CIS-EM sample questions

Question 1

Which are recommended best practices for Event Management? (Choose three.)

Accepted Answer

Promote all events to alerts during initial implementation until you fully understand which should be ignored.

Accepted Answer

Filter out events at source rather than in the ServiceNow instance.

Accepted Answer

Ignore all non-critical events during initial implementation to streamline processing; add alerts over time as time and resources allow.

Answer

Filter out events on ServiceNow Instance for easier consolidation and aggregation.

Answer

Base-line “normal-state' events to filter out background noise.

Question 2

For an incoming event with a matching message key, what allows an existing alert to be automatically closed?

Accepted Answer

In the event rule, set the Severity to -1

Answer

In the event rule, set the Severity to 0

Answer

In the alert rule, set the Severity to 0

Answer

In the alert rule, set the Severity to -1

Question 3

A support agent resolves an incident associated with an alert, but the alert does automatically close even though the evt_mgmt.incident_closes_alert property is set appropriately to close the alert.

What is the most likely cause of this issue?

Accepted Answer

The support agent does not have the evt_mgmt_user role.

Answer

The support agent only has the evt_mgmt_admin role.

Answer

The support agent has the evt_mgmt_operator role, but not the evt_mgmt_user role.

Answer

The support agent has the evt_mgmt_user role, but not the evt_mgmt_operator role.

Question 4

What are the two most accurate statements regarding the ServiceNow CMDB (configuration management database) and CIs (configuration items)?

Accepted Answer

The CMDB is a dynamic list that tracks both the CIs within your platform and the relationship between those items.

Accepted Answer

A CI is any component within your infrastructure that needs to be managed in order to deliver Services.

Answer

The CMDB is a series of tables that contain only key hardware components located in critical paths within your platform that must be managed.

Answer

All CIs stored in the CMDB must have an assigned IP address within your infrastructure.

Question 5

An administrator is troubleshooting an issue where events from a specific source are not being de-duplicated, resulting in multiple alerts for the same ongoing issue. The administrator inspects the incoming events and confirms that the `message_key` field is populated and identical for all related events. The event processing flow is depicted below. At which stage is the de-duplication logic primarily handled? ```mermaid flowchart TD A[Event Received] --> B{Event Rule Processing}; B --> C[CI Binding]; C --> D{Alert Creation/Update}; D --> E[Alert Management Rules]; E --> F[Incident Creation]; ```

Accepted Answer

D (Alert Creation/Update)

Answer

A (Event Received)

Answer

B (Event Rule Processing)

Answer

C (CI Binding)

Question 6

When creating an alert management rule, where would you specify a workflow to resolve a given condition?

Accepted Answer

From the Remediation tab

Answer

From the Actions tab

Answer

From the Launcher tab

Answer

In the Related Links section

Question 7

What type of system can a MID Server can be installed on?

Accepted Answer

Microsoft Windows Server

Answer

OpenVMS System

Answer

Linux System

Answer

Microsoft Windows Desktop

Answer

Any system inside the customer firewall

Answer

Mac OS X System

Question 8

What would be the primary use case for creating Javascripts in Event Management?

Accepted Answer

To create a customized pull connector to retrieve events on behalf of an event source

Answer

To automatically populate the Configuration Management Database (CMDB)

Answer

To parse a nodename out of your raw event data in an event rule

Answer

To run as part of a remediation workflow for IT alerts that fail to execute

Question 9

What would you use to define the monitoring sources allowed to communicate with the ServiceNow instance for Operational Intelligence?

Accepted Answer

Metric Type Actions

Answer

Metric Registration

Answer

Metric Config Rules

Answer

Metric to CI

Question 10

The value of the Alert Priority score is a composite of what?

Accepted Answer

The value of the alert’s category and its relative weight

Answer

The value of the alert’s category and its Priority Group

Answer

The value of the alert’s Severity and its Priority Group

Answer

The value of the alert’s Severity and its relative weight

CIS-EM Event Management Practice Questions

Create an account to continue.

Create an account to continue.

Related exams