ServiceNow CIS ITSM Exam Prep

How can you resolve related Incidents on Hold from the problem record?

From the context menu on the problem form, click "Resolve incidents"

What application includes Performance Analytics in the baseline with no further licensing required?

Incident (available for other applications at license cost)

Describe the inheritance as it relates to Incident table

Incident inherits from task table. Incident_task inherits from incident table.

How can you reference the Incident state constant?

IncidentState.<state> Example: IncidentState.NEW IncidentState.ON_HOLD etc.

What tabs display on the problem form after it is saved for the first time?

Incidents (related list) Problem Tasks

What database views are available for reporting for Change?

change_request_metric change_request_sla change_task_metric change_task_sla change_task_time_worked

Describe what the Communicate Workaround UI action does.

Copies workaround to Active related incidents Passes most recent workaround entry that was logged Notifies caller on the active related incidents and the Watch List and Assignee

What happens if an ESS user reopens a parent incident

No child incidents are reopened

What is a standard change?

A low risk, commonly performed, pre-authorized change usually created from a template

Benchmarks/KPIs of Change

% of emergency changes % of failed changes Avg time to close a change

What are the benchmarks/KPIs for Problem management?

% of high priority problems % of incidents resolved by problems Avg time to close a problem

Benchmarks or KPIs for Incident

% of: high priority incidents resolved incidents resolved on first assignment Incidents resolved within SLA Reopened Incidents Avg time to: resolve high priority incident resolve incident

What are the priority levels on incident?

1 - Critical 2 - High 3 - Moderate 4 - Low 5 - Planning

What are the three impact/urgency levels on incident

1 - High 2 - Med 3 - Low

Incident: Activities during Investigate and Diagnose stage

1. Assignee takes ownership of incident 2. Diagnose symptoms 3. Investigate and research potential causes 4. Update activity (work notes, comments) 5. Escalate (as needed) 6. Monitor progress of incident towards resolution

What are the 4 options for On hold reason on the incident form

1. Awaiting caller 2. Awaiting problem 3. Awaiting change 4. Awaiting vendor

What are the activities that take place during the Investigate and Diagnose stage of the problem lifecycle

1. Conduct Root Cause Analysis (RCA) 2. Document and communicate workaround when found 3. Document known error 4. Work problem tasks (if configured) 5. Create knowledge (as needed)

What are the activities that take place during the Resolution and Closure stage of the problem lifecycle?

1. Confirm workaround & implement permanent fix 2. Resolve related incidents (as needed) 3. Close Problem record

Modules under the problem application (baseline)

1. Create New 2. Assigned to me 3. Known Errors 4. Open 5. Pending 6. All 7. Overview

Incident: baseline modules

1. Create New 2. Assigned to me 3. Open 4. Open - unassigned 5. Resolved 6. All 7. Overview 8. Critical Incident map

Incident Lifecycle

1. Create and classify 2. Investigate and diagnose 3. Resolve and close

What needs to be configured in order to satisfy the requirements of the Investigation and Diagnosis stage of the problem lifecycle?

1. Create and manage problem tasks and workflows 2. Communicate workaround UI Action 3. Post Knowledge UI Action 4. Post News UI Action

What are the stages of the Change Management Lifecycle

1. Creation and Scoping 2. Assessment and Approval 3. Implementation 4. Closure (change types determine details of each stage)

What activities take place during the detection and logging stage of the problem lifecycle?

1. Detect problem 2. Create a new record and document details 3. Prioritize and categorize the problem 4. Assign investigation to individual or group

What are the 3 stages of the Problem lifecycle?

1. Detection and Logging 2. Investigate and Diagnose 3. Resolution and Closure

What is the value of change management?

1. Ensures changes are made in a planned controlled manner 2. Reduces emergency changes 3. Reduces incidents caused by change 4. Reduces time to complete standard/repeatable changes

What are the scoping discussions related to problem integration?

1. Fields to pass from Incident to Problem 2. Fields to pass from Problem to Incident

Ways problem management can reduce incident

1. Identifying root case and providing long term resolution, reducing recurrences 2. Getting the correct team involved minimizes impact and time to resolution

Incident: What are the states of an incident during the Investigate and Diagnose stage?

1. In progress 2. On hold

What needs to be configured in order to satisfy the requirements of the Detection and Logging stage of the problem lifecycle?

1. Integrations with other applications (particularly incident) 2. Categorizations 3. Prioritizations

How can you create knowledge from a problem record?

1. Knowledge checkbox-creates a draft article 2. Communicate Workaround related link 3. Post Knowledge - creates a draft article 4. Post News - creates a draft article with topic of News

Incident: Activities during Create and classify stage

1. Log incident 2. Define and classify incident details 3. Specify CI that is impacted 4. Assign the incident

Name the ways that changes can be created.

1. Manually through Change > Create New > Interceptor (to select the type) 2. From the incident form (Create ||type|| change UI Action) 3. From the Problem form (Create ||type|| change UI Action) 4. CMDB (from list view) "create new change" UI action 5. Service Catalog via Record Producer, Standard change catalog, etc 6. Through routine maintenance processes (release management, project management, event management.

