Incident Management Flashcards

1
Q

What is the best way of checking the Incident state in a Server script?

a) Using constants i.e IncidentState.IN_PROGRESS
b) Using g_form.getValue
c) Using getDisplayValue
d) Using the value of the State field, e.g. hardcoding “2”

A

a) Using constants i.e IncidentState.IN_PROGRESS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which field on the Incident table calculates the duration from when an Incident is created until it’s resolved using 24h clock:

a) Duration [calendar_duration]
b) Business Duration [business_duration]
c) Business Resolved time [business_resolved_time]
d) Resolve time [calendar_stc]

A

a) Duration [calendar_duration]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Other than admin, which role can delete Incidents?

A

itil_admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What functionality in SN can you use to look at the trends of high priority Incidents and compare with other companies in your industry?

a) Reporting
b) PA
c) Benchmarks

A

c) Benchmarks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When a parent incident is resolved, what’s updated on the child incident? (5)

A

State = Resolved

Resolution code

Resolution notes

Work notes

Comments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which table is Incident Task extended from?

A

Task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When can someone without a role close an Incident?

a) When they are the caller and it’s currently Resolved
b) When they are the caller, or they are on the watch list and it’s Resolved
c) When its closed already

A

a) When they are the caller and it’s currently Resolved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which Incident States are considered “Active”?

a) New\In Progress\Closed
b) New\In Progress\On Hold\Closed
c) New\In Progress\On Hold\Resolved
d) New\In Progress\Resolved

A

c) New\In Progress\On Hold\Resolved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the ITIL definition of Incident (Management):

A

An unplanned interruption or a reduction in the Quality of an IT Service

Failure of a Configuration Item that has not yet impacted a Service is also an Incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are shown in the related search results when filling in the short description on an incident?

A

Related knowledge articles (attach) or Service Catalog items can appear (order)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the conditions for an incident to auto-close

A

Set in “autoclose time”:

A resolved incident will autoclose in 7 days (ootb)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which fields are used to calculate Priority?

A

Impact and Urgency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When adding knowledge to an incident, what is the best way of knowing that the knowledge is appropriate to the caller?

a) Do a “Search as*” search
b) Enable the system property to limit knowledge results to the caller
c) Do a global search

A

a) Do a Search as* search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the stages in the Incident lifecycle? (3)

A

Creation and Classification

  • create or locate
  • details
  • assign

Investigation and Diagnosis

  • assign/take ownership
  • investigate/diagnose
  • update activity
  • escalate
  • monitor progress of the incident resolution

Resolution and Closure

  • restore service
  • update activity
  • communicate resolution
  • closure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you assign incidents to group?

assignment group methods 5

A
Manual selection
Assignment rules
Data lookup rules
Script
Automatic population via Business Rule
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can you assign incidents to individuals? (assigned to methods, 3)

A

Manual selection
Assign to me
On-call scheduling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the options for On Hold reasons?

A

Awaiting Caller

Awaiting Change

Awaiting Problem

Awaiting Vendor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the states on an incident? (6)

A
New
In Progress
On Hold
Resolved
Closed
Cancelled
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the states on a incident task? (6)

A
Pending
Open
Work in Progress
Closed Complete
Closed Incomplete
Closed Cancelled
20
Q

When can you change/update script includes?

A

Only when it doesn’t contain SNC in the name - these are read only

21
Q

In what state does the incident need to be to be posted as a knowledge article, and where can you find the post option?

A

State = Resolved

By clicking “Create Knowledge” in related links or by right-clicking in the form header

(it requires KCS Integration for Incident Management plugin to be activated)

22
Q

What role can create and maintain surveys?

A

survey_admin

23
Q

Which plugin activates sn_incident_read and sn_incident_write

A

ITSM Roles plugin (com.snc.itsm.roles)

24
Q

What is the Activity Log Configuration?

