CIS-Discovery Exam 2026: What You Actually Need to Know

Why CIS-Discovery Is Different

Most CIS exams test you on configuring a module. CIS-Discovery tests you on understanding a system of systems — Discovery doesn't just live in ServiceNow. It reaches out to your infrastructure, scans networks, classifies devices, and populates the CMDB.

If you've only configured ITSM modules, this exam will surprise you. It's as much about networking concepts and infrastructure as it is about ServiceNow.

The Exam Blueprint

The big takeaway: 70% of the exam is Pattern Design + Discovery Configuration. Master these two and you're most of the way there.

Domain 1: Pattern Design (~35%)

This is the most technical domain. It covers how Discovery identifies and classifies what it finds.

How Discovery Works (The Flow)

Schedule triggers → Discovery starts scanning

Port scan → Finds devices on the network

Classification → Determines device type (Windows server, Linux, network switch, etc.)

Exploration → Runs patterns/probes to collect details

CMDB update → Creates/updates CIs with discovered data

Patterns vs Probes/Sensors

Horizontal patterns are the modern approach (Xanadu):

• Written in ServiceNow Pattern Language (SNPL)
• Visual pattern designer
• Reusable steps
• Easier to maintain and debug

Probes and sensors are the legacy approach:

• Probes: SSH/WMI/SNMP commands sent to devices
• Sensors: Scripts that parse probe results
• Still used for custom discovery scenarios

Exam tip: Know BOTH. The exam tests the modern approach but also asks about legacy patterns/probes for troubleshooting.

Key Concepts

Classifiers determine WHAT a device is:

• Port-based classification (port 22 → likely Linux)
• Banner-based (connection response identifies device type)
• SNMP-based (sysObjectID identifies network devices)

Identification rules determine if a discovered CI already exists:

• Prevent duplicates in CMDB
• Match on serial number, IP, hostname, or combinations
• Rule order matters — first match wins

Discovery patterns collect DETAILS about a classified device:

• OS version, installed software, hardware specs
• Running processes, services
• Network interfaces, IP addresses
• Relationships (this server connects to that database)

What the Exam Tests

• When to create a custom pattern vs modify an existing one
• How to troubleshoot a pattern that's not collecting expected data
• The difference between horizontal and vertical discovery
• How classifier priority works
• What happens when identification rules conflict

Domain 2: Discovery Configuration (~35%)

MID Server

The MID (Management, Instrumentation, and Discovery) Server is the bridge between ServiceNow and your infrastructure.

Must-know facts:

• Runs on-premises (or in your cloud VPC)
• Java application connecting to your ServiceNow instance
• Communicates outbound on port 443 (HTTPS) — no inbound firewall rules needed
• Multiple MID Servers can be deployed for load balancing and network segmentation
• MID Server clusters share workload across a group

Common exam topics:

• MID Server placement (which network segment)
• MID Server validation and testing
• Troubleshooting MID Server connectivity
• When to use multiple MID Servers

Credentials

Discovery needs credentials to log into devices and collect information.

Credential types:

• SSH (Linux/Unix)
• Windows (WMI/PowerShell)
• SNMP (network devices)
• VMware (vCenter/ESXi)
• Cloud credentials (AWS, Azure, GCP)

Credential affinity:

• After successful authentication, Discovery remembers which credential worked for each IP
• Speeds up subsequent Discovery runs
• Can be manually overridden

Security considerations:

• Use least-privilege accounts
• Credentials stored encrypted in ServiceNow
• MID Server retrieves credentials per-scan (not stored on MID)

Discovery Schedules

• Quick Discovery: Scan a single IP or small range for testing
• Scheduled Discovery: Regular scans on a schedule (daily, weekly)
• CI-based Discovery: Rescan known CIs to update their data

Configuration:

• IP ranges to include/exclude
• Which MID Server to use
• Credential order
• Behavior settings (scan type, timeout, max devices)

Network Scanning

• Shazzam probes for port scanning
• Port-based device classification
• Ping sweep vs. targeted scanning
• How to handle devices behind firewalls
• SNMP community strings for network devices

Domain 3: CMDB Integration (~15%)

Discovery's output is CMDB data. You need to understand how discovered data becomes CI records.