Name 2 integration points for Incidents

1. Platform Web Services (REST/SOAP) 2. Event Management

What is the value of Problem Management?

1. Prevent problems from happening 2. Eliminate recurring incidents 3. Minimize impact of incidents that cannot be prevented (via workarounds)

What are the scoping discussions related to problem content?

1. Prioritization approach 2. Problem/Known error guidance

What are the two methods to detect a problem?

1. Proactive - analyzing reports, overview modules, event notifications to determine trends 2. Reactive - One or more incident prompts investigation into underlying cause. continues until long term resolution is found.

List the ways you can relate an incident to a problem record?

1. Problem can be created from the incident form, the incident will be automatically related 2. Use the New button the Problem form>Incidents tab (creates a new incident and automatically relates it to the problem) 3. Use the Edit button on the Problem form>Incidents tab to select an existing incident record

What are the scoping discussions related to the problem management process?

1. Problem tasks and workflow 2. SLAs

Functional Roles in Incident

1. Process Owner 2. Service Desk Analyst 3. Technical Support

What needs to be configured to satisfy the requirements of the Resolution and Closure stage of the problem lifecycle?

1. Resolve Incidents UI action

What are the states of an Incident during the Resolve and Close stage?

1. Resolved 2. Closed 3. Cancelled

What are the baseline incident SLAs?

1. Response SLA 2. Resolution SLA

Incident: activities during Resolve and Close stage

1. Restore service 2. Update activity (work notes and comments) 3. Communicate Resolution 4. Mark Incident resolved (resolution code, resolution note) 5. Manual or automatic incident closure

Value of Incident Management

1. Restore service faster 2. Minimize service interruptions 3. More efficient identification, prioritization and resolution of incidents 4. Escalation to correct groups leads to faster resolution

List the method to communicate a workaround from the problem record.

1. Save at least one workaround entry 2. Click the Communicate Workaround related link

Name some best practices for configuring incident forms

1. Set a VIP flag 2. Populate pop up for caller concisely 3. Limit dot-walked fields 4. configure activity log 5. add reference qualifiers to assignment group and Assignee fields (as needed)

Incident: What are the configuration steps to complete to satisfy the Investigate and Diagnose stage of the life cycle?

1. State model (best practice is to keep baseline) 2. Priority and assignment methods 3. Knowledge search 4. Activity log 5. Parent-Child relationships and interactions 6. Notifications 7. SLAs 8. Integrations 9. Assignment Groups

What needs to be considered prior to implementing change?

1. States and transitions 2. Templates that are needed 3. Catalog items 4. Reporting needed

Incident: What are the configuration steps to complete to satisfy the Resolve and Close stage of the life cycle?

1. Surveys 2. Time to close (if automatic - Baseline is 7 days in London release)

6 ways to create an incident

1. Through the Service Portal/Employee Self Service 2. Through Record Producers in Service Catalog 3. Incident Application (Incident > Create New) 4. Support Chat 5. Inbound email 6. Integrations (ex. Event management)

What are some best practices related to Incident Groups?

1. Use reference qualifiers to restrict the groups available by category 2. Leverage CI groups 3. Use Group Types 4. Disable Assign to me option since it does not validate that the current user is a member of a group.

What are the steps to configure change?

1. Validate change types 2. Validate state model 3. Configure forms 4. Configure conflict detection 5. Configure Risk Assessment

List some scoping discussions for Incident in general

1. What type of overview/reports are needed? 2. What do you want to see on Performance Analytics dashboards 3. Which benchmarks/KPIs are tracked/useful 4. What security is needed

What are the scoping discussions related to problem and security?

1. Who are the owners/managers? 2. Who has access to view? 3. Who has access to contribute?

Name some hidden fields on Incident that are helpful for reporting

1. business duration 2. child incidents 3. reassignment count 4. time worked (but user must be logging this) 5. calendar duration 6. correlation id 7. reopen count

Incident: What are the configuration steps to complete to satisfy the Create and Classify stage of the life cycle?

1. form layout 2. Classification structure 3. CI Usage/relationships 4. Inbound actions 5. Prioritization (Impact + Urgency) 6. Record Producers 7. Incident deflection (service portal)

Incident database views

1. incident_metric 2. incident_sla 3. incident_time_worked 4. task_survey_detail

Name the tables that are referenced from the incident form

1. sys_user 2. sys_user_group 3. cmdb_ci 4. cmdb_ci_service (business service) 5. core_company 6. cmn_location

What is an Emergency change?

A high-impact change that needs to be implemented ASAP to avoid causing loss to the business

What is the Known Error module?

A list of problems designated as Known Errors (Problem state of Known error). They can be active/closed. They should contain problem and workaround details and can be used in problem and incident management processes

What is a normal change?

A non-trivial change that goes through the entire change process

What is a workaround in problem management?

