Discovery Engagement Readiness
About 15% of the CIS-Discovery exam — see all 4 domains.
Before Discovery can run successfully, the environment must be prepared. This domain is about the pre-implementation conversation with network, security, and platform teams.
Network zones and MID Server placement
- Map the network into zones/segments and place MID Servers so that each zone is reachable. Firewalls between segments often block probe traffic, so a MID Server may be needed inside each zone, with Discovery Behaviors routing work to the correct one.
- The MID Server makes only outbound HTTPS (443) connections to the instance: it never accepts inbound connections from the instance. Confirm this path is open.
Firewalls and ports
- Discovery's MID Server must reach targets on the protocol ports the device uses: SSH 22, SNMP 161/UDP, WMI/RPC (Windows dynamic RPC + WinRM 5985/5986), HTTPS 443, SQL ports, etc. The Shazzam phase needs these ports reachable to detect services.
- Work with the firewall team to allow the MID Server's source IP to reach the target ranges on the required ports; a device whose ports are all blocked shows as alive but not classified.
Least privilege and credentials governance
- Request service accounts with only the privileges Discovery needs. On Windows, that means a domain user with local administrator rights on the targets. Many SSH discovery commands run without a privileged user; reserve sudo for the specific Discovery commands (used by both probes and patterns) that require it.
- Use a credential vault integration where the customer mandates it, rather than storing secrets only on the instance.
- Set the credential Order so the most likely credential is tried first; credential affinity then reuses the one that worked, which keeps runs fast and avoids lockouts from credential cycling.
Cloud discovery readiness
- Cloud (agentless) discovery uses the cloud provider's API, reached via a MID Server with outbound internet to the provider endpoints, authenticated by a cloud service account / service principal.
- Cloud discovery finds logical datacenters (regions/accounts) first, then the resources inside them; you run discovery on a service account to enumerate its datacenters and then their resources.
- Ensure the service principal has read permissions across the subscriptions/accounts to be discovered.
What to drill for Domain 4: MID Server outbound-only 443 to instance; per-protocol ports for targets; placing MID Servers per network zone and using behaviors across firewalls; least-privilege service accounts (non-privileged vs. privileged SSH commands); credential vaults; and cloud discovery's service-account → logical datacenter → resources flow.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
During the planning phase of a Discovery engagement, why is it important to gather the customer's network architecture and firewall information?
- A. To set the credential Order so Discovery tries domain accounts before local accounts
- B. To define the identification rules the IRE uses to match discovered servers to existing CIs
- C. To choose which CMDB Health KPIs will track completeness for each in-scope CI class
- D. To plan MID Server placement and ensure required ports/protocols are open to the targets ✓
Why: Network architecture and firewall rules tell the team where MID Servers must sit to reach each target segment and which ports (for example 22, 135 plus the dynamic RPC range used by WMI, 445, 161, 5985/5986) must be opened. Credential Order depends on which accounts exist and which should be tried first, not on network layout. Identification rules are IRE configuration based on class identifiers such as serial number and name, unrelated to reachability. CMDB Health KPIs measure completeness of the data after it is discovered, so firewall details do not choose them.
Which prerequisite should be confirmed before a Discovery go-live to ensure targets can be authenticated?
- A. Credential affinity records have been created in advance for every target IP address
- B. Each credential record has an IP range field set to the subnets it should be tried against
- C. Shazzam port probes are disabled so the classifiers can authenticate to hosts sooner
- D. Service accounts/credentials with appropriate permissions exist for each target platform ✓
Why: Discovery can only authenticate if service accounts with the right permissions exist for each platform (a domain user with local admin on Windows, sudo for selected commands on Linux, SNMP for network gear) and are loaded as credentials. Credential affinity is created automatically after a credential succeeds, so it cannot be built in advance. Credential records have no IP range field; scope is set with Applies to (All or Specific MID servers). Shazzam scanning must run first because the port probe that answers triggers the classifier, so disabling it stops discovery rather than speeding authentication.
Which items belong on a Discovery engagement readiness checklist? (Choose two)
- A. Credential affinity cleared for every target before each schedule runs
- B. Firewall rules opened for required discovery ports/protocols ✓
- C. Production subnets scheduled first so the pilot covers the critical hosts
- D. One domain administrator account shared by every MID Server and platform
- E. MID Server host(s) provisioned and sized for the environment ✓
Why: Readiness checklists confirm that MID Server hosts are provisioned and sized for the device count and concurrency, and that firewall rules allow the MID to reach targets on the required ports. Credential affinity is maintained automatically and clearing it before every run only forces Discovery to retry every credential. Scanning production first reverses the recommended order of a non-production pilot before critical systems. A single shared domain administrator account violates least privilege and is not a readiness item.