CIS-DF ServiceNow Certified Implementation Specialist - Data Foundations (CMDB and CSDM) Free Practice Exam Questions (2026 Updated)

In a healthcare environment, identifying who is impacted during a critical incident is essential to patient safety and continuity of care. Within the Common Service Data Model (CSDM), the most effective way to determine impacted users is through Service Offerings, particularly when they are defined by department or location.

Service Offerings represent how a service is consumed by specific user groups. In this case, a patient management system may have different offerings for departments such as Emergency, Inpatient Care, or Outpatient Services, or be scoped by hospital location. These offerings explicitly define consumer context, allowing incident responders to immediately identify which clinicians, staff, or facilities are affected.

Option D (Affected CI related list) identifies technical impact but does not translate that impact into user or consumer context. Option A provides historical insight but does not identify current impacted users. Option C (service environment) helps differentiate production vs non-production but does not identify who is impacted.

By leveraging Service Offerings by Department or Location, the provider can quickly notify the right users, prioritize response based on clinical impact, and coordinate mitigation effectively—aligning with CSDM and ITIL best practices.

Therefore, the correct answer is B – Service Offerings by Department or Location.

In ServiceNow, Vulnerability Response and Security Incident Response rely heavily on business context to accurately assess risk, prioritize remediation tasks, and communicate impact to stakeholders. From a CSDM (Common Service Data Model) perspective, this context is primarily delivered through properly modeled relationships between Application Services and Business Applications.

The “Application Services with Business Application Relationships” Get Well Playbook directly addresses this requirement. In CSDM, Application Services represent the technical, deployable services that run in the environment, while Business Applications represent the logical applications that support business capabilities. When these two are correctly related, security teams can clearly understand which business processes, customers, and revenue streams are affected by a vulnerability or security incident.

Without this relationship, vulnerabilities may still be detected, but they lack meaningful prioritization. For example, a critical vulnerability on an application service supporting a revenue-generating or customer-facing business application should be addressed far more urgently than one tied to a low-impact internal tool. This relationship is what enables risk-based prioritization, rather than purely technical severity-based prioritization.

The other options do not fulfill this need. Location hierarchy issues (Option A) and CI lifecycle status consistency (Option D) relate more to CMDB hygiene and governance, not security context. Product ownership gaps (Option C) affect accountability but do not directly enable risk estimation during security response.

Therefore, Option B is the correct and CSDM-aligned Get Well Playbook for ensuring sufficient business context in Vulnerability Response and Security Incident Response workflows.

The fastest and most supportable time-to-value option is the SCCM Service Graph Connector . Service Graph Connectors are purpose-built integrations for bringing third-party source data into the CMDB using ServiceNow-supported mappings, Identification and Reconciliation Engine processing, source tracking, and standardized class alignment. For SCCM specifically, the SCCM Service Graph Connector avoids the technical debt of building custom JDBC imports, transform maps, and scripts. Import sets and transform maps can work, but they require more implementation effort and create higher risk if IRE is not correctly invoked. IntegrationHub ETL with RTE is a stronger pattern than raw imports, but for SCCM the dedicated Service Graph Connector is still the fastest and most governed solution. SCCM Usage Metering Spoke is not the CMDB ingestion tool for Windows computer CI data. Therefore, D is correct.

In CMDB modeling, accurately defining relationships is critical for impact analysis, service mapping, and Change Management. In this scenario, Application Servers can host multiple Applications, and Applications can also run across multiple Application Servers (for example, in clustered, load-balanced, or distributed architectures).

This architectural reality defines a many-to-many relationship between the Application Server table and the Application table.

In ServiceNow, many-to-many relationships are common for application hosting models, especially in modern environments that use horizontal scaling, redundancy, or containerized workloads. Modeling this correctly ensures that incidents, changes, and outages affecting a single server can be accurately traced to all impacted applications—and vice versa.

A one-to-many or many-to-one relationship would incorrectly assume exclusivity in one direction, which does not reflect real-world application deployment patterns. A one-to-one relationship would be even more restrictive and inaccurate.

Therefore, the correct relationship type is A – Many-to-many, which aligns with CMDB best practices and CSDM service modeling principles.

Generated CMDB Data Manager policy tasks are reviewed and managed in CMDB Workspace > My Work tab . CMDB Data Manager creates policy-driven tasks for activities such as attestation, certification, archive, retire, and delete workflows. These tasks must be presented to the assigned users or groups in a place where they can take action. The My Work tab in CMDB Workspace is designed for this operational task management experience. The CMDB Health Dashboard provides scorecards and health visibility, but it is not the primary place to work Data Manager policy tasks. The Duplicate CIs tab is specific to duplicate remediation, and the Audit tab is not the correct workspace location for managing assigned Data Manager tasks. Therefore, C is correct.