A

A tool used to modify the content tracked in all incident activity streams

-> click on Filter Icon next to the activity field on incident form

25
Q

How do you add/modify the additional fields on the drop-down list?
(used on caller field in course)

A

Open “Configure Dictionary” on form attribute

Add ref_ac_column attribute from the dictionary entry and listing the columns to be visible

26
Q

Field Decorations are controlled by:

A

The ‘ref_contributions’ attribute

found in “Configure Dictionary” on form attribute

27
Q

To update priority values based on Impact and Urgency we use…

A

The Priority Data Lookups table

System Policy > Rules > Priority Lookup Rules

28
Q

What is a major incident?

A

Incident that results in

  • significant disruption to the business
  • demands a response beyond the routine incident management process, such as shorter timescales and accelerated urgency
29
Q

What plugin needs to be activated for Major Incident Management functionality?

A

A system admin must activate the Incident Management - Major Incident Management plugin

30
Q

Major Incident Management installs which additional roles: (3)

A

major_incident_manager

commuications_manager

incident_manager (additional responsibilities)

31
Q

Major Incident Management plugin also activates which related plugins: (3)

A

Incident Communications Management (com.snc.iam)

Incident Updates (com.snc.incident.updates)

Task-outage Relationship (com.snc.task_outage)

32
Q

What are the four pre-defined Major Incident Management trigger rules?

A

Critical Business Services Impacted
Number of Child Incidents
P1 Incident
High severity incident

stored on major_incident_trigger_rule

33
Q

What does Incident Deflection provide?

A

Knowledge articles, catalog items, open and resolved incidents/problems that will help users resolve issues before raising an incident

NOTE: End users only see knowledge articles and catalog items

34
Q

What are Inbound Email Actions?

A

Similar to business rules, it uses conditions and scripts that take action on a target table:

The inbound email action checks the email for a watermark that associates it with a task and checks for other conditions. If conditions are met, the system takes the inbound email action that you configure. The system can take two types of actions:-

  1. Record action - setting a value of a field in the target table
  2. Email reply - send an email back to the source that triggered the action
35
Q

What can Inbound email actions do?

A

Create/Update incidents

Update changes

Update problems

Update a request item

Approve/reject approvals

36
Q

Taking incident as an example, where would we impose limits/prerequisites to moving from one state to another?

A

Incorporate all new logic in the ‘IncidentState’ script include

37
Q

To define a system response to an inbound email we can use one of two methods…

A

Create an inbound email flow in Flow Designer

Script an inbound email action

38
Q

What are the Inbound Email Priorities?

A

Inbound email FLOWS take priority over inbound email ACTIONS

Flows with inbound email triggers are first processed by email triggers, then by inbound email actions.

39
Q

To Close Incident Tasks when an incident is closed or cancelled we must enable the property:

A

com.snc.incident.incident_task.closure

40
Q

What does the Incident Overview page provide?

A

An overview of the current state of the incident management process

41
Q

On an Incident form, Category and Subcategory fields include a drop-down list of potential field values to allow users to categorize Incidents. Which table stores the list of potential field values displayed in these two fields?

A

Choice [sys_choice]

42
Q

If you hover over the reference icon for a Caller, and a sys_popup view hasn’t been configured, which view is used?

A

Default

43
Q

What are the avenues for incident creation?

A
  • Employee self service portal
  • Service portal
  • Incident application
  • Support chat
  • Inbound email
  • Integrations
44
Q

When the state field is set to On Hold, a UI Policy does what?

A

Makes the On Hold Reason field visible

45
Q

How do you configure the ‘Search As’ contextual search for incident?

A

Contextual Search > Table Configuration

Search As - Enable Search As

46
Q

Which field on the Incident table calculates the duration from when an Incident is created until it’s resolved during SLA schedule:

a) Duration [calendar_duration]
b) Business Duration [business_duration]
c) Business Resolved time [business_resolved_time]
d) Resolve time [calendar_stc]

A

b) Business Duration [business_duration]