Discovery Engagement Readiness
About 15% of the CIS-Discovery exam — see all 4 domains.
Before Discovery can run successfully, the environment must be prepared. This domain is about the pre-implementation conversation with network, security, and platform teams.
Network zones and MID Server placement
- Map the network into zones/segments and place MID Servers so that each zone is reachable. Firewalls between segments often block probe traffic, so a MID Server may be needed inside each zone, with Discovery Behaviors routing work to the correct one.
- The MID Server makes only outbound HTTPS (443) connections to the instance — it never accepts inbound connections from the instance. Confirm this path is open.
Firewalls and ports
- Discovery's MID Server must reach targets on the protocol ports the device uses: SSH 22, SNMP 161/UDP, WMI/RPC (Windows dynamic RPC + WinRM 5985/5986), HTTPS 443, SQL ports, etc. The Shazzam phase needs these ports reachable to detect services.
- Work with the firewall team to whitelist the MID Server's source IP to the target ranges on the required ports; closed ports look like "device not found."
Least privilege and credentials governance
- Request service accounts with only the privileges Discovery needs. Many SSH discovery commands run without a privileged user; reserve sudo/root for the specific commands that require it.
- Use a credential vault integration where the customer mandates it, rather than storing secrets only on the instance.
- Plan credential affinity so runs converge quickly and avoid account lockouts from credential cycling.
Cloud discovery readiness
- Cloud (agentless) discovery uses the cloud provider's API, reached via a MID Server with outbound internet to the provider endpoints, authenticated by a cloud service account / service principal.
- Cloud discovery finds logical datacenters (regions/accounts) first, then the resources inside them; you run discovery on a service account to enumerate its datacenters and then their resources.
- Ensure the service principal has read permissions across the subscriptions/accounts to be discovered.
What to drill for Domain 4: MID Server outbound-only 443 to instance; per-protocol ports for targets; placing MID Servers per network zone and using behaviors across firewalls; least-privilege service accounts (non-privileged vs. privileged SSH commands); credential vaults; and cloud discovery's service-account → logical datacenter → resources flow.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
During the planning phase of a Discovery engagement, why is it important to gather the customer's network architecture and firewall information?
- A. To select the CMDB report color theme
- B. To choose the user's browser
- C. To decide the instance language
- D. To plan MID Server placement and ensure required ports/protocols are open to the targets ✓
Why: Understanding network architecture and firewall rules is essential to place MID Servers where they can reach targets and to confirm required ports/protocols are permitted. Report theme, instance language, and browser choice are irrelevant to discovery reachability.
Which prerequisite should be confirmed before a Discovery go-live to ensure targets can be authenticated?
- A. The ECC queue is disabled
- B. The CMDB has zero CIs
- C. All MID Servers are uninstalled
- D. Service accounts/credentials with appropriate permissions exist for each target platform ✓
Why: Before go-live, you must confirm that service accounts/credentials with the right permissions exist for each platform (Windows, Linux, network, etc.). An empty CMDB, uninstalled MID Servers, or a disabled ECC queue would prevent discovery, not enable it.
Which items belong on a Discovery engagement readiness checklist? (Choose two)
- A. Disabling the IRE before go-live
- B. Firewall rules opened for required discovery ports/protocols ✓
- C. Deleting the CMDB classes
- D. A list of every end user's favorite color
- E. MID Server host(s) provisioned and sized for the environment ✓
Why: Provisioning/sizing MID Servers and opening firewall rules for required ports are core readiness items. User color preferences are irrelevant, and disabling the IRE or deleting CMDB classes would break discovery.