A temporary solution that reduces or eliminates the impact of a problem. It is used when a permanent resolution isn't available yet.

What happens if an ITIL user reopens a parent incident?

All active child incidents are reopened

What is a Root Cause Analysis

Answers the questions: 1. What happened? 2. Why did it happen? 3. How do we prevent it from happening again? 4. Is there a workaround to be employed while we wait for permanent fix?

Describe changes on hold

Any change can be placed on hold as long as it is not in closed or canceled state (by clicking checkbox) On Hold changes must have a reason field completed (ui policy only displays when on-hold is true When checked, the on-hold field on change tasks is set to true as well.

Functional Roles for Change Management

Change Manager Technical Support Manager/Reviewer Change Advisory Board (CAB) Implementer/Fulfiller

Describe the data structure for Change

Change table is extended from Task Change task table is extended from Change

Describe what the Resolve Incidents UI action does.

Executes on related incidents in the state of On Hold with a reason of Awaiting problem Sets incident state to resolved Copies problem resolution code and notes to incident

What fields from incident are copied to a problem record when created from the incident form?

Impact Urgency Priority Configuration Item Short Description

Describe the incident SLA stages and color coding:

In progress (yellow) Condition Met (green) Condition not met (Red) - SLA may be in progress, paused, cancelled or completed state. * See this on the Task SLA tab on the incident form.

Who gets notification of the latest workaround when you click the Communicate Workaround related link?

Individuals in the watch list and assigned to fields of the problem record Callers on all of the active related incident records

What are the stages of a change (displayed in the process flow formatter)?

New > Assess > Authorize > Schedule > Implement > Review > Closed > Canceled

What displays on the Resolution Information tab of the incident form?

Knowledge checkbox Resolution Code Resolution Notes Resolved by Resolved (date)

Incident: What is the state of an incident during the Create and Classify stage

New

Incident States and Values

New (1) In progress (2) On Hold (3) Resolved (6) Closed (7) Cancelled (8)

What are the baseline change types?

Normal Standard Emergency

What fields are pre-populated on the incident form? (with defaults)

Number Category (defaults to Inquiry/help) State (defaults to New) Impact ( defaults to 3 - Low) Urgency (defaults to 3 - low) Priority (defaults to 5 - planning)

When a parent incident is moved to these states, there is no change to the state of the child incident.

On Hold (awaiting caller) Closed/Cancelled *changes to all other states on the parent cascade to the child incident

What state is a problem in during the Detection and Logging stage of the lifecycle?

Open

What states could a problem be in during the Investigate and Diagnose stage of the lifecycle?

Open (*while performing RCA) Known Error (*if a workaround is available and/or flagged as known error)

What is the state and values for Problem?

Open (1) Known Error (2) Pending Change (3) Closed/Resolved (4) *no constants are available

What displays on the related records tab of the incident form?

Parent Incident Problem Change Request Caused by Change

What states could a problem be in during the Resolution and Closure stage of the lifecycle?

Pending Change Closed/Resolved

Functional Roles of Problem management

Problem Manager Tech Support Vendor

What is the basic data structure for Problem

Problem table extends from task Problem task table extends from problem

When you use the Resolve Incidents UI action on the problem form, what does it do?

Resolves all related incidents that are in a state of On Hold with a reason of Awaiting problem

What starts and stops the incident response SLA?

Starts: Incident is in a state of New Stops: Incident is in state of In Progress and has an assignee

What starts, stops, or pauses the incident resolution SLA?

Starts: Incident is in a state of new Pauses: Incident is moved to state of On hold or Resolved Stops: Incident moves to state of closed or cancelled

Where do you configure the Priority Matrix for Incident?

System Policy > Rules > Priority Lookup Rules

What tabs display after the incident form is saved for the first time?

Task SLAs Affected CIs Impacted Services/CI's Child incidents

What determines the workflow on a change?

The change type (Normal, Standard, Emergency)

What happens if an ITIL or ESS user adds a child to a parent incident

The child incident is set to a state of In progress

What displays on the Notes tab of the incident form?

Watch List Work Notes List Work notes Activity stream

What happens to active child incidents when a parent incident is resolved, or when a work note is added to a parent incident?

When the Parent incident is resolved, the resolution code and resolution notes are copied to the child incident (and the state is marked on the child as resolved) Work notes on the parent are copied to the child

When would you leave a problem in the known error database? and how do you do that?

When the organization cannot or chooses not to implement a permanent fix. Document problem details and workaround clearly, and leave in KE database by using the KE checkbox (even if the problem state is closed)

What database views are related to problem?

problem_metric problem_sla

Metrics and reports related to problem

problem_state_duration problem_create_to_resolve_duration KPI_avg_problem_resolution_time

What tables are referenced on the Change form?

sys_user sys_user_group core_company cmn_location cmdb_ci cmdb_ci_service

What tables are referenced from the Problem form?

sys_user sys_user_group core_company cmn_location cmdb_ci cmdb_ci_services