32 free ServiceNow CIS-EM practice questions from the CertStash pack of 130, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 32 free here, all 130 in the pack, and each step includes the one before it.
Get all 130 questions (US$39) · Download the first 10 as a PDF
Question 1
What feature would you use to trigger a workflow or automatically generate tasks via templates?
Show answer and explanation
Correct answer: C. Alert management rules
Alert Management Rules act on alerts that match their filter, and can launch a workflow, create tasks such as incidents from templates, or run remediation. They are the Event Management feature built for this automated response.
Why the other options are wrong
- A. Event rules transform and filter incoming events into alerts; they do not launch workflows or create tasks from templates.
- B. Task rules are not the Event Management feature for automating responses to alerts.
- D. Alert correlation rules group related alerts into primary and secondary alerts but do not trigger workflows or tasks.
Question 2
What are the valid states an alert can be in during its lifecycle?
Show answer and explanation
Correct answer: A. Open, Reopen, Flapping, Closed
Alerts progress through the states of Open, Reopen, Flapping, and Closed during their lifecycle. Open is the initial state, Reopen occurs when a closed alert becomes active again, Flapping indicates rapid state changes, and Closed is the terminal state.
Why the other options are wrong
- B. New, Updating, Waiting, and Complete are not valid alert states in ServiceNow Event Management.
- C. Open, Updating, Swinging, and Closed do not represent the correct alert lifecycle states; Swinging is not a valid state.
- D. Open, Warning, Flapping, and Clear are not the correct progression; Warning and Clear are not standard alert states in this context.
Question 3
What Event Management module allows for configuration of automatic task creation?
Show answer and explanation
Correct answer: A. Alert management rules
Alert management rules are the Event Management module component that allows configuration of automatic task creation. These rules define when and how tasks should be generated based on alert conditions and properties.
Why the other options are wrong
- B. Task rules manage existing tasks but are not the primary configuration point for automatic task creation from alerts.
- C. Event rules trigger workflows and actions but are not specifically designed for task creation configuration.
- D. Alert correlation rules combine alerts but do not provide the mechanism for automatic task creation.
Question 4
You have a system configured with a MID Web Server using Basic authentication to enable Operational Management Intelligence (OI) to push raw metric data to the MID Server. No data is getting through to the MID Server. What is the most likely cause of the issue?
Show answer and explanation
Correct answer: D. An invalid password is set in the MID Web Server Context
An invalid password set in the MID Web Server Context is the most likely cause when Basic authentication is configured and data is not reaching the MID Server. The MID Web Server requires valid credentials in its context configuration to authenticate requests from Operational Management Intelligence.
Why the other options are wrong
- A. If the MID Web Server were already running, a restart would not be necessary as the root cause.
- B. The MID Web Server is typically running if it was properly configured; this would not be the most likely issue when authentication is involved.
- C. Secret keys are not used in Basic authentication; Basic authentication relies on username and password credentials.
Question 5
In the event table, which field maps the external attributes from the target system?
Show answer and explanation
Correct answer: D. Additional Information
The Additional information field on an event holds extra attributes from the monitoring source as JSON key-value pairs. Event rules can then map these external attributes into alert fields.
Why the other options are wrong
- A. Resource names the component on the node that the event is about, not the external attribute set.
- B. Description is free text summarising the event.
- C. Source only identifies which monitoring tool sent the event.
Question 6
By default, the Alert Console displays what type of alerts?
Show answer and explanation
Correct answer: E. All Primary and Secondary Open alerts with a Severity of Critical, Major, Minor, and Warning that are not in Maintenance mode
By default, the Alert Console displays all Primary and Secondary Open alerts and anomaly alerts with a Severity of Critical, Major, Minor, and Warning that are not in Maintenance mode. This default filter ensures visibility of both primary and secondary alerts across critical severity levels while excluding alerts in maintenance windows.
Why the other options are wrong
- A. This option excludes Secondary alerts, which are included in the default view.
- B. This option incorrectly specifies the severity levels and maintenance mode logic.
- C. This option excludes Secondary alerts and does not specify that only Open alerts are shown.
- D. This option excludes Secondary alerts from the default display.
Question 7
Which are recommended best practices for Event Management? (Choose three.)
Show answer and explanation
Correct answer: C, D, E. Filter out events at source rather than in the ServiceNow instance; Baseline “normal-state” events to filter out background noise; Ignore all non-critical events during initial implementation to streamline processing; add alerts over time as time and resources allow.
The recommended best practices are: Filter out events at source rather than in the ServiceNow instance to reduce processing load, Baseline normal-state events to filter out background noise and reduce alert fatigue, and Ignore all non-critical events during initial implementation to streamline processing while adding alerts over time as understanding and resources improve.
