I85PREP
⌘ K
ServiceNow CIS-ITSM study materials
ServiceNow CIS-ITSM study resources

ServiceNow CIS-ITSM practice questions

One question at a time. Build your ServiceNow CIS-ITSM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Service Management Overview and ITSM Fundamentals

Which IT Service Management practice is primarily responsible for restoring normal service operation as quickly as possible and minimizing the adverse impact on business operations?

  1. Service request management
  2. Problem management
  3. Incident management Correct answer.
  4. Change enablement

Explanation

Incident management owns the incident lifecycle and is focused on returning service to an agreed state as quickly as possible while limiting business impact. It logs, categorizes, prioritizes, escalates and resolves interruptions rather than investigating long-term causes.

Question 2IT Service Management Overview and ITSM Fundamentals

In ServiceNow, which table stores incident records?

  1. task
  2. incident Correct answer.
  3. problem
  4. change_request

Explanation

Incident records live in the incident table, which extends the task table so it inherits common fields such as number, state, assignment group and SLA references. The problem and change_request tables hold their own separate record types.

Question 3IT Service Management Overview and ITSM Fundamentals

Which change type is pre-authorized for a defined, low-risk procedure and therefore does not require individual approval from the Change Advisory Board?

  1. Emergency
  2. Major
  3. Normal
  4. Standard Correct answer.

Explanation

Standard changes are low-risk, repeatable changes with a documented procedure that is approved in advance, so they can be raised and implemented without a per-change CAB review. Normal and Emergency changes both go through an authorization step.

Question 4IT Service Management Overview and ITSM Fundamentals

In ServiceNow, incident priority is calculated from which pair of fields?

  1. Impact and category
  2. Impact and urgency Correct answer.
  3. Severity and SLA definition
  4. Urgency and assignment group

Explanation

Priority is derived from a matrix lookup of impact against urgency: high impact combined with high urgency produces the highest priority. Category, assignment group and SLA definitions do not feed the priority calculation.

Question 5IT Service Management Overview and ITSM Fundamentals

Which practice is responsible for identifying the root cause of recurring incidents and maintaining the known error database?

  1. Change enablement
  2. Service configuration management
  3. Problem management Correct answer.
  4. Incident management

Explanation

Problem management performs root cause analysis, documents workarounds and records known errors so that recurring incidents can be resolved faster or prevented. Incidents are the trigger and evidence for this work, but the cause analysis itself sits with problem management.

Question 6IT Service Management Overview and ITSM Fundamentals

Which ServiceNow feature lets end users browse published items and submit orders without contacting the service desk?

  1. Service level agreement
  2. Change calendar
  3. Service catalog Correct answer.
  4. Configuration management database

Explanation

The service catalog exposes catalog items and record producers that users can order from a portal, creating requests and requested items automatically. This self-service channel offloads routine contacts from the service desk.

Question 7IT Service Management Overview and ITSM Fundamentals

A user orders a laptop from the service catalog. Which record represents that single ordered line item in ServiceNow?

  1. sc_task
  2. sc_request
  3. kb_knowledge
  4. sc_req_item Correct answer.

Explanation

Each catalog item ordered produces a requested item (sc_req_item) record that carries the item variables and price. One or more requested items roll up to a single request (sc_request) record.

Question 8IT Service Management Overview and ITSM Fundamentals

What is the primary purpose of the Configuration Management Database (CMDB)?

  1. To store user credentials and access policies
  2. To track SLA breaches and escalations
  3. To hold CIs and the relationships between them Correct answer.
  4. To publish knowledge articles for end users

Explanation

The CMDB stores configuration items and the relationships that connect them, giving ITSM processes an accurate model of the infrastructure and services they support. Incident, problem, change and asset processes all reference this data.

Question 9IT Service Management Overview and ITSM Fundamentals

A user submits a single catalog order containing a laptop and a monitor. How many sc_request and sc_req_item records does ServiceNow create?

  1. Two sc_request and one sc_req_item record
  2. One sc_request and two sc_req_item records Correct answer.
  3. One sc_request and one sc_req_item record
  4. Two sc_request and two sc_req_item records

Explanation

The order produces one request header (sc_request), and one requested item (sc_req_item) is generated for each distinct catalog item in the cart. Fulfillment tasks are then created per requested item.

