CIS-EM Online Practice Questions and Answers

Within an event rule, how would you parse a nodename out of your raw event data?

A. JavaScript

B. Groovy script

C. PowerShell script

D. Regex statement

You have an event with a Source of `Trap from Enterprise 111', but the alert created for this event shows a Source of `Oracle EM'. If you want to change what this is set to, where in the event rule would you do this?

A. Transform and Compose Alert Output lab

B. Event rule info tab

C. CI Binding tab

D. Event Filter tab

Applying recommended Event Management best practice guidelines, which of the following alerts should be processed first?

A. Alert00l0042

B. Alert0010003

C. Alert00l0075

D. Alert00l0074

What makes all ServiceNow metrics, tasks, services, configuration items, assets, people, locations, and information a single system of record for IT and business processes?

A. ServiceNow is installed within your datacenter providing you complete control

B. All applications are built on the Oracle database standard, providing uniformity across products

C. All applications that are built by ServiceNow utilize the same data model and code base

D. ServiceNow runs on supported Windows servers and is managed through Windows Update

E. A single table houses all data elements within ServiceNow

F. ServiceNow utilizes the AWS MariaDB cloud database structure, providing a single system of record

For an incoming event with a matching message key, what allows an existing alert to be automatically closed?

A. In the event rule, set the Severity to 0

B. In the alert rule, set the Severity to 0

C. In the alert rule, set the Severity to-1

D. In the event rule, set the Severity to-1

A Service is not viewable in Operator Workspace. What could be the issue?

A. The service is a manual service

B. The service is not set to operational

C. The service was created through Service Mapping

D. The service is a technical service

Alerts are processed using which of the following? (Choose three.)

A. Alert management rules

B. Event action rules

C. Event rules

D. Scheduled jobs

E. Java and Groovy scripts

When sending data from the monitoring source to the additional_info field, what format is supported?

A. XML

B. JSON

C. YAML

D. Comma separated

A support agent resolves an incident associated with an alert, but the alert does automatically close even though the evt_mgmt.incident_closes_alert property is set appropriately to close the alert. What is the most likely cause of this issue?

A. The support agent does not have the evt_mgmt_user role.

B. The support agent only has the evt_mgmt_admin role.

C. The support agent has the evt_mgmt_operator role, but not the evt_mgmt_user role.

D. The support agent has the evt_mgmt_user role, but not the evt_mgmt_operator role.

What are the possible actions available in alert management? (Choose three.)

A. Execute remediation subflows

B. Execute remediation workflows

C. Launch applications

D. Evaluate business rule

E. Create a service catalog request