CIS-DF Exam Dumps - ServiceNow CIS-Data Foundations (CMDB and CSDM) Questions and Answers

In ServiceNow, each CMDB Health metric can independently define which CIs are in scope for evaluation. This scoping is controlled primarily through Health Inclusion Rules, not CMDB Groups.

In this scenario, the Duplicate metric evaluates all 60,000 Server CIs, indicating no inclusion rule is restricting its scope. In contrast, the Orphan metric evaluates only 50,000 Server CIs, which means 10,000 servers are intentionally excluded from that metric’s evaluation.

This difference is explained by a Health Inclusion rule configured specifically for the Orphan metric on the Server class. Health Inclusion rules allow administrators to define conditions—such as lifecycle state, environment, discovery source, or operational status—that determine whether a CI should be included in a specific health calculation. For example, retired servers or servers in build states may be excluded from orphan checks.

CMDB Groups are not used by the CMDB Health Engine to determine metric scope; they are used for reporting, assignment, and operational grouping. Therefore, Options A and D are incorrect. Option C is also incorrect because the Duplicate metric clearly evaluates the full population of 60,000 servers.

Thus, the scope difference is correctly explained by the Orphan metric having a Health Inclusion rule configured, making Option B the verified answer.

A healthy and trusted CMDB that aligns with Data Foundations principles—covering accurate data ingestion, strong governance, and service-aware relationships—directly strengthens the insight available to Change Management. When discovered infrastructure data is integrated with well-maintained non-discoverable attributes (such as assignment groups, support groups, and ownership), the CMDB becomes a reliable source of truth for evaluating change risk and impact.

Option B is correct because Service Mapping establishes relationships between configuration items (CIs) and business services. This enables change practitioners to perform impact analysis, identifying which services, applications, and downstream components may be affected by a proposed change. Rather than relying on assumptions or tribal knowledge, change records can reference real dependency data, improving risk assessment, scheduling decisions, and stakeholder communication. This aligns directly with CSDM and CMDB best practices, where service context is essential for informed decision-making.

Option D is also correct because accurate, governed non-discoverable data—such as support and assignment groups—allows Change Management processes to dynamically route work. When a change is associated with a CI or service, the system can automatically populate the appropriate assignment group based on CMDB relationships. This improves efficiency, reduces manual errors, and ensures accountability across federated support models.

Options A and C are incorrect because a CMDB, regardless of maturity, cannot guarantee zero downtime, nor does it eliminate the need for human governance, approvals, and risk-based decision-making. Data Foundations enhance insight and control—not unchecked automation or absolute outcomes.

Duplicate identifies data quality issues where the same asset is modeled more than once, violating CMDB trust principles.

Required ensures minimum viable CI creation and update—critical for ingestion and lifecycle integrity.

Orphan highlights broken relationships, which directly impact impact analysis, Service Mapping, and Change Management.

Stale flags CIs that are no longer being refreshed by Discovery or other sources but still exist in the CMDB.

Recommended improves completeness and usability, supporting operational and reporting use cases without being mandatory.

Audit validates data correctness by comparing CI field values against predefined templates or policies.

This exact mapping is what ServiceNow expects in CMDB Health Dashboard–related exam questions and real-world implementations.

When building advanced CMDB queries using CMDB Query Builder in ServiceNow, the correct approach is to model CI scope, relationships, and task context explicitly on the canvas.

To limit results to databases in a specific location, the administrator must filter the Database CI node by the Location attribute. Therefore, Option C is required to scope the query to Database CIs where Location = Seattle.

To include Incidents related to those databases, the Incident table must be added from the Non-CMDB Tables list and linked through the task_ci relationship. This is exactly what Option A provides. CMDB Query Builder separates CMDB tables (CIs) from task and transactional tables, so incidents must be explicitly added from the Non-CMDB section.

Option B is incorrect because property columns on Application Services do not scope databases or incidents. Option D is unnecessary because relationship depth alone does not include non-CMDB task data and does not filter by location.

Thus, the correct actions are A (add Incident table) and C (filter Database by location).

In ServiceNow, Vulnerability Response and Security Incident Response rely heavily on business context to accurately assess risk, prioritize remediation tasks, and communicate impact to stakeholders. From a CSDM (Common Service Data Model) perspective, this context is primarily delivered through properly modeled relationships between Application Services and Business Applications.

The “Application Services with Business Application Relationships” Get Well Playbook directly addresses this requirement. In CSDM, Application Services represent the technical, deployable services that run in the environment, while Business Applications represent the logical applications that support business capabilities. When these two are correctly related, security teams can clearly understand which business processes, customers, and revenue streams are affected by a vulnerability or security incident.

Without this relationship, vulnerabilities may still be detected, but they lack meaningful prioritization. For example, a critical vulnerability on an application service supporting a revenue-generating or customer-facing business application should be addressed far more urgently than one tied to a low-impact internal tool. This relationship is what enables risk-based prioritization, rather than purely technical severity-based prioritization.

The other options do not fulfill this need. Location hierarchy issues (Option A) and CI lifecycle status consistency (Option D) relate more to CMDB hygiene and governance, not security context. Product ownership gaps (Option C) affect accountability but do not directly enable risk estimation during security response.

Therefore, Option B is the correct and CSDM-aligned Get Well Playbook for ensuring sufficient business context in Vulnerability Response and Security Incident Response workflows.

Removing obsolete or inactive CIs from the CMDB must be handled carefully to avoid data loss, audit issues, and unintended operational impact. In ServiceNow, the recommended and governed approach is to use an archive policy.