Question 10IT Service Management Overview and ITSM Fundamentals

Which type of agreement is made between two parts of the same organization to support delivery of a service?

  1. Service level target
  2. Service level agreement
  3. Underpinning contract
  4. Operational level agreement Correct answer.

Explanation

An operational level agreement is an internal agreement between teams within the same organization describing how they will support each other in delivering a service. A service level agreement is with the customer, and an underpinning contract is with an external supplier.

Question 11IT Service Management Overview and ITSM Fundamentals

Which statement best describes the relationship between problems and incidents?

  1. A problem is a user request; an incident is a failed change
  2. A problem is the underlying cause; an incident is one interruption Correct answer.
  3. An incident documents the root cause; a problem documents user impact
  4. A problem and an incident are the same record type

Explanation

A problem represents the unknown or known cause behind one or more incidents, while an incident is a single unplanned interruption or degradation of a service. Several incidents may be linked to a single problem record.

Question 12IT Service Management Overview and ITSM Fundamentals

When the start condition of an SLA definition is met for a task, what does ServiceNow create?

  1. A change request linked to the task
  2. A new contract_sla definition
  3. A task SLA record attached to the task Correct answer.
  4. A scheduled job for the task

Explanation

Meeting a start condition instantiates a task SLA record that tracks the stage, breach time and elapsed percentage for that specific task. The SLA definition itself is configuration and is not duplicated.

Question 13IT Service Management Overview and ITSM Fundamentals

An incident is temporarily suspended while the service desk waits for the caller to supply more information. Which incident state reflects this?

  1. In progress
  2. Resolved
  3. On hold Correct answer.
  4. Closed

Explanation

On hold indicates work is paused, typically awaiting the caller or a third party, and the SLA can be configured to pause while in this state. In progress means active work is underway.

Question 14IT Service Management Overview and ITSM Fundamentals

Which statement defines a known error?

  1. A problem with a documented root cause and workaround Correct answer.
  2. An incident that has breached its SLA target
  3. A catalog item withdrawn from the catalog
  4. A change that was rejected by the CAB

Explanation

A known error exists once the root cause of a problem has been identified and a workaround is available, which lets the service desk resolve matching incidents faster. It is recorded against the problem record.

Question 15IT Service Management Overview and ITSM Fundamentals

After a problem's root cause is identified and a permanent fix is planned, which record type is typically created to implement that fix?

  1. A catalog task
  2. A knowledge article
  3. A service level agreement
  4. A change request Correct answer.

Explanation

Permanent fixes are delivered through change enablement, so a change request is raised and linked to the problem so the remediation is assessed, authorized and scheduled. The problem can then be resolved once the change is implemented.

Question 16IT Service Management Overview and ITSM Fundamentals

What is the purpose of an assignment rule?

  1. To publish catalog items to a portal
  2. To set the assignment group or assignee automatically based on conditions Correct answer.
  3. To calculate the priority of an incident
  4. To define which users may approve a change

Explanation

Assignment rules evaluate conditions on a record and populate the assignment group or assigned to fields so work reaches the right team without manual triage. They run on record creation or update depending on configuration.

Question 17IT Service Management Overview and ITSM Fundamentals

In ITIL 4, which concept describes the interconnected activities an organization performs to deliver value to customers?

  1. Service portfolio
  2. Service value chain Correct answer.
  3. Service catalog
  4. Configuration model

Explanation

The service value chain is the set of six interconnected activities (plan, improve, engage, design and transition, obtain and build, deliver and support) through which the organization converts inputs into value. It sits within the wider service value system.

Question 18IT Service Management Overview and ITSM Fundamentals

Which of the following is one of the three technical management practices in ITIL 4?

  1. Incident management
  2. Service desk
  3. Deployment management Correct answer.
  4. Problem management

Explanation

ITIL 4 groups its practices into general management, service management and technical management. The three technical management practices are deployment management, infrastructure and platform management, and software development and management.

Question 19IT Service Management Overview and ITSM Fundamentals

What primarily distinguishes a service request from an incident?

  1. A request is a standard user ask; an incident is an unplanned interruption Correct answer.
  2. A request is handled by problem management
  3. A request must be approved by the CAB
  4. A request always has a lower priority than an incident

Explanation

A service request is a routine, pre-defined item or piece of information a user asks for, handled through request fulfillment. An incident is an unplanned interruption or degradation of a service that must be restored.