Why the other options are wrong
- A. Filtering events in ServiceNow is less efficient than filtering at the source; events should be filtered before reaching the instance.
- B. Promoting all events to alerts creates unnecessary noise and inefficiency; a selective approach aligned with actual incidents is better.
Question 8
For an incoming event with a matching message key, what allows an existing alert to be automatically closed?
Show answer and explanation
Correct answer: A. In the event rule, set the Severity to 0
In the event rule, setting the Severity to 0 allows an existing alert with a matching message key to be automatically closed. A severity value of 0 indicates a clearance or resolution event that closes the corresponding alert.
Why the other options are wrong
- B. Alert rules do not contain severity settings that trigger alert closure; event rules handle this action.
- C. Setting severity to -1 in alert rules is not the correct mechanism for closing alerts.
- D. While event rules are correct, severity -1 is not used; severity 0 is the value that triggers alert closure.
Question 9
During processing of the event and if the event Severity is blank, the state of the event is set to:
Show answer and explanation
Correct answer: C. Error
When an event has a blank Severity field during processing, the event state is set to Error. This is a validation check in the event processing lifecycle, Severity is a required attribute, and missing it indicates a data quality problem that prevents normal event processing.
Why the other options are wrong
- A. Ready state is used for events that have passed validation and are prepared for alert creation.
- B. Ignored state is used when events are deliberately excluded from processing based on filter rules.
- D. Processing is a transient state during active event handling, not a terminal state for validation failures.
Question 10
What two key steps must be performed after creating a new connector instance? (Choose two.)
Show answer and explanation
Correct answer: D, E. Test the connector; Activate the connector
After creating a new connector instance, the two key steps are to Test the connector to verify connectivity and proper configuration, and then Activate the connector to enable it for production use. Testing ensures the connector works correctly before activation, and activation puts it into service.
Why the other options are wrong
- A. Assigning a MID Server may be necessary for some connector types, but it is not universally required for all connectors and is not a mandatory post-creation step.
- B. Entering credentials is typically done during connector creation or configuration, not after instance creation as a separate step.
- C. Debugging is an optional troubleshooting step performed only if issues arise, not a standard post-creation requirement.
What people say about the full CIS-EM pack 5.0 from 1
Cert Stash pdf dumps for ServiceNow CIS-EM are highly recommended to all who are appearing for the exam. I scored 92% marks.
Question 11
What would be the primary use case for creating Javascripts in Event Management?
Show answer and explanation
Correct answer: C. To parse a nodename out of your raw event data in an event rule
Javascripts in Event Management are primarily used to parse and extract data from raw event fields, such as extracting a node name from unstructured event data within event rules. This allows for data transformation and normalization during event processing.
Why the other options are wrong
- A. Creating pull connectors requires connector development, not Event Management javascripts.
- B. CMDB population is handled through different ServiceNow mechanisms, not Event Management javascripts.
- D. Remediation workflows use different scripting and execution mechanisms separate from Event Management javascripts.
Question 12
What are the possible actions available in alert management? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. Execute remediation subflows; Execute remediation workflows; Launch applications
Alert management supports three primary action types: executing remediation subflows (A), executing remediation workflows (B), and launching applications (C). These actions allow operators to automatically respond to alerts by triggering predefined automation sequences or opening relevant tools and interfaces for incident response.
Why the other options are wrong
- D. Evaluating business rules is a condition used in alert management rule processing, not an action that can be performed on an alert.
- E. Creating service catalog requests is not a standard action available in alert management; alerts typically trigger incident creation or other operational responses.
Question 13
Where can you look to determine what event rule created an alert? (Choose two.)
Show answer and explanation
Correct answer: A, C. Alert Activity; Event Processing Notes
Alert Activity and Event Processing Notes are the two locations where you can determine which event rule created an alert. Alert Activity shows the history of changes to the alert, while Event Processing Notes contains the rule processing details and which rule was applied.
Why the other options are wrong
- B. Event Additional Information contains supplementary data but not the rule creation information.
- D. Alert Message Key is used for de-duplication, not for identifying which rule created the alert.
- E. Alert Source identifies the originating system but does not indicate which event rule was applied.
Question 14
A support agent resolves an incident associated with an alert, but the alert does automatically close even though the evt_mgmt.incident_closes_alert property is set appropriately to close the alert. What is the most likely cause of this issue?
Show answer and explanation
Correct answer: A. The support agent does not have the evt_mgmt_user role.
