ServiceNow Certified Implementation Specialist – IT Service Management (CIS-ITSM) practice questions

Exam overview CIS-ITSM

Domain coverage 6 domains

• Incident Management (25%)
• Change Management (25%)
• Request Fulfillment (25%)
• Problem Management (10%)
• Knowledge Management (10%)
• Configuration Management Database (CMDB) (5%)

Sample questions 13 of 127 shown

1. Q1 Incident Management

   In base ServiceNow ITSM configuration, what happens to a resolved incident if no one reopens it?

   1. It is deleted after 7 days
   2. It automatically moves to Closed after 7 days
   3. It remains Resolved until an agent closes it manually
   4. It converts to a problem after 7 days

   In the base configuration, a resolved incident automatically moves to Closed after 7 days. This keeps the lifecycle moving without requiring manual follow-up on every resolved record.
2. Q2 Incident Management

   A widespread outage requires networking, identity, and messaging teams to work in parallel while leadership wants one communication hub. What is the best record design?

   1. One major incident with child incidents for the specialist teams
   2. Three unrelated major incidents, one for each resolver group
   3. One problem record with no incident records
   4. One catalog request with fulfillment tasks

   A parent major incident provides a single place for stakeholder communication and status. Child incidents let specialist teams work independently while remaining coordinated under the same outage.
3. Q3 Incident Management

   In the out-of-box incident priority design, which fields should analysts set to drive priority?

   1. Impact and urgency
   2. Category and subcategory
   3. State and assignment group
   4. Caller and configuration item

   Out of the box, incident priority is derived from impact and urgency. This keeps prioritization consistent and avoids agents setting priority arbitrarily.
4. Q4 Incident Management

   The business wants one target for first response and a separate target for restoring service. What should be configured?

   1. A single resolution SLA only
   2. Separate response and resolution SLAs
   3. A problem task for every incident
   4. A CAB approval before assignment

   Response and resolution are different commitments and should be measured separately. Using distinct SLAs gives clearer reporting and avoids masking slow response with fast resolution.
5. Q5 Incident Management

   A service desk restores email by restarting a service, but the outage has happened several times this month and the root cause is unknown. What should happen next?

   1. Create a problem and relate the recurring incidents to it
   2. Close the incident and take no further action
   3. Open a catalog item for the email team
   4. Convert the incident directly into a standard change

   Incident Management restores service quickly, but repeated incidents indicate an underlying issue. A problem record gives the team a place to investigate root cause and track prevention work.
6. Q6 Incident Management

   Service has been restored, but the team wants a short period for user confirmation before final closure. Which incident state is the best fit?

   1. New
   2. On Hold
   3. Resolved
   4. Canceled

   Resolved indicates that restoration work is complete while still allowing a confirmation or reopen window. Closed is the final state and should come after that validation period.
7. Q7 Incident Management

   One incident requires the desktop team to replace a laptop and the security team to revoke tokens at the same time. What is the best design?

   1. Create two unrelated incidents
   2. Use incident tasks under the same incident
   3. Use a request and requested items instead of an incident
   4. Close the incident and open a problem

   Incident tasks are appropriate when multiple discrete activities must be tracked under one service restoration record. They keep the main incident as the user-facing record while allowing parallel work assignment.
8. Q8 Incident Management

   During a major incident, which record should normally act as the main status and stakeholder communication hub?

   1. The parent major incident
   2. The oldest child incident
   3. A related problem record
   4. A change request

   The parent major incident is the central coordination record. Child incidents and tasks support technical work, but the parent should remain the primary status and communication point.
9. Q9 Incident Management

   A regional network outage affects 12 branch offices, and each office needs its own field dispatch notes and local ownership. What is the most scalable approach?

   1. Create one incident with all branch notes mixed together
   2. Create a parent incident with a child incident for each branch
   3. Create one problem record only
   4. Create a separate catalog request for each branch

   A parent-and-child incident structure separates local work while preserving overall outage coordination. This pattern scales better than forcing all branch activity into one record with crowded updates and conflicting assignments.
10. Q10 Incident Management

    A customer wants to use the Service Catalog to generate task-based records for end-user inquiries. What Service Catalog capability can you use to generate these records?

    1. Catalog Items
    2. Record Producers
    3. Content Items
    4. Execution Plans

    Record Producers allow the creation of task-based records from the Service Catalog, making them ideal for end-user inquiries that need to generate incident, request, or other task records automatically.
11. Q11 Incident Management

    If the Assignment group is empty on an incident record, what happens when an agent that is a member of a single user group clicks the Assign to me UI action?

    1. The agent is prompted to select the Assignment group
    2. The Assignment group field is populated with agent's user group
    3. The Assignment group field remains empty
    4. An error is displayed indicating the Assignment group field must be populated

    When an agent who is a member of a single group clicks "Assign to me", the system populates both the Assigned to field with the agent and the Assignment group field with that agent's group automatically.
12. Q12 Incident Management

    Incidents are stored in what table?

    1. Incident [task_incident]
    2. Incident [incident]
    3. Incident [sn_incident]
    4. Incident [sn_task_incident]

    Incidents are stored in the incident table in ServiceNow, which extends from the task table.
13. Q13 Incident Management

    On an incident record, where are the fields that appear on the caller lookup select box defined?

    1. The ref_ac_columns attribute from the dictionary entry
    2. The Caller lookup field on the [user] table
    3. The ref_contributions attribute on the caller lookup form
    4. The form design of the caller lookup form

    The ref_ac_columns attribute in the dictionary entry for the caller field determines which columns appear in the auto-complete lookup select box on the incident form.

Answer all 127 questions with instant feedback →

Reader reviews 96 ratings

• Great ServiceNow exam preparation tool. The CIS-ITSM questions are current and the interface is clean and easy to use.

  ★★★★★★ Chris D.

• The CIS-ITSM practice exam was crucial to my success. The domains map perfectly to the official exam blueprint.

  ★★★★★★ Jennifer F.

• Three of my coworkers used this for CIS-ITSM and all passed. Figured I’d give it a shot — worked like a charm.

  ★★★★★★ Derek S.

• Solid ServiceNow prep material. The CIS-ITSM questions are well-written and the answer rationales are thorough.

  ★★★★★★ Madison T.

• The CIS-ITSM certification opened up a promotion for me at work. These practice questions were a big part of that success.

  ★★★★★★ Ryan J.

• I was really impressed by the depth of the CIS-ITSM answer explanations. Feels like having a tutor walk you through each question.

  ★★★★★★ Jack W.

Frequently asked questions

More ServiceNow exams