Question 20IT Service Management Overview and ITSM Fundamentals

Which practice sets agreed targets for service delivery and monitors performance against them?

  1. Knowledge management
  2. Service level management Correct answer.
  3. Service configuration management
  4. Change enablement

Explanation

Service level management negotiates, agrees and monitors service targets, using SLAs, OLAs and underpinning contracts and tracking achievement through SLA records. It provides the reporting that shows whether commitments are being met.

Question 21IT Service Management Overview and ITSM Fundamentals

A task SLA on an incident is in the Paused stage when its scheduled breach time passes. What is the expected behavior in ServiceNow?

  1. The SLA records a breach immediately and stops
  2. The breach time shifts by the paused duration; no breach is recorded while paused Correct answer.
  3. The stage changes to Completed with breached set to true
  4. The SLA record is deleted and re-created when the task resumes

Explanation

Pausing an SLA stops the clock and moves the breach time forward by the paused interval, so the SLA cannot breach while it remains paused. The remaining time is preserved and counting resumes when the pause condition clears.

Question 22IT Service Management Overview and ITSM Fundamentals

Which of the following tables directly extends the task table?

  1. cmdb_ci
  2. change_request Correct answer.
  3. sys_user
  4. kb_knowledge

Explanation

change_request extends task and therefore inherits the common task fields such as number, state, assignment and SLA references, as do incident and problem. The other options belong to different table hierarchies.

Question 23IT Service Management Overview and ITSM Fundamentals

What does the change conflict detection feature in ServiceNow identify?

  1. Changes scheduled to affect the same CI at overlapping times Correct answer.
  2. Changes that exceed their planned budget
  3. Changes whose approvals are still pending
  4. Changes that have been closed without review

Explanation

Conflict detection compares planned change schedules against the configuration items they affect and flags changes that would be implemented on the same CI within an overlapping window. This helps change managers avoid collisions before authorizing a schedule.

Question 24IT Service Management Overview and ITSM Fundamentals

In incident management, how do resolution and closure differ?

  1. Resolution is the final administrative step; closure restores the service
  2. Resolution is optional; closure is mandatory for every incident
  3. Resolution requires CAB approval; closure requires user approval
  4. Resolution restores the service; closure confirms and finalizes the record Correct answer.

Explanation

Resolution is recorded once a fix has restored service and the resolution code is captured. Closure is the later step that confirms the outcome with the user, completes any follow-up and finalizes the record.

Question 25IT Service Management Overview and ITSM Fundamentals

Which ServiceNow role is typically required for a user to access and work on ITSM records such as incidents, problems and changes?

  1. knowledge_admin
  2. approver_user
  3. itil Correct answer.
  4. catalog_admin

Explanation

The itil role is a composite role that grants the access needed to work with ITSM applications, including incidents, problems, changes and requests. More granular roles exist for narrower access, but itil is the standard grant for ITSM practitioners.

Question 26Incident Management

On the ServiceNow incident form, how is the Priority value determined out of box?

  1. Computed from Impact and Urgency using a priority matrix Correct answer.
  2. Inherited from the affected CI's criticality value
  3. Entered by the caller on the service portal form
  4. Taken from the assignment group's service level agreement

Explanation

Priority is a derived field: the platform combines the Impact and Urgency values through a priority lookup matrix and stores the resulting priority. Changing either Impact or Urgency recalculates the priority automatically. Callers and SLAs do not set priority directly.

Question 27Incident Management

In the out-of-box incident lifecycle, which state immediately precedes Closed?

  1. Canceled
  2. Resolved Correct answer.
  3. In Progress
  4. On Hold

Explanation

The incident flow is New, In Progress (with possible On Hold detours), Resolved, then Closed. Resolution is recorded first, and closure is the final administrative step performed after resolution.

Question 28Incident Management

Which field must be populated before an agent can resolve an incident in the out-of-box configuration?

  1. Close notes
  2. Resolution notes Correct answer.
  3. Assignment group
  4. Hold reason

Explanation

Resolution information is captured at resolve time, so the resolution code and resolution notes are mandatory before the state can move to Resolved. Close notes belong to the later closure step, and hold reason applies only to On Hold.

Question 29Incident Management

When an agent sets an incident to On Hold, which field becomes mandatory?