The evt_mgmt_user role is required to perform the action that triggers the automatic alert closure when an incident is resolved. Without this role, even with the property correctly configured, the system lacks the necessary permissions to execute the alert closure workflow. The evt_mgmt_user role is the standard operational role needed for alert and incident management tasks.
Why the other options are wrong
- B. The evt_mgmt_admin role alone is actually more permissive than evt_mgmt_user and would include necessary permissions.
- C. The evt_mgmt_operator role combined with lack of evt_mgmt_user is not the typical permission issue; the evt_mgmt_user role is what's needed.
- D. Having evt_mgmt_user without evt_mgmt_operator is not the cause; evt_mgmt_user is the critical role for this functionality.
Question 15
What applications are included in the ITOM Health product?
Show answer and explanation
Correct answer: A. Event Management and Operational Intelligence
The ITOM Health product specifically includes Event Management and Operational Intelligence as its core applications. These components work together to collect, normalize, and analyze events and alerts from across the IT infrastructure.
Why the other options are wrong
- B. ITOM Visibility is a separate ITOM product, not included in ITOM Health.
- C. Discovery and Service Mapping are components of ITOM Discovery, a distinct product.
- D. Cloud Management is a separate ServiceNow product offering outside ITOM Health.
Question 16
What attribute is used to consolidate events into a single alert?
Show answer and explanation
Correct answer: B. Message Key
The Message Key attribute is used to consolidate multiple events into a single alert. Events sharing the same Message Key are identified as related occurrences of the same issue and are combined into one alert record rather than creating separate alerts.
Why the other options are wrong
- A. Event Rules define filtering and processing logic, not the consolidation mechanism itself.
- C. Alert Priority determines urgency ranking but does not drive event consolidation.
- D. Severity is an event attribute that may influence alert handling but is not the consolidation key.
Question 17
Which attribute is responsible for de-duplication?
Show answer and explanation
Correct answer: B. Message_key
The message_key attribute is responsible for event de-duplication in Event Management. This field is used to identify duplicate events and group related events together, allowing the system to suppress redundant alerts.
Why the other options are wrong
- A. Metric_name identifies the type of metric but is not used for de-duplication logic.
- C. Short_description is a display field and is not used as the de-duplication mechanism.
- D. Additional_info contains supplementary data but is not the primary de-duplication attribute.
Question 18
What event value will auto close an alert?
Show answer and explanation
Correct answer: C. Resolution State of Closing
An event with a Resolution State of Closing will auto-close an alert in ServiceNow. The Resolution State field is the designated mechanism for triggering automatic alert closure, and the Closing value indicates that the underlying issue has been resolved and the alert should be automatically closed without further intervention.
Why the other options are wrong
- A. Severity of -1/OK may indicate resolution but is not the field that triggers auto-close functionality.
- B. Event Type of Clear is not the standard field used to auto-close alerts in ServiceNow.
- D. Resolution State of Clear is not the correct value; Closing is the correct resolution state value.
- E. Severity of 0/Clear indicates a cleared condition but does not trigger automatic alert closure.
Question 19
A four node cluster makes up the components (CIs) of a Business Service. The impact influence for the cluster is set to 60%. How many members of the cluster must be in a Critical state in order for the Business Service to display as Critical in the Impact Tree?
Show answer and explanation
Correct answer: C. 3
With a four-node cluster and a 60% impact influence threshold, the business service becomes critical when the failure impact exceeds 60% of the cluster. Since 3 out of 4 nodes equals 75% of the cluster, three nodes must be in a Critical state for the overall Business Service to display as Critical in the Impact Tree. Two nodes would only represent 50%, falling short of the 60% threshold.
Why the other options are wrong
- A. One node represents 25% of the cluster, well below the 60% threshold needed.
- B. Two nodes represent 50% of the cluster, still below the 60% threshold required.
- D. Four nodes in critical state would render the entire service critical, but only three are needed to meet the 60% requirement.
Question 20
When creating event rules, is it best practice to create:
Show answer and explanation
Correct answer: C. As few rules as possible
Best practice in event rule creation is to create as few rules as possible while still meeting operational requirements. This approach reduces complexity, minimizes maintenance overhead, decreases the risk of conflicts between rules, and improves system performance by avoiding redundant or overlapping rule evaluations.
Why the other options are wrong
- A. Creating two rules for every event is arbitrary and leads to unnecessary complexity.
- B. Creating as many rules as possible causes performance degradation, conflicts, and maintenance challenges.
- D. One rule per event is overly restrictive and ignores scenarios where multiple conditions may apply to a single event type.
Question 21
Based on the information shown, which of the following three alerts should be processed first?
