CIS-ITSM Practice Questions

A single underlying problem, such as a faulty network switch or a failing database cluster node, can cause incidents on multiple different upstream CIs that depend on it. For example, several application servers (each a separate CI) might report errors (separate incidents), but the root cause is a single storage array (the problem's CI). Therefore, it is common and expected for a problem to have related incidents with various CIs.

The 'Can Contribute' related list uses User Criteria to define which users or groups are permitted to author, edit, and submit articles for a specific knowledge base. The 'Can Read' list defines who can view published articles. Approval permissions are handled by workflows or approval policies, not directly by this list.

For a strict audit requirement, security must be enforced on the server side. An Access Control List (ACL) is the correct mechanism for this. A write ACL on change_request.risk and change_request.impact with a condition that the state is 'Assess' (or any subsequent state) and a role/script that evaluates to false will prevent any user from modifying the fields, regardless of how they access the data (form, list view, API). UI Policies and Client Scripts are client-side and can be bypassed.

The CMDB Health 'Completeness' metric is configured using the 'Required' and 'Recommended' field lists in the CI Class Manager. Adding fields to the 'Recommended' list will cause the health metric to check if they are populated, and CIs with empty values will lower the completeness score. Making them 'Required' would enforce population at the data entry level (like a dictionary attribute or data policy), which might be too strict if the data isn't always available upon CI creation.

The order of execution for record creation is critical. The Record Producer script runs first to populate the current object. Then, 'before' business rules execute. Since the business rule runs 'before' the record is inserted into the database, its calculation will overwrite any values previously set. Assignment rules also run before insert, but the final data modification before the database write will be from the business rule. The priority lookup will use the impact and urgency set by the record producer to perform its calculation.

Requirement 1 specifically calls for automatic categorization and assignment for POS system incidents. The most direct and standard way to achieve this is by using rules that trigger based on information in the incident. An Assignment Rule can set the 'POS Support' group, and a Data Lookup rule (or a simple business rule) can set the 'Retail Systems' category when the CI of the incident is identified as a POS system. This directly addresses the routing problem.

Requirement 3 states the Emergency Change model must bypass initial CAB approval but include a post-implementation review (PIR). The best way to model this is with a custom state model and workflow. The workflow should skip the 'Assess' and 'Authorize' states (where CAB approval typically happens), move quickly to 'Implement', and then transition to a 'Review' state. In the 'Review' state, the workflow should generate a change task for the Post-Implementation Review.

Flow Designer is the best tool for this scenario as it provides native, low-code actions for complex processes like looking up on-call schedules and sending notifications via various channels (like SMS through Notify). It can handle the entire sequence, including adding to the watch list, without requiring extensive custom scripting. A Business Rule with a Script Include could work but is a less modern, code-heavy approach. A Workflow is typically for record lifecycles, not discrete updates. A UI Action requires manual intervention.

The correct way to handle dynamic, data-driven approvals is within the process engine (Workflow or Flow Designer) that governs the change model. By adding an 'Approval - User' activity and scripting its input, the approval is formally requested, tracked, and logged. This is scalable because it's part of the defined process. A business rule could send a notification but wouldn't create a formal, auditable approval record. Relying on the VP to filter their approvals is not a reliable or automated process. An assignment rule is for assigning tasks, not approvals.

An Order Guide is specifically designed for bundling multiple, existing catalog items into a single request process. It allows the user to answer a set of initial questions, and based on the rules, it adds the relevant items (in this case, all four) to their cart. This approach reuses the existing items and their fulfillment processes without modification, making it the most efficient and maintainable solution.