  1. Escalation level
  2. Hold reason Correct answer.
  3. Affected CI
  4. Resolution code

Explanation

On Hold represents waiting on a third party or the caller, so the platform requires a hold reason to record why work is paused. This lets reporting distinguish waiting states from active effort.

Question 30Incident Management

The Incident [incident] table extends which base table?

  1. Problem
  2. Service
  3. Change Request
  4. Task Correct answer.

Explanation

Incident extends Task, which supplies shared fields and behavior such as number, state, assignment, and SLA attachments used by other task types. Problem and Change Request are separate tables that also extend Task.

Question 31Incident Management

Which role lets a user create, update, and work incidents without administrative rights?

  1. catalog_admin
  2. itil Correct answer.
  3. asset
  4. report_admin

Explanation

The itil role is the standard role for IT service management agents and grants the ability to work records such as incidents, problems, and changes. Administrative and specialized roles are not required for day-to-day incident handling.

Question 32Incident Management

Which two fields work together to classify what an incident is about for reporting and routing?

  1. Impact and Urgency
  2. Category and Subcategory Correct answer.
  3. Caller and Opened by
  4. State and Hold reason

Explanation

Category and Subcategory form the hierarchical classification of the incident type, and they drive reporting, routing, and assignment logic. Impact and Urgency instead determine priority severity.

Question 33Incident Management

A caller reports that a previously resolved incident is still occurring, so the agent reopens it. To which state does the incident return?

  1. Closed
  2. On Hold
  3. New
  4. In Progress Correct answer.

Explanation

Reopening returns the record to active work so it can be investigated again, which is the In Progress state. The resolution information is cleared so a fresh resolution must be recorded when work completes.

Question 34Incident Management

Which field establishes a parent-child relationship between two incident records?

  1. Affected CI
  2. Parent Correct answer.
  3. Service
  4. Assignment group

Explanation

The Parent field on the child incident references the parent incident record, creating a hierarchy of related work. This supports splitting a large outage into manageable child incidents.

Question 35Incident Management

What is the main benefit of promoting an incident to a major incident?

  1. It removes the incident from all SLA measurement
  2. It triggers heightened visibility, coordination, and communication Correct answer.
  3. It automatically converts the record into a problem record
  4. It permanently locks the record against further edits

Explanation

Major incident handling is about mobilizing the organization for high-impact outages, so promotion drives specialized communication, a dedicated bridge or war room process, and executive visibility. The record remains an incident and continues to be managed normally.

Question 36Incident Management

Under what circumstances do assignment rules on the incident table typically evaluate?

  1. Only when an agent manually clicks an assign button
  2. Only during a nightly scheduled job
  3. When an incident is inserted or updated and the rule conditions match Correct answer.
  4. Only the first time the record is opened by a user

Explanation

Assignment rules run during record processing on insert and update, and when their conditions match, they populate assignment fields before the record is saved. Out-of-box rules are usually conditioned so they do not overwrite an existing assignee.

Question 37Incident Management

Which capability creates incident records automatically when users send email to a monitored support mailbox?

  1. Workflow timers
  2. Inbound email actions Correct answer.
  3. UI policies
  4. Access control lists

Explanation

Inbound email actions define how the platform processes received messages, including creating a new incident or updating an existing one based on the message content. They are the standard mechanism for email-to-incident processing.

Question 38Incident Management

An incident with an active task SLA is moved to On Hold. What happens to the SLA timer?

  1. It pauses if the SLA definition's pause condition matches the record Correct answer.
  2. It keeps counting exactly as before with no change
  3. It immediately completes and records a breach
  4. It is canceled and a new SLA is attached on resume

Explanation

Task SLA records evaluate a pause condition defined on the SLA definition; when the condition is true, elapsed time stops accumulating. Whether On Hold pauses an SLA therefore depends on how that SLA definition is configured.

Question 39Incident Management

Which incident field holds the configuration item that is believed to be malfunctioning?

  1. Configuration item Correct answer.
  2. Business service
  3. Service offering
  4. Asset tag

Explanation

The Configuration item field references the CI record that is failing or affected, linking the incident to the CMDB. This link supports impact analysis and reporting on problem-prone infrastructure.

Question 40Incident Management

An agent suspects a string of incidents shares an underlying root cause. Which incident action is intended for that situation?

  1. Cancel the incidents as duplicates
  2. Create a change request for each incident
  3. Resolve the incidents without investigation
  4. Create a problem record linked to the incident Correct answer.

