ServiceNow ITOM interview questions, with what a senior answer contains

Searching for ServiceNow interview questions returns quizzes and forum threads: what is a CI, what is a MID Server. Those are vocabulary checks, and a candidate who has read the documentation passes them. These ten are scenarios of the kind the ServiceNow ITOM practice at Duczer East puts to candidates, covering Discovery, Service Mapping, Event Management and the CMDB. Each has the answer a senior engineer gives and the point where a mid-level engineer stops.

How to use this screen

Pick five or six questions for a 45-minute technical interview, and ask the follow-up 'what would you check first?' on every one. Sequencing is the signal: senior engineers ask what populated the data before they touch it. If nobody on your panel has run ITOM, have someone who has run it sit in. Questions 1, 2, 3, 5, 9 and 10 rest on ServiceNow documentation current at 31 October 2026 and are cited; check the behaviour against your own release family before you mark a candidate down.

1. Discovery runs every night and the service maps are still stale. Why?

A senior answer starts from the fact that horizontal Discovery and Service Mapping are different jobs. Horizontal discovery finds and updates individual CIs across IP ranges. Service maps are kept current by the Service Mapping schedules, All Applications and Load Balancer Services, which are active by default and trigger top-down discovery across business services [1].

• Senior: checks whether those two schedules are active and completing, and notes that ServiceNow's guidance is that they need to run even when horizontal discovery already covers the IP ranges [1]. Asks which source populated the CIs in a stale map before re-running anything.
• Mid: re-runs Discovery, or blames credentials, without separating the two kinds of discovery.

2. The CMDB reports 94 percent complete and the executive dashboard is wrong. Where do you look?

A senior answer says completeness is not correctness. CMDB Health scores completeness, correctness and compliance separately, and reports relationship health on its own [2]. A CMDB can score high on field population and still have duplicate, stale or unrelated CIs underneath a service.

• Senior: asks which score the 94 percent refers to, goes to relationships and to identification and reconciliation rules before blaming Discovery, and tells the sponsor plainly that this is a data problem, not a reporting problem.
• Mid: treats 94 percent as good news and starts reconfiguring the dashboard.

3. Discovery finds a server, but the CI has almost no detail. What went wrong?

A senior answer walks the Discovery phases (scanning, classification, identification and exploration) and puts the failure at the phase where information stops. A device that is found but poorly described usually means exploration could not authenticate or reach it.

• Senior: reads the device history and probe results for that run, tests the credential against the target from the MID Server that ran it, and fixes the credential or the access rule. Refuses to widen credentials to administrator just to make it work. Knows that credential-less scanning, which Brazil extends to UDP ports and a best-guess operating system when enabled, produces a guess and should be treated as one [3].
• Mid: re-runs the schedule, or edits the CI by hand so the record looks complete.

4. A MID Server goes down overnight. What happens, and how would you have known?

A senior answer treats the MID Server as a dependency to design around. Probes for that MID queue until it returns or time out, so the CIs it covers stop being refreshed while the staleness clock keeps running; a CI counts as stale after 60 days without an update by default, and that is configurable per class [2].

• Senior: monitors MID status and alerts on it, puts a second MID or a cluster in front of each network segment so one outage does not stop discovery, and checks scope and credential expiry on recovery.
• Mid: restarts the service. Has not thought about alerting or what the outage did to freshness.

5. The same server appears as two CIs, one from Discovery and one from an import. Fix it.

A senior answer fixes duplicates where they are created, in the Identification and Reconciliation Engine (IRE). Identification rules decide which attributes make a CI unique; reconciliation rules decide which source wins for each attribute when two sources disagree.

• Senior: finds out which source created the second record and why the identifier rule did not match, then corrects the rule or the import payload. Confirms whether the instance runs Static or Dynamic IRE, because Dynamic IRE is the Brazil default on new instances while upgraded instances can still be on Static [4]. Proves the fix by replaying a known payload set.
• Mid: merges or deletes the duplicates with a script, and they return on the next import.

6. Walk me through mapping a business application that sits behind a load balancer.

A senior answer starts from an entry point agreed with the application owner, because Service Mapping works top-down: from an entry point such as a URL or load balancer, it follows the connections to the components that serve it.

• Senior: agrees the entry point first, checks the load balancer's members are discovered, validates the resulting map with the application owner, and knows tag-based mapping exists for dynamic cloud workloads and when it is the better fit.
• Mid: draws relationships by hand, or tries to map every server the application might touch.

7. How would you model a Payroll service in the CMDB?

A senior answer uses the Common Service Data Model (CSDM) as the shared vocabulary, because it separates what the business consumes from the technical services and CIs that deliver it.

• Senior: distinguishes the business service from the application or technical service and its instances, assigns an owner at each layer, and resists making everything a service. Understands that views built on these layers are only as good as the relationships beneath them, and that role and workspace behaviour changes across releases [4].
• Mid: creates one CI called Payroll and attaches servers to it.

8. Four thousand events arrive in ten minutes from one failed switch. What do you change?

A senior answer fixes the noise by topology rather than by thresholds. Event Management can only group alerts by what they affect if events are bound to the right CIs, so the quality of the CMDB is the quality of the correlation. The figure is a hypothetical, as in a real storm.

• Senior: checks event-to-CI binding first, uses alert correlation on topology so downstream alerts attach to the failed device, uses the service map to state business impact, and honours maintenance windows by CI.
• Mid: raises thresholds or mutes rules, which removes the symptom and the signal together.

9. After a patch, a custom Discovery script starts failing on relationship creation. What happened?

A senior answer recognises a deprecation: findOrCreateRelationshipType no longer creates a relationship type. It finds an existing one and returns an error if none exists, and the change shipped in Zurich and Australia patches as well as Brazil [3].

• Senior: updates scripts to findCIRelationshipType as ServiceNow advises, searches script includes, patterns and integrations for other callers, and tests that relationships are still being written afterwards, because the failure looks like a quiet data-quality drop rather than an outage [3].
• Mid: rolls the patch back, or treats the error as an isolated bug in one script.

10. The CI count drops sharply after a quiet weekend. Real decommissions?

A senior answer assumes a collection failure before a real change. A sudden fall is more often a MID outage, expired credentials or a schedule that did not complete than hundreds of servers being retired.

• Senior: checks MID health, credential validity and schedule completion before anything else, compares scope against the previous run, and acts before the staleness window closes (60 days by default [2]) so that any retirement or deletion policy does not act on records that are fine.
• Mid: accepts the number as real, or re-runs Discovery and moves on.

Red flags across the whole interview

• Cannot say which of Discovery, an import or an integration populated a CI.
• Fixes the report, dashboard or record rather than the source of the data.
• Answers every scenario with 'run Discovery again'.
• Has only ever been measured on a CMDB health score and cannot describe a time it was misleading.
• Softens a data-quality finding to keep a sponsor comfortable.
• Describes the platform entirely by feature names, with no version, no failure and no detail they were not asked for.

How to score it

Score each question 0 for a mid-level answer, 1 for partial and 2 for a senior answer. Our starting point: 16 or more out of 20 on ten questions is senior, 10 to 15 is a solid mid-level to early senior engineer, and below 10 is mid-level. Weight questions 2, 5 and 7 most heavily, because they test data quality, which is what ITOM work is judged on. Adjust the thresholds to the role.

Hiring an ITOM developer and would rather not run this screen yourself? Send us the role brief. The ServiceNow ITOM practice at Duczer East runs it before you see a CV.