=========

The CMDB Data Foundations Dashboard is designed to help administrators identify priority data issues and take structured remediation actions. When several metrics have low scores, the correct approach is not to randomly clean records or manipulate scoring rules. Instead, the administrator should prioritize the most important issues and use the recommended remediation guidance.

Option A is correct because Data Foundations emphasizes prioritizing metrics with Critical and High priority first. These metrics usually represent the most important issues affecting CMDB trust, operational readiness, service visibility, and downstream ITSM processes such as Incident, Change, and Problem Management. Focusing on the highest-priority metrics ensures remediation effort is aligned with business and operational risk.

Option C is also correct because the dashboard provides Remediation Playbooks linked to specific metrics. These playbooks give structured guidance for analyzing the issue, identifying impacted records, correcting the data, and improving governance so the problem does not return. This is the preferred Data Foundations approach because it supports repeatable, auditable, and best-practice remediation.

Option B is not recommended because changing exclusions simply to improve the score can hide poor data quality rather than fix it. Exclusion rules should only be used when records are legitimately out of scope. Option D may be valid in some lifecycle cleanup scenarios, but blindly removing non-operational or retired CIs is not the primary recommended action for improving dashboard health.

Business Criticality in the Service Offering is the correct CSDM attribute because the requirement is prioritization based on business impact. Customer-facing services that affect revenue should be modeled and prioritized according to their business importance, not only by technical ownership or affected infrastructure. In CSDM, Service Offerings represent consumable versions of services and can carry important business context such as audience, availability expectations, and criticality. Business Criticality helps Incident, Change, and operational teams understand which services require faster response because disruption would create greater business or customer impact. Assignment Group is used for routing work, not determining service priority. Service classification in a Technical Service describes the nature of a technical service, not customer-facing business impact. Affected CIs identify technical scope, but they do not directly express revenue or business criticality. Therefore, Business Criticality in the Service Offering is the correct prioritization attribute.

Business Application records represent logical applications from a portfolio, ownership, investment, risk, and lifecycle perspective. They are principally used by Application Portfolio Management and Enterprise Architecture to support application rationalization .

Rationalization enables an organization to evaluate applications based on factors such as business value, technical fitness, cost, risk, lifecycle status, capability alignment, and functional redundancy. Decision-makers can then determine whether an application should be invested in, tolerated, migrated, consolidated, replaced, or retired.

Application availability is normally monitored through operational Application Services and their supporting infrastructure rather than through the logical Business Application record. Change impact analysis also relies mainly on Application Services, service maps, and relationships to affected infrastructure CIs.

Because Business Applications belong to the Design and Planning context and provide strategic portfolio information, application rationalization is the appropriate business-decision use case

Bottom of Form

In the CSDM lifecycle model, the Life Cycle Stage represents the broad phase of a CI or asset, while the Life Cycle Stage Status supplies a more precise condition within that phase. When a hardware-backed server reaches End of Life, valid disposition-oriented statuses include Disposed and Donated . These values indicate how the organization concluded responsibility for the physical item after its operational use ended.

“Charity” is not a standard lifecycle status. A charitable transfer would be represented by the standardized status Donated , rather than by creating a separate nonstandard value. “Broken” describes a physical condition and is not the appropriate standardized End-of-Life disposition status in this question.

The Data Foundations material distinguishes Life Cycle Stage as the macro lifecycle phase and Life Cycle Stage Status as its more granular condition. It also identifies “Disposed” as a lifecycle-status value rather than a CMDB Data Manager policy type. ServiceNow likewise defines lifecycle state as the combination of an item’s stage and status.

=========

The correct answer is Certification because the team is validating a specific CI attribute or relationship: whether each server is correctly associated with its location. Data Certification is used when assigned users must review and validate specific field values on CI records, such as location, support group, lifecycle status, environment, or ownership. If incorrect, the certifier can update or correct the data. Attestation would be correct only if the question asked users to confirm that the CI still exists or is still valid in general. This question is more precise: the location association must be confirmed, which is an attribute-level validation requirement. Delete, Archive, and Retire are lifecycle policy types used to remove, archive, or transition records, not validate field accuracy. Therefore, Certification is the correct CMDB Data Manager policy type.

=========

In the CSDM Walk stage, an organization has moved beyond basic data hygiene (Crawl) and has established foundational service models, especially Business Services and their relationships to underlying technical components. One of the most important and immediate benefits of reaching this stage is the ability to perform reliable impact analysis across ITSM processes.