Show answer and explanation
Correct answer: B. The Alert Priority score 4406020.001 was calculated according to the following factors, ordered by their respective priority (2018-05-31 20:04:47 GMT) Category (Score, Weight) 1. Business services, (4.0, 1000000.0) 2. Severity, (4.0, 100000.0) 3. CI type, (60.0, 100.0) 4. Role, (2.0, 10.0) 5. Secondary, (0) 6. State, (1.0, 0.001)
Alert B has the highest priority score of 4406020.001, driven primarily by the Business services score of 4.0 with a weight of 1000000, which contributes 4,000,000 points to the total. Additionally, Alert B has a Severity score of 4.0 (compared to 1.0 and 3.0 in the other alerts), further elevating its priority. Since alerts are processed based on calculated priority scores from highest to lowest, Alert B should be processed first.
Why the other options are wrong
- A. Alert A has a lower overall priority score of 3106020.001 and lower severity and business service scores than Alert B.
- C. Alert C has the lowest priority score of 3306020.001 and also has lower severity and business service scores than Alert B.
- D. While chronological order is a consideration, the priority scoring system explicitly ranks alerts by calculated factors, not by receipt time.
Question 22
How would you interpret the following data in the Operational Intelligence Insights Explorer?
Show answer and explanation
Correct answer: B. win-ces882ierw is one of your hottest Configuration Items (CIs), but is currently experiencing a low probability of anomalies
The green indicator dot next to win-ces882ierw in the Operational Intelligence Insights Explorer signifies normal operational status with low anomaly probability. The device is listed as a monitored Configuration Item, but the green status indicator clearly denotes that it is currently experiencing low probability of anomalies and does not require immediate attention. The term 'hottest' in ServiceNow OI terminology refers to CIs with high anomaly risk requiring urgent review, which this device is not demonstrating based on its green status.
Why the other options are wrong
- A. The green indicator shows low anomaly probability, not high, so immediate checking is not required.
- C. While it may be monitored, the green indicator denotes low probability of anomalies, contradicting the 'high probability' claim.
- D. The reference answer conflicts with the visual indicator; the green dot indicates low anomaly risk, not high, making option B the correct interpretation.
Question 23
The value of the Alert Priority score is a composite of what?
Show answer and explanation
Correct answer: C. The value of the alert’s Severity and its Priority Group
Alert Priority score is a composite value calculated from the alert's Severity level and its Priority Group. These two attributes together determine the overall priority ranking of the alert within the system.
Why the other options are wrong
- A. Category is not used in Alert Priority score calculation; Severity is the relevant attribute.
- B. While Priority Group is part of the calculation, it is paired with Severity, not category.
- D. Relative weight is not the standard term; Priority Group is the correct component paired with Severity.
Question 24
By default, Event Management tries to bind an alert to CI (configuration item), by matching the node name in the event to which three items in the CMDB (configuration management database)?
Show answer and explanation
Correct answer: A. CI name, Fully qualified domain name, IP or MAC address
Event Management automatically binds alerts to configuration items by matching the node name in the event against the CI name, the fully qualified domain name (FQDN), and the IP or MAC address stored in the CMDB. These three attributes provide the most reliable and comprehensive matching criteria for correlating incoming events with existing infrastructure components.
Why the other options are wrong
- B. Webserver name is not a standard CMDB matching attribute; FQDN is used instead for domain resolution.
- C. SSH public host keys are not used for default alert-to-CI binding in Event Management.
- D. System class name is not part of the standard three-item matching criteria; CI name is the correct attribute.
Question 25
What would you use as a central location to explore the CMDB class hierarchy, CI table definitions, and CIs?
Show answer and explanation
Correct answer: E. CI Class Manager
The CI Class Manager is the central location in ServiceNow for exploring and managing the CMDB class hierarchy, viewing CI table definitions, and understanding the relationships and structure of all configuration items. It provides a complete view of how CIs are organized and classified within your platform.
Why the other options are wrong
- A. CI Remediations is focused on corrective actions for configuration items, not the class hierarchy.
- B. CI Relation Types defines the relationships between CIs but not the overall class hierarchy.
- C. CI Identifiers relates to how CIs are uniquely identified, not the class structure.
- D. Process to CI Type Mapping connects processes to CI types but is not the central hierarchy management tool.
Question 26
Which attribute correlates multiple events to one alert?
Show answer and explanation
Correct answer: B. Message_key
The Message_key attribute is used to correlate multiple events to a single alert. Events with the same Message_key value are grouped together and consolidated into one alert record, enabling event deduplication and correlation.
Why the other options are wrong
- A. Additional_info is a supplementary field for context, not a correlation mechanism.
- C. Metric_name identifies the metric being measured, not a correlation identifier for events.