Explanation

Problem management exists to investigate and eliminate recurring root causes, and an incident can be used to raise a linked problem. Linking incidents to a problem gives the root cause analysis a home and preserves the incident history.

Question 41Incident Management

What does the Notify field on an incident control?

  1. Whether the record is included in SLA reporting
  2. Whether update notifications are sent to the caller Correct answer.
  3. Whether the assignment group is paged on escalation
  4. Whether the incident appears in the service portal

Explanation

Notify governs caller-facing communication for that record; when it is cleared, notifications about updates are suppressed for the caller. It does not affect internal escalation or reporting behavior.

Question 42Incident Management

What is the purpose of incident tasks?

  1. To record the SLA definitions that apply to the incident
  2. To define the catalog items available to the caller
  3. To split the work of an incident into assignable units of effort Correct answer.
  4. To store the closure approval signatures for the incident

Explanation

Incident tasks let an agent break a single incident into smaller pieces of work that can be assigned to different people or teams. They roll up under the parent incident so overall progress is still tracked in one place.

Question 43Incident Management

Which incident field identifies the person who experienced the issue being reported?

  1. Watch list
  2. Caller Correct answer.
  3. Assigned to
  4. Opened by

Explanation

The Caller field captures the user on whose behalf the incident is logged, which may differ from the person entering the record. This distinction matters for communication and for service reporting.

Question 44Incident Management

Why would an incident management team maintain templates for the incident table?

  1. To generate the numeric incident identifier
  2. To replace the need for assignment rules
  3. To prefill common field values for frequently logged incident types Correct answer.
  4. To enforce access control at the field level

Explanation

Templates store standard values for fields so agents can log a recurring incident type quickly and consistently. They reduce data entry errors and support consistent categorization and routing.

Question 45Incident Management

An agent resolves a recurring incident and wants to capture the fix as reusable guidance. Which action supports that?

  1. Create a change request from the incident
  2. Escalate the incident to a major incident
  3. Create a child incident under the record
  4. Create a knowledge article from the incident Correct answer.

Explanation

Knowledge creation can be initiated from an incident so the diagnosis and resolution become a reusable article. This closes the loop between incident resolution and future self-service or agent guidance.

Question 46Incident Management

Using the out-of-box priority matrix, what priority results when Impact is 1 (High) and Urgency is 3 (Low)?

  1. 4 - Low
  2. 3 - Moderate Correct answer.
  3. 1 - Critical
  4. 2 - High

Explanation

The priority matrix maps high impact combined with low urgency to priority 3, Moderate. Priority 1 requires both high impact and high urgency, while priority 4 typically pairs medium impact with low urgency.

Question 47Incident Management

In the out-of-box configuration, Resolved incidents that no one closes are automatically closed after how long?

  1. Fourteen days
  2. Seven days Correct answer.
  3. Thirty days
  4. Three days

Explanation

The auto-closure behavior closes incidents that have stayed in the Resolved state for seven days, which keeps the active queue clean. The interval is controlled by system properties, so an administrator can change it.

Question 48Incident Management

Which numeric value of the incident State field represents Resolved?

  1. 4
  2. 6 Correct answer.
  3. 3
  4. 7

Explanation

In the incident state model, New is 1, In Progress is 2, On Hold is 3, Resolved is 6, Closed is 7, and Canceled is 8. Value 6 is therefore the persisted value for a resolved incident.

Question 49Incident Management

Which table stores the individual SLA timer records attached to an incident?

  1. Contract SLA
  2. SLA definition
  3. Service level agreement
  4. Task SLA Correct answer.

Explanation

Task SLA is the table that holds runtime SLA records for a task, tracking stage, elapsed time, breach status, and pause state. SLA definitions are the reusable configurations from which those runtime records are generated.

Question 50Incident Management

A resolved incident is reopened by the caller's follow-up message. What is the most appropriate handling for preserving metrics and history?

  1. Log a brand-new incident and cancel the old one
  2. Leave the record resolved and note the issue in a comment
  3. Close the record immediately and ask the caller to call back
  4. Reopen the existing incident so the original record continues its lifecycle Correct answer.

Explanation

Reopening keeps the full history, effort, and SLA data in one record and correctly reflects that the original fix did not hold. Creating a duplicate record fragments the history and distorts reopen and resolution metrics.