents are frequently misrouted because analysts classify the same issue differently. What should be clarified before adding more routing automation?

• AThe wallpaper settings for the service desk monitors
• BA consistent category and ownership model for common incident types
• CWhether all callers should become approvers
• DWhether problem records should replace incidents

What is the main benefit of child incidents during a major outage?

• AThey allow parallel team work while keeping central coordination on the parent
• BThey automatically eliminate the need for communication updates
• CThey replace the need for assignment groups
• DThey convert the outage into a known error

When should an implementer prefer an incident task instead of a child incident?

• AWhen the work item needs its own caller communication, separate lifecycle, and separate o…
• BWhen the work is a discrete activity under the incident and does not need a full separate…
• CWhen the issue should be investigated as a root cause problem
• DWhen CAB approval is required

A team wants to reduce manual triage by adding one large custom script that hard-codes routing logic for every incident type. What is the more maintainable approach?

• AUse data-driven assignment rules based on stable classification and ownership data
• BForce agents to pick an assignment group manually for every ticket
• CConvert all incidents to problems for reassignment
• DMove routing decisions into CAB meetings

A monitoring integration creates incidents automatically. Which field is especially valuable to populate for downstream routing and impact analysis?

• AAffected service or configuration item
• BCAB agenda item
• CKnowledge article number
• DRequested item number

A major outage is already being worked, and many more users call to report the same issue. What is the best service desk approach?

• ACreate isolated incidents with no relationship so each caller has a separate path
• BRelate the additional reports to the existing major incident structure instead of fragmen…
• CIgnore the new callers because the outage is already known
• DConvert each new incident to a standard change

Leadership needs one outage dashboard, but infrastructure, application, and telecom teams each need separate technical work ownership. Which design best supports both needs?

• AOne parent incident with child incidents for each resolver area
• BOne incident and no assignments
• COnly incident tasks, even when separate incident lifecycles are needed
• DA single problem record without incidents

A workaround restored service, but the permanent fix requires a planned production restart tomorrow night. What should the team do?

• AImplement the restart directly from the incident with no other process
• BRaise a governed change for the permanent fix
• CClose the incident and stop tracking the issue
• DDelete the incident and start a new one after the restart

Which base component controls the automatic move of a problem from New to Assess?

• AThe Update Problem State to Assess business rule
• BA scheduled job named Problem Auto Close
• CThe CAB workbench
• DThe incident priority data lookup

A root cause is understood and a workaround is documented, but the permanent fix has not been implemented yet. How is this condition typically described?

• AMajor incident
• BKnown error
• CEmergency change
• DCatalog request

Many incidents across different offices point to the same application defect. How should they be structured for root cause analysis?

• ACreate one problem and relate the incidents to it
• BKeep every incident isolated with no shared record
• CConvert all incidents into changes
• DUse a request item as the parent record

Service has been restored, but the underlying cause is still unknown and recurrence risk is high. Why should a problem be opened?

• ATo investigate root cause and prevent repeat incidents
• BTo replace the original incident record completely
• CTo avoid using change management later
• DTo bypass assignment groups

After a recurring critical outage, what should strong RCA governance require before a problem is closed?

• AOnly a final work note that says fixed
• BDocumented root cause, workaround or recovery guidance, and prevention actions or ownersh…
• CA new incident for every affected user
• DRemoval of all related incidents

What is the main value of documenting a workaround on a problem record?

• AIt lets the service desk restore service faster when the issue recurs
• BIt automatically changes all future incidents to Closed
• CIt replaces the need for root cause analysis
• DIt prevents the use of change records

A problem investigation needs separate assigned activities such as collecting logs, validating a hypothesis, and testing a fix. Which record type should be used?

• AProblem tasks
• BRequested items
• CIncident duplicates
• DCAB agenda entries

A workaround exists and incidents can be resolved with it, but the permanent correction is still pending. Should the problem remain open?

• ANo, close the problem as soon as a workaround exists
• BYes, because the underlying issue still needs controlled resolution or an explicit risk d…
• CNo, convert the problem into an incident
• DYes, but only if CAB has already approved a change

A stakeholder proposes automatically creating a problem for every high-priority incident. What is the best response?

• ADo it, because severity alone should always create a problem
• BCreate problems selectively when criteria indicate meaningful root cause investigation is…
• CReplace all incident records with problems
• DOpen changes instead of problems

A known error has a tested permanent fix that must be deployed to production. Which additional process is usually required?

• AChange Management through a change request
• BA duplicate incident only
• CA catalog item checkout
• DDeleting the problem record

Before configuring problem assignment rules and closure behavior, what should stakeholders define first?

• AThe portal theme for problem forms
• BOwnership, investigation criteria, and RCA expectations
• CWhether incidents should be hidden from service desk agents
• DWhether all changes should be emergency changes

One root cause investigation needs separate work owned by the database, application, and infrastructure teams, each with its own assignee and due date. What is the best design?

• AThree unrelated problem records
• BOne parent problem with problem tasks for the team-specific work
• COne major incident with no problem record
• DOne request with three requested items

A new incident matches a documented known error. What should the analyst use first to restore service quickly?

• AThe workaround documented on the related problem or known error
• BA CAB meeting invitation
• CA new catalog request
• DA duplicate problem record

Which statement best distinguishes Problem Management from Incident Management?

• AProblem Management restores service quickly, while Incident Management performs root caus…
• BIncident Management restores service, while Problem Management investigates and prevents…
• CThey are the same process with different labels
• DProblem Management is only used for catalog items

What is the most effective way to improve RCA quality and auditability in a ServiceNow problem process?

• AAllow analysts to close problems with free-text notes only
• BRequire structured root cause, workaround, and prevention information before closure
• CAutomatically close every problem after 7 days
• DHide related incidents from the problem form

Which set of conflicts can ServiceNow Change Management conflict detection identify?

• ABlackout periods, CI maintenance windows, and scheduled changes
• BDuplicate users, expired passwords, and missing approvals
• CClosed incidents, inactive groups, and stale knowledge articles
• DFailed imports, skipped workflows, and update collisions

What is the main purpose of a change model in ServiceNow?

• ATo define reusable presets, lifecycle behavior, and governance for similar changes
• BTo replace the CMDB for all change records
• CTo store incident root cause data
• DTo force every change to become emergency

How are standard changes typically treated in the out-of-box change process?

• AThey are pre-authorized for repeatable, low-risk work
• BThey always require ECAB review before scheduling
• CThey bypass implementation and review states entirely
• DThey must start as incidents

A production outage requires an urgent fix before the next scheduled CAB meeting. Which group is most appropriate to review and authorize the change?

• ACAB
• BECAB
• CThe service desk queue
• DThe problem management team only

A database team wants one class of changes to use its own defaults, lifecycle, and restricted creator audience. What is the best approach?

• ACreate a dedicated change model
• BCreate only a dashboard
• CConvert the changes into incidents
• DDisable approvals globally

What should you expect when a change is scheduled inside an applicable blackout window?

• AIt is silently approved because blackout windows are informational only
• BConflict detection flags the scheduling issue for review or rescheduling
• CThe change automatically becomes an emergency change
• DThe CI is removed from the change automatically

Besides overlapping scheduled changes, what schedule source can also create a change conflict?

• AA CI maintenance window or blackout period relevant to the planned work
• BA resolved incident on the same service
• CAn inactive assignment group
• DA catalog variable set