Identification and Reconciliation Engine (IRE)

IRE is the gatekeeper between Discovery and the CMDB:

Identification rules — Match discovered device to existing CI

Reconciliation rules — When multiple sources report different data, which source wins?

Data refresh rules — How often can a CI be updated?

Key concept: Discovery isn't the only thing writing to the CMDB. Import sets, manual entry, and third-party tools also create CIs. IRE ensures consistency regardless of source.

CI Relationships

Discovery doesn't just find individual CIs — it maps relationships:

• Server → runs on → Virtual Host
• Application → uses → Database
• Load Balancer → connects to → Server pool
• Server → has network interface → IP Address

Relationship types and their directionality come up on the exam.

Reconciliation

When Discovery says a server has 16GB RAM but an import set says 32GB:

• Reconciliation rules determine which source wins
• Source priority is configurable
• "Most authoritative source" concept
• Manual overrides can be protected from Discovery updates

Domain 4: Engagement Readiness (~15%)

This domain tests whether you can plan and execute a Discovery implementation for a customer.

Prerequisites Checklist

Before running Discovery, a customer needs:

• [ ] MID Server deployed in each network segment
• [ ] Credentials for target device types
• [ ] Firewall rules allowing MID Server communication
• [ ] IP ranges documented
• [ ] CMDB class structure planned
• [ ] Identification rules configured

Planning Conversations

The exam asks about:

• What information to gather from a customer before starting
• How to scope a Discovery implementation
• Phased rollout approaches (start small, expand)
• Success criteria and validation

Common Implementation Challenges

• Firewall blocking MID Server probes
• Insufficient credentials (wrong permissions)
• Duplicate CIs from misconfigured identification rules
• Discovery timeout on large networks
• Credential affinity pointing to wrong credentials

Study Strategy

Week 1-2: Fundamentals

• Complete Discovery Fundamentals on Now Learning
• Understand the complete Discovery flow (scan → classify → explore → update CMDB)
• Get comfortable with MID Server concepts

Week 3: Pattern Design Deep Dive

• Study horizontal patterns and the pattern designer
• Understand probes, sensors, and classifiers
• Practice identifying pattern issues in scenarios

Week 4: Configuration & Integration

• Focus on schedules, credentials, and network scanning
• Study IRE and reconciliation rules
• Review CMDB relationship types

Week 5: Practice & Review

• Take practice tests
• Focus on scenario-based questions
• Review weak areas

Pro Tips for Exam Day

Read scenarios carefully — Discovery questions often have long setups with specific details that matter

Think about the flow — When troubleshooting, trace the Discovery flow: schedule → MID Server → scan → classify → explore → CMDB

Know your protocols — SSH (22), WMI (135/5985), SNMP (161), VMware (443)

MID Server is usually the answer — If something isn't working, it's often a MID Server configuration or connectivity issue

IRE before CMDB — Always think about identification rules before worrying about CMDB data

Common Mistakes

1. Treating It Like a CMDB Exam

CIS-Discovery is about the DISCOVERY PROCESS, not CMDB management. CMDB is 15% of the exam. Pattern design and configuration are 70%.

2. Ignoring Network Concepts

If you don't understand subnets, ports, SSH vs WMI, and basic networking, you'll struggle. This isn't pure ServiceNow configuration knowledge.

3. Skipping Engagement Readiness

15% is "soft" content about planning and implementation. Don't skip it — that's 9 questions.

4. Not Understanding Horizontal Patterns

The exam is shifting toward the modern pattern approach. Know the pattern designer, SNPL basics, and when to use patterns vs legacy probes.

The Bottom Line

CIS-Discovery is one of the more technical CIS exams. It rewards people who understand infrastructure, networking, and how systems talk to each other.

If you've deployed Discovery in a real environment, you have a massive advantage. If you haven't, spend extra time on the MID Server and networking sections — those are where pure ServiceNow admins struggle.

Practice CIS-Discovery Questions → Take a Timed CIS-Discovery Mock Exam →

---

Updated March 2026. Covers the Xanadu exam blueprint.