- D. Short_description is a human-readable summary field, not used for automatic event correlation.
Question 27
What is the function of the External Communication Channel (ECC) Queue? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. It is a connection point between a ServiceNow instance and the MID Server; It contains probe records to be executed on the customer’s network; It holds jobs that the MID Server needs to perform.
The External Communication Channel (ECC) Queue serves as a connection point between a ServiceNow instance and the MID Server, contains probe records to be executed on the customer's network, and holds jobs that the MID Server needs to perform. These three functions make the ECC Queue the central communication and job management mechanism for all MID Server activities, enabling remote data collection and system integration.
Why the other options are wrong
- D. The ECC Queue communicates with the MID Server, not directly with hardware CIs; the MID Server handles network-level communication.
- E. The ECC Queue does not contain records of CIs submitted for CMDB entry; this relates to discovery processes and CMDB management, not ECC Queue function.
Question 28
Agent Client Collector is built on what framework that enables you to adopt and extend monitoring checks from the community?
Show answer and explanation
Correct answer: B. Sensu
Sensu is an open-source monitoring framework that enables users to adopt and extend monitoring checks from the community through its architecture and plugin system. This community-driven extensibility is a core feature of Sensu's design, allowing operators to leverage shared checks and integrate with various monitoring tools.
Why the other options are wrong
- A. Icinga is a monitoring system but is not specifically known for the Agent Client Collector framework.
- C. SolarWinds is a proprietary monitoring solution not built around community-extensible framework architecture.
- D. Nagios is a monitoring platform but does not use the Agent Client Collector framework architecture.
- E. Zabbix is a monitoring tool but is not built on the Agent Client Collector community framework model.
Question 29
What ServiceNow feature would you configure to process incoming email to create events?
Show answer and explanation
Correct answer: B. Inbound actions
Inbound actions is the ServiceNow feature configured to process incoming email and create events. Inbound actions define rules and scripts that parse incoming email messages and automatically convert them into events that can be ingested into the Event Management system.
Why the other options are wrong
- A. Transforms are used to map and compose events after they have been received, not to process incoming email.
- C. Event processing jobs are scheduled background processes for event handling, not the mechanism for processing incoming email.
- D. Event Filter is used to filter events that have already been created, not to process incoming email.
- E. Event field mapping normalizes fields in already-created events, not the entry point for email processing.
Question 30
What is Event Management licensing based on?
Show answer and explanation
Correct answer: A. The number of unique nodes that can send events to the instance
Event Management licensing in ServiceNow is based on the number of unique nodes that can send events to the instance. This represents the scope of monitoring capability and is the standard licensing metric for event management modules. The number of connectors (B, C) and CIs in the CMDB (D) may be related to configuration but are not the basis for Event Management licensing itself.
Why the other options are wrong
- B. Licensing is not based on the total number of connectors and listeners combined.
- C. The number of connectors alone does not determine Event Management licensing; it is based on source nodes.
- D. CMDB CI count is a licensing factor for other modules but not for Event Management licensing.
Question 31
Applying recommended Event Management best practice guidelines, which of the following events should generate an alert?
Show answer and explanation
Correct answer: B. Only events that necessitate action should generate an alert.
Event Management best practices dictate that only events requiring action should generate alerts. This approach reduces alert fatigue, ensures operators focus on actionable items, and prevents the system from being overwhelmed with notifications that do not require intervention. Generating alerts for every event or only critical CIs would either create excessive noise or miss important incidents.
Why the other options are wrong
- A. Generating alerts for every event creates alert fatigue and reduces operational effectiveness by flooding operators with non-actionable notifications.
- C. Limiting alerts to only the most critical events on every CI may miss important incidents on less-critical infrastructure that still require action.
- D. This approach would generate excessive alerts on critical CIs even for events that require no action, violating best practice principles.
Question 32
The individual commands that the Agent Client Collector executes on the host are known as what? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. Events; Checks; Metrics
The Agent Client Collector executes individual commands on a host that are known as events, checks, and metrics. Events represent occurrences detected on the host, checks are the individual monitoring checks performed, and metrics are the measured values collected. Parameters (C) are configuration inputs to commands rather than the commands themselves. Policies (D) are higher-level configurations that determine which commands to run. Scripts (F) are code that may implement checks but are not the individual commands themselves.
Why the other options are wrong
- C. Parameters are inputs to commands, not the commands themselves.
- D. Policies define which commands to execute, not the individual command executions.
- F. Scripts are implementations or tools, not the term for individual commands executed by the collector.
That was 32 of 130.
The full ServiceNow CIS-EM pack has all 130 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 62 free as one PDF by email. Get the Half Pack →