When Business Services are correctly defined and related to Application Services, applications, and infrastructure CIs, the CMDB becomes a decision-support system rather than just a data repository. This enables impact assessments for Incident, Problem, and Change Management, which is exactly what Option C describes. For example, when an incident is logged against a CI, ServiceNow can automatically determine which Business Services are impacted and who the affected stakeholders are. Similarly, during Change Management, planners can assess downstream risk by identifying which business-facing services could be disrupted.

Option A is more aligned with advanced operational governance and support model optimization, which typically appears later as organizations mature toward the Run stage. Option B relates to Application Portfolio Management (APM) acceleration, which benefits more from accurate application ownership and lifecycle data rather than core Walk-stage service modeling.

Therefore, the correct and CSDM-aligned benefit at the Walk stage is enabling impact assessments for incident, problem, and change on Business Services, making Option C the verified answer.

In ServiceNow, the Duplicate CI Remediator is designed to resolve duplicate records while preserving the most authoritative data from each source. Data Foundations guidance clearly states that automated discovery is the system of record for technical attributes, such as IP address, hostname, and operational status, while manually maintained records often contain valuable business context, such as relationships to business applications or services.

In this scenario, the discovered CI contains the most accurate and up-to-date technical data, making it the correct CI to retain as the primary record. However, the manually imported CI has a critical relationship to a business application, which is essential for impact analysis, incident prioritization, and CSDM alignment. Deleting this CI without preserving the relationship would result in loss of business context and reduced CMDB value.

The Duplicate CI Remediator supports selective merging, allowing administrators to retain one CI while merging specific attributes or relationships from the duplicate. Option C reflects this best practice by retaining the discovered CI and merging the relationship from the manually imported CI, ensuring both technical accuracy and business relevance are preserved.

Options A and D would result in the loss of important relationship data, while Option B would discard the discovered CI, violating the principle that discovery should be the authoritative source for technical attributes.

Therefore, Option C is the correct and Data Foundations–aligned answer.

Comprehensive and Detailed Explanation (200–300 words)

Within ServiceNow Data Foundations, CMDB Data Manager provides multiple policy types to support governance, data quality, and lifecycle management of configuration items (CIs). The scenario described—confirming that servers recorded in the CMDB physically exist in the data center—is a classic example of existence validation and ownership confirmation, which is exactly the purpose of an Attestation policy.

An Attestation policy is designed to request a human validation from a responsible individual or group (such as a data center manager, platform owner, or infrastructure team). The policy generates attestation tasks that require reviewers to explicitly confirm whether a CI is valid, accurate, and still exists. This aligns directly with CMDB governance best practices and ITIL 4 Service Configuration Management, where periodic verification ensures trust in the CMDB as a system of record.

The other policy types do not meet this requirement:

Certification is typically used to validate compliance with defined data standards (e.g., mandatory fields populated), not physical existence.

Delete, Archive, and Retire are lifecycle actions, used after a CI has already been identified as obsolete or no longer required.

None of these options involve human confirmation of real-world existence.

From a CSDM and Data Foundations perspective, attestation supports:

CMDB accuracy and credibility

Audit and regulatory compliance (especially critical in financial services)

Clear accountability for CI ownership and validation

Therefore, when the goal is to confirm that servers actually exist, the correct and fully aligned CMDB Data Manager policy type is Attestation (E).

In the Common Service Data Model (CSDM), the Incident form is designed to capture operational impact and enable effective incident routing, prioritization, and communication. To achieve this, CSDM prescribes using classes that represent how services are delivered and consumed, not how they are planned or governed.

Application Service (Option A) is an appropriate class on the Incident form because it represents the technical service that is running in production and is directly impacted during an incident. Application Services are service-mapped, relate to underlying infrastructure, and support impact analysis, root cause investigation, and automated assignment. This makes them ideal for associating incidents with technical outages or degradations.

Service Offering (Option C) is also appropriate because it represents how a service is consumed by users or business units. Service Offerings allow Incident Management to understand who is affected, enable targeted communications, and support SLA/OLA alignment. For example, an email service offering for a specific department clearly identifies the impacted consumer group.

Business Application (Option B) is not recommended on the Incident form. Business Applications are logical representations used for portfolio, ownership, and governance purposes, not day-to-day operational incident handling. Using them directly on incidents can reduce precision and automation.

Service Portfolio (Option D) is a strategic construct used for service lifecycle management and is never associated with operational incidents.

Therefore, according to CSDM best practices, the correct classes used on the Incident form are Application Service and Service Offering, making Options A and C the correct answers.

In a mature Configuration Management implementation within ServiceNow, CI operational attributes are leveraged to automate Change Management workflows and reduce manual effort.

When a CI is selected on a Change record, ServiceNow evaluates the CI’s Change Group attribute. If this field is populated on the CI, the platform automatically copies its value into the Change Group field on the Change form. This ensures that change ownership and governance are immediately aligned with the responsible technical team.

The Change Group is distinct from the Assignment Group, which is used primarily in Incident and Task routing. Managed by Group represents lifecycle ownership and is used by CMDB governance tools, while Approval Group controls approval workflows but is not auto-populated from CI selection.

This behavior demonstrates the value of accurate CI attributes: once populated consistently, they enable automatic field population, reduced manual errors, and faster processing across ITSM workflows.

Therefore, the correct answer is A – Change Group.

A Technology Management Service Offering associated with the applicable Dynamic CI Group synchronizes operational group information to its member CIs. The fields designed for this synchronization include Managed by Group and Support Group .

Therefore, Linux Server CIs included in the offering’s CI population receive Enterprise IT Services as their Managed by Group. The CI Class Manager value can provide class-level ownership or governance context, but the service-offering alignment actively maintains the operational group value on the related member CIs.

The conflicting values do not cause Discovery or ingestion to fail. ServiceNow applies the configured group-synchronization mechanism rather than leaving the field empty. Change Management Team is assigned to the Change Group field, not the Managed by Group field, so Option D does not answer the question.

Consequently, the Managed by Group assigned to the discovered Linux Server instances is Enterprise IT Services.

In ServiceNow Data Foundations, specifically within CMDB Data Manager, policies are used to enforce data quality, completeness, and governance across configuration items (CIs). When defining a Data Manager policy, administrators can configure task creation for non-compliant records and specify how those tasks are assigned. One key configuration is the Assignment type, where “User Group Field” allows assignment to a group dynamically based on a group reference field on the CI record.

Out of the box, ServiceNow provides two default and universally available group reference fields for this purpose:

Assignment Group

Managed By Group

These two fields are considered core CMDB governance fields and are consistently available across most CI classes. They align directly with ITIL 4 Service Configuration Management and CSDM accountability models, ensuring that remediation tasks are routed to teams responsible for operational ownership or technical management of the CI.

Assignment Group (Correct – D) This is the most commonly used operational field in ServiceNow. It represents the team responsible for working on tasks related to the CI and is fully supported by CMDB Data Manager for automated task assignment.

Managed By Group (Correct – C) This field represents the group accountable for managing the CI throughout its lifecycle. It is a standard CMDB field and is explicitly supported by Data Manager policies for governance-driven task routing.

The other options are not default Data Manager assignment fields:

Owned by Group is often added through extensions or governance customization and is not guaranteed to exist across all CI classes.

Support Group is a CSDM and ITSM operational concept, commonly derived or mapped, but it is not a default group reference field exposed for CMDB Data Manager task assignment.

From a Data Foundations and CSDM governance perspective, using Assignment Group and Managed By Group ensures consistent accountability, scalable automation, and alignment with CMDB best practices.

The correct answer is Pinned Classes . In CI Class Manager, pinning a class is used to keep frequently managed CI classes easily accessible. A CI Class Owner who regularly manages the Windows Server class does not need to search for it repeatedly through the full class hierarchy. By pinning the class, the owner can return to it quickly, improving administrative efficiency and reducing navigation overhead. “CI Favorites” is not the correct CI Class Manager feature in this context, and “Search CI Classes” can locate a class but does not streamline ongoing repeated management in the same way. Search is useful for one-time discovery, while pinned classes are specifically useful for recurring ownership and class administration tasks. Therefore, the feature that best supports this requirement is Pinned Classes.

=========

A Web Server is an application or software CI hosted on an underlying physical or virtual Server CI. The standard ServiceNow relationship is therefore Runs on::Runs .

From the Web Server’s direction, the relationship reads Web Server runs on Server . From the reverse direction, the Server runs Web Server . This bidirectional relationship allows users and platform processes to traverse the relationship correctly during incident investigation, service impact analysis, change planning, and service mapping.

“Uses::Used by” represents a broader dependency or consumption relationship and does not accurately express direct software hosting. “Runs::Runs on” reverses the standard relationship direction presented in the question.

Discovery can identify the running software and its host and create the relationship automatically as part of the ingestion process. Therefore, the correct relationship is Web Server > Runs on::Runs > Server.

=========