Archive policies are designed to manage CI lifecycle cleanup based on defined conditions such as class, last updated date, lifecycle status, or operational state. In this scenario, the condition would target Linux Server CIs that have not been updated in six months. Archive policies can either archive or permanently delete records in a controlled, auditable manner, ensuring compliance with data retention and governance standards.

Creating a business rule (Option A) is strongly discouraged for bulk CMDB cleanup because it introduces technical debt, upgrade risk, and unpredictable side effects. A scheduled job (Option C) may automate execution but lacks governance logic and lifecycle awareness on its own.

Archive policies integrate with CMDB Data Manager, provide visibility into actions taken, and support approval and rollback where appropriate. This aligns fully with Data Foundations best practices for maintaining a lean, accurate, and trusted CMDB.

Therefore, the correct and recommended action is B – Create an archive policy.

This question tests understanding of reconciliation source priority in the Identification and Reconciliation Engine (IRE) in ServiceNow.

In reconciliation rules, lower numeric values represent higher priority. Therefore, the priority order is:

ServiceNow (100) – highest authority

Altiris (200)

SCCM (300) – lowest authority

Why A is correct

Because Altiris (200) has higher priority than SCCM (300), data from Altiris can update records originally inserted by SCCM. This is exactly how reconciliation precedence works—higher-priority sources can overwrite lower-priority ones.

Why C is correct

SCCM, even though it has the lowest priority, is still an authorized discovery source. It can insert new records into the Windows Server table when no existing CI is identified. Priority only affects updates, not the ability to create records.

Why B is incorrect

ServiceNow (priority 100) can update records from Altiris and SCCM because it has the highest priority. The statement incorrectly claims it cannot.

Why D is incorrect

SCCM does not have the highest authority. A higher numeric value means lower priority, so SCCM cannot update records created by higher-priority sources.

In CSDM version 5, enterprise-wide capability tracking is firmly positioned within the Design and Planning domain. This domain is specifically intended to support Enterprise Architecture, Portfolio Management, and Strategic Planning use cases, making it the correct choice for an Enterprise Architect working across the organization.

The Design and Planning (Design) domain focuses on answering “what the business needs and how it should be designed” before services are built or delivered. It includes core concepts such as Business Capabilities, Value Streams, Information Objects, Business Applications, and Architectural relationships. Business capabilities represent what an organization does to achieve its objectives, independent of organizational structure, technology, or implementation. This abstraction is essential for enterprise architects, especially in highly regulated industries like financial services, where strategic alignment and impact analysis are critical.

The other domains do not fit this requirement:

Foundation provides shared reference data (companies, locations, users) but does not model enterprise capabilities.

Build and Integration focuses on application development, CI/CD pipelines, and integration layers.

Service Consumption is concerned with customers, offerings, and how services are consumed.

Service Delivery models the operational and technical delivery of services, including infrastructure and runtime environments.

From a Data Foundations and CSDM governance perspective, tracking enterprise capabilities in the Design and Planning domain ensures:

Clear separation between strategy, design, and operations

Alignment with ITIL 4 strategy and planning practices

Strong support for impact analysis, rationalization, and transformation initiatives

Therefore, Design and Planning (D) is the correct and fully aligned CSDM 5 domain for tracking enterprise capabilities.

In ServiceNow, Dynamic CI Groups are a core Data Foundations capability used to automatically manage CI membership based on rules rather than manual maintenance. When Technology Management Service Offerings (Technical Service Offerings) are related to Dynamic CI Groups, ServiceNow uses those relationships to synchronize operational support attributes to the member CIs.

The two CI attributes that are intentionally designed to sync in this model are the Managed by Group and the Support Group. These groups directly influence operational ownership and support routing, which is why they are automatically aligned when Dynamic CI Groups are used. This ensures that incidents, changes, problems, and operational tasks are routed consistently as CI membership changes over time.

The Support Group defines who provides day-to-day operational support and is critical for Incident and Request Management workflows. The Managed by Group represents the team responsible for the technical lifecycle and operational health of the CI. Synchronizing these attributes eliminates manual updates and reduces misrouted tickets, which is a key goal of Configuration Management maturity.

The Approval Group (Option A) is not synced because approvals are process-driven and often context-specific rather than CI-driven. Similarly, the Owned by Group (Option C) represents accountability or financial ownership, which is intentionally decoupled from dynamic operational grouping to avoid unintended governance changes.

Therefore, the correct answers are B (Managed by Group) and D (Support Group).

In ServiceNow, de-duplication tasks generated by the Identification and Reconciliation Engine (IRE) are operational governance tasks that require action by CMDB administrators or data owners. These tasks are surfaced in a role-based and actionable manner to ensure they are addressed promptly.

Within the CMDB Workspace, such tasks are accessed via the My Work tab, specifically under the Total status section. This area consolidates all actionable CMDB-related work items assigned to the user or their groups, including duplicate CI remediation tasks, data certification tasks, attestation requests, and lifecycle governance actions generated by CMDB Data Manager and IRE processes.

Option A is incorrect because the Home tab focuses on high-level navigation and featured actions, not task execution. Option B is also incorrect because the Insights tab and feature adoption tiles provide visibility and analytics, not task management.

By centralizing de-duplication tasks in My Work, ServiceNow ensures CMDB governance is embedded into daily operations, improving responsiveness and data quality while maintaining accountability.

Therefore, the correct answer is C – Total status under the My Work tab.