CIS-CPG Cloud Provisioning and Governance Practice Questions
Prepare for CIS-CPG with more than an answer.
- 1
True or False: Once a Cloud Formation Template (CFT) is imported into ServiceNow CPG, any subsequent changes to the template in its source Git repository are automatically synchronized and reflected in the associated Cloud Catalog Item.
Show answer details
Correct answer: B
Importing a template is a point-in-time action. If the template is updated in the source repository, an administrator must manually re-import or re-discover the template within ServiceNow to create a new version. The system does not automatically synchronize changes to maintain stability and control over the catalog offerings.
- 2
Case Study:
FinCorp, a regulated financial institution, is using ServiceNow CPG to manage its VMware vSphere environment. They have a critical security policy stating that any new virtual machine intended to host a database server must be placed on a specific, isolated vSphere network port group named 'DB_Network_Segregated' and must use a VM template that is hardened according to CIS benchmarks.
Current Setup:
- A Cloud Catalog Item exists for provisioning general-purpose VMs.
- Users can select the network and template from drop-down lists.
- The 'Application' field on the request form allows users to specify the intended role, e.g., 'Database'.
Problem:
Audits have found that developers are provisioning VMs for 'Database' use but are failing to select the correct secure network and hardened template, creating a compliance risk. The goal is to automate the enforcement of this policy.Which CPG configuration provides the most robust and automated solution to this problem?
Show answer details
Correct answer: C
This is the ideal CPG solution. It uses a Governance Policy to conditionally react to user input ('Application'='Database'). The 'Enforce Profile' action allows the system to override any user-selected values with the compliant settings defined in a pre-configured Resource Profile. This automates enforcement without requiring user training or creating duplicate catalog items.
- 3
A developer is creating a custom operation in a blueprint. They need to use an expression to concatenate the user's name (stored in a variable
user_name) with a fixed string '-vm' to create a virtual machine name. Which syntax is correct for this expression in CPG?Show answer details
Correct answer: B
CPG expressions use a JavaScript-like syntax. The
${...}notation is used to embed and evaluate variables or code. Within this notation, standard JavaScript operators like+can be used for string concatenation. - 4
A user reports that their request to provision a new AWS EC2 instance has been in the 'In Provisioning' state for over an hour, which is much longer than usual. As a CPG administrator, where would you look first to get detailed, real-time logs of the CAPI operations and API calls being made to AWS for this specific request?
Show answer details
Correct answer: C
The 'Cloud API Request Trail' provides a detailed, step-by-step log of every CAPI operation executed for a specific provisioning request (Stack). It shows the request sent to the cloud provider, the response received, any errors, and the data being passed in the context. This is the primary tool for troubleshooting in-flight provisioning issues.
- 5
What is the primary architectural difference between how CPG integrates with AWS/Azure versus how it integrates with VMware vCenter?
Show answer details
Correct answer: B
Because VMware vCenter is typically located within a private corporate network, ServiceNow CPG requires a MID Server to be deployed within that network to act as a secure proxy. The ServiceNow instance sends commands to the MID Server, which then communicates with the vCenter API. In contrast, AWS and Azure have public API endpoints, allowing the ServiceNow instance to communicate with them directly over the internet (outbound HTTPS).
- 6
A financial services client has implemented ServiceNow CPG to manage their AWS and Azure environments. They have a strict compliance requirement that any new virtual machine provisioned with the tag 'CostCenter:Trading' must automatically be assigned to a specific, pre-approved network security group and have a maximum lease duration of 90 days. What is the most efficient way to enforce this multi-faceted requirement within CPG?
Show answer details
Correct answer: C
This is the most efficient and declarative approach. CPG is designed to handle such requirements through the combination of Resource Profiles (for resource attributes like network settings) and Policies (for conditional enforcement based on metadata like tags). A policy can enforce the application of a specific profile, which in turn defines the technical specifications and lease terms, avoiding the need for complex custom scripting.
- 7
A cloud administrator is building a custom workflow for a complex provisioning process. The workflow needs to provision a database, retrieve its generated public IP address, and then pass that IP address to a subsequent step that provisions a web server, which needs the IP to configure its connection string.
Which CAPI object is specifically designed to store and pass data, such as the database IP address, between different activities within the same workflow execution?
Show answer details
Correct answer: B
The Cloud Operation Context is a data structure that persists throughout a CAPI workflow's execution. It acts as a data bus, allowing one activity (e.g., provisioning the database) to write output variables (like the IP address) into the context, which can then be read by subsequent activities (e.g., configuring the web server).
- 8
When configuring a Service Account for an Azure cloud provider in ServiceNow CPG, which specific pieces of information are required to establish the connection and authenticate successfully? (Select THREE)
Show answer details
Correct answer: A, C, E
To authenticate an Azure Service Principal, you need the Tenant ID (to identify the Azure AD directory), the Application (client) ID (to identify the application registration), and a Client Secret or Certificate (as the password/proof of identity).
- 9
A development team uses a complex Terraform configuration to deploy their entire application stack, which includes EC2 instances, an RDS database, and a load balancer. The team lead wants to make this stack available for self-service provisioning through the ServiceNow Cloud Catalog while maintaining Terraform as the underlying engine. What is the correct sequence of steps to achieve this?
Show answer details
Correct answer: C
The standard and recommended process involves connecting ServiceNow to the source of the Terraform configuration (like a Git repo) via the Terraform Connector. ServiceNow can then parse the template, generate a corresponding Catalog Item with variables mapped as inputs, and make it available for provisioning, leveraging the native integration.
- 10
True or False: In ServiceNow CPG, a single Resource Profile can be configured to apply different settings based on whether the target cloud provider is AWS or Azure.
Show answer details
Correct answer: B
A Resource Profile is provider-specific. You would create one Resource Profile for AWS settings (e.g., specifying an EC2 instance type) and a separate Resource Profile for Azure settings (e.g., specifying an Azure VM size). A policy could then be used to select the appropriate profile based on the target cloud provider.
