Data Integrity - Attributes and Sources
About 28% of the CIS-SAM exam — see all 5 domains.
Compliance is only as trustworthy as the data feeding it. This domain is about getting clean, normalized, de-duplicated data into SAM.
Software discovery and normalization
Raw software is collected from inventory sources and lands as discovered software in installation records. Normalization maps each raw record (raw publisher/product/version strings, often messy like "Msft Corp") to a curated, canonical software model via the software discovery model (the discovery map). Normalization standardizes publisher, product, version, and edition so that one real product no longer appears under many slightly different names.
Records the Content Service cannot match automatically are flagged for review (a normalization queue / "needs review" state) and can be manually normalized. Best practice is to subscribe to Content Service updates and publisher packs so the bulk of normalization happens automatically and ongoing.
The Content Service
The SAM Content Service (Content Library) is a ServiceNow cloud service delivering curated, regularly updated publishers, products, software models, discovery maps, and license metrics, plus publisher packs (deeper, publisher-specific content, e.g., Microsoft, Oracle, IBM, Adobe) and lifecycle (EOL/EOS) data. Subscribing means customers do not hand-build normalization content. Newly enabled content normalizes future and re-processed installs; it does not retroactively change already-completed reconciliation results until reconciliation reruns — a common exam point.
Data sources
SAM consumes software inventory and usage from multiple sources:
- ServiceNow Discovery (agentless, MID Server–based) and Agent Client Collector.
- Microsoft SCCM / Configuration Manager via the Service Graph Connector for SCCM (and the SCCM Software Usage plugin for usage/metering data).
- Microsoft Intune via the Service Graph Connector for Intune (modern/mobile and remote endpoints).
- Other third-party inventory tools.
When the same device arrives from multiple sources (e.g., Discovery and SCCM), CMDB Identification and Reconciliation (IRE) uses identification rules to match and de-duplicate so you do not get duplicate CIs or double-counted installs. Data source precedence decides which source "wins" for a given attribute.
Attributes that drive counting
- License metric on the model — without it, no count.
- Host/device CI link on each install — ties consumption to a machine; essential for per-core.
- CPU / core count and processor type on the host — essential for per-core, core-factor, and PVU.
- VM-to-host relationship — essential for sub-capacity and cluster-wide Oracle/IBM counts.
- User reference on the install — essential for named-user metrics.
- Edition and version — affect which model/metric applies and which use rights are available.
Exam traps (Domain 2)
- Unnormalized installs cause undercounting; the root cause of a low count is usually "installs not normalized," not "entitlement missing."
- Duplicate installs from two sources inflate counts; resolve via IRE/identification rules, not by deleting one source blindly.
- Missing core/CPU data on hosts silently corrupts per-core/PVU/Oracle positions.
- Missing user reference breaks named-user reconciliation.
- Enabling a publisher pack normalizes data but does not rewrite past reconciliation results automatically.
Sample questions from this domain
Three of the 84 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow application is most commonly used to discover installed software on Windows and Linux endpoints for SAM?
- A. Virtual Agent
- B. ServiceNow Discovery (ITOM) ✓
- C. Performance Analytics
- D. Knowledge Management
Why: ServiceNow Discovery (part of ITOM) scans endpoints and populates installed software data that SAM normalizes and reconciles. Performance Analytics is for KPI trending, Virtual Agent is a chatbot, and Knowledge Management handles articles; none discover installed software.
When integrating Microsoft SCCM (Configuration Manager) as a software inventory source, which ServiceNow capability is typically used to import the data?
- A. The Email Inbound Action
- B. The Knowledge Import wizard
- C. The SCCM/Configuration Manager integration (SAM data source import) ✓
- D. The Survey Designer
Why: SAM provides an SCCM integration that imports third-party software inventory into ServiceNow for normalization and reconciliation. Inbound email actions, knowledge import, and survey tooling are unrelated to importing software inventory from SCCM.
What is the role of the SAM Content Service when processing newly discovered, unrecognized software?
- A. It assigns the software to an incident queue
- B. It matches raw install data to curated publishers, products, and software models for normalization ✓
- C. It encrypts the install records
- D. It deletes the unrecognized software records
Why: The Content Service supplies curated normalization data, matching raw discovered titles to standardized publishers, products, and software models. It does not delete records, route them to incidents, or encrypt them; its job is normalization.