Data Integrity - Attributes and Sources
About 28% of the CIS-SAM exam — see all 5 domains.
Compliance is only as trustworthy as the data feeding it. This domain is about getting clean, normalized, de-duplicated data into SAM.
Software discovery and normalization
Raw software is collected from inventory sources and lands as discovered software in installation records. Normalization turns each raw record (raw publisher/product/version strings, often messy like "Msft Corp") into a normalized software discovery model with a standard publisher, product, version, and edition, so that one real product no longer appears under many slightly different names. Reconciliation then matches normalized discovery models to software models using each model's criteria (publisher, product, version condition).
Discovery models that the normalization library cannot match get the normalization status Match Not Found (partial matches are Partially Normalized), and they can be manually normalized (status Manually Normalized). Best practice is to keep the normalization library current with Content Service updates so the bulk of normalization happens automatically and ongoing.
The Content Service
The SAM Content Service is an optional ServiceNow cloud service that keeps the normalization library (publishers, products, and normalization rules) and lifecycle (EOL/EOS) data current. Subscribing means customers do not hand-build normalization content. License metrics ship out of the box and with publisher packs, which are separate add-on plugins, not Content Service content. Newly applied content normalizes future and re-processed installs; it does not retroactively change already-completed reconciliation results until reconciliation reruns, a common exam point.
Data sources
SAM consumes software inventory and usage from multiple sources:
- ServiceNow Discovery (agentless, MID Server based) and Agent Client Collector.
- Microsoft SCCM / Configuration Manager via the Service Graph Connector for SCCM (and the SCCM Software Usage plugin for usage/metering data).
- Microsoft Intune via the Service Graph Connector for Intune (modern/mobile and remote endpoints).
- Other third-party inventory tools.
When the same device arrives from multiple sources (e.g., Discovery and SCCM), CMDB Identification and Reconciliation (IRE) uses identification rules to match and de-duplicate so you do not get duplicate CIs or double-counted installs. Data source precedence decides which source "wins" for a given attribute.
Attributes that drive counting
- License metric on the entitlement: decides how consumption is counted for the rights you own.
- Host/device CI link on each install: ties consumption to a machine; essential for per-core.
- CPU / core count and processor type on the host: essential for per-core, core-factor, and PVU.
- VM-to-host relationship: essential for sub-capacity and cluster-wide Oracle/IBM counts.
- User reference on the install: essential for named-user metrics.
- Edition and version: affect which software model and entitlement apply and which use rights are available.
Exam traps (Domain 2)
- Unnormalized installs cause undercounting; the root cause of a low count is usually "installs not normalized," not "entitlement missing."
- Duplicate installs from two sources inflate counts; resolve via IRE/identification rules, not by deleting one source blindly.
- Missing core/CPU data on hosts silently corrupts per-core/PVU/Oracle positions.
- Missing user reference breaks named-user reconciliation.
- A Content Service update normalizes data but does not rewrite past reconciliation results automatically; reconciliation must rerun.
Sample questions from this domain
Three of the 84 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow application is most commonly used to discover installed software on Windows and Linux endpoints for SAM?
- A. Event Management (ITOM)
- B. ServiceNow Discovery (ITOM) ✓
- C. Software Spend Detection (SAM)
- D. Content Service (SAM)
Why: ServiceNow Discovery (part of ITOM) scans Windows and Linux endpoints and creates the software installation records that SAM normalizes and reconciles. Event Management processes alerts and events from monitoring tools; it does not inventory installed software. Software Spend Detection imports financial transactions to reveal software spend, not installs. The Content Service keeps the normalization library current but collects no data from endpoints.
When integrating Microsoft SCCM (Configuration Manager) as a software inventory source, which ServiceNow capability is typically used to import the data?
- A. The Microsoft Intune Service Graph Connector (Microsoft Graph API import)
- B. Software Spend Detection (financial transaction data import)
- C. The SCCM/Configuration Manager integration (SAM data source import) ✓
- D. The SAM Content Service (normalization library content import)
Why: SAM provides an SCCM (Configuration Manager) integration that imports SCCM software inventory as a SAM data source so it can be normalized and reconciled. The Intune Service Graph Connector pulls devices and installed applications from Microsoft Intune, a different source, not from the Configuration Manager database. Software Spend Detection imports financial transactions to reveal software spend, not installation records. The Content Service updates the normalization library; it does not import inventