CIS Discovery – Questions and Answers Already Passed

CIS Discovery – Questions and Answers Already Passed To enable File-Based Discovery, navigate to? Discovery Configuration Console What are the 2 types of Discovery? Horizontal discovery Top-Down discovery What is Horizontal Discovery? Horizontal discovery is used to scan the network, find computers and devices, and then populate the CMDB with the CIs it finds. Horizontal discovery creates direct relationships between CIs, such as a runs on relationship between an application CI and the actual computer CI that it runs on. Horizontal discovery is not aware of business services and does not create relationships between CIs based on the business service they are in. What is Top-down Discovery? Top-down discovery is a technique that Service Mapping uses to find and maps CIs that are part of business services, such as an email service. Which components does Discovery use to find CI's? Probes and sensors & Patterns What are Probes and Sensors? Probes and sensors are scripts that collect and process data on a host and then update the CMDB. - Probes explore or investigate CIs on your network - Sensors parse the data returned from the probes. If you want to add Steps to a Pattern, where do you add them? Using the Pattern Designer and add steps to the Extension Section In which order are the Identification Steps and Extension Steps executed? Identification Steps run first, then the Extension Steps What does the area on the right side of the Pattern configuration form represent? The CI attributes (fields) of the CI class you are trying to discover How can you populated the fields that are visible in the CI Attributes part on the right side? By activating the Debug Mode What is the Debug Mode in the Pattern Designer, used for? It allows someone who want to write, modify or extend a Pattern, to 'read' a live system on the fly, with values. What is reconciliation ? ServiceNow reconciliation is a process that prevents duplication and inconsistency of Configuration Items (CIs) and software assets in the Configuration Management Database (CMDB) What are reconciliation rules used for? Reconciliation rules determine which data sources can update CI attributes, and the Identification and Reconciliation engine (IRE) uses these rules to accept or reject information from different sources. What is WMI ? Windows Management Instrumentation (provides all windows /hardware related specifications) What is the default operation of the first step, when you enter Debug Mode ? Set Parameter Value If you are in Debug Mode and want to create a step for Operation: 'WMI Query', how can you get the namespace you need to use? (Since you cannot select it from the list..? Click on Get Data button wich retrieves the WMI structure from the device I'm using the Debug Mode for. What type of Operation do you need to use when creating a step to 'strip' returned values (for example in debug mode, the date is returned as .11.11 Create a step with Operation Parse Variable Do you need to publish your new steps which have been created as Extension? No, just SAVE What should you do, to make a new Pattern Extension available to all MID Servers? Synchronize the MID Servers to update them with the lastest pattern changes, by using the button 'Pattern Sync to Mid' Where do MID Servers store all of the patterns? In the NDL directory NDL = Nebula Description Language What are the 4 phases of Discovery? Port Scan Classification Identification Exploration Which process steps are executed during the PORT SCAN phase? Shazzam Probe scans common ports Discovery determines which Ports responded and identifies the type of machine Which process steps are executed during the CLASSIFICATION phase? Classification Probe is sent based on port probe response (executed in Port Scan phase) Probe retrieves additional information, such as version of OS, then Classifies the device. Which process steps are executed during the IDENTIFICATION phase? 1. Patterns unify the Identification and Exploration phases 2. The Classifier specifies the Horizontal Pattern Probe 3. The Horizontal Pattern probe specifies which pattern to launch 4. Horizontal Pattern probe also contains a Sensor used for updating the CMDB Which process steps are executed during the EXPLORATION phase? 1. Patterns unify the Identification and Exploration phases 2. The Classifier specifies the Horizontal Pattern probe 3. The Horizontal Pattern probe specifies which pattern to launch 4. Horizontal Pattern probe also contain a Sensor used for updating the CMDB In which 2 phases is Discovery ALWAYS using Probes and Sensors? Port Scan & Classification How do Probes, Sensors and the ECC Queue work? 1. The probe collects the information and the sensor processes it. Both get their instructions from the ECC queue. 2. A Worker job on the MID Server monitors the queue for work. The monitor checks for any entries in the ECC Queue where Queue = Output AND State = Ready 3. The MID Server then processes all the output ECC messages, runs the necessary probes, and returns the probes results to the ECC queue. These results are put in the ECC Queue as input entries. 4. After an entry is inserted in the ECC Queue table, a business rule fires (on insert) that takes that information and runs it through a sensor processor. The sensor processor's job is to take the input data, find any sensors interested in that data, and pass it along to be processed. Those sensors ultimately update the CMDB. What is a multi-probe? A probe that contains probes Which types of variables are used in Discovery? Global variables CI attribute variables Temporary variables What is the type/structure of the Global variable? Type is a Container variable: variable can hold any combination of single strings and tabular variables. What are the possible type/structures of a CI Attribute and a Temporary variable ? Scalar : a single string Tabular: a table where each cell is a scalar variable Vector: a single, unnamed column with as many rows as needed What are schedules used for? A Discovery schedule determines what horizontal Discovery searches for, when it runs, and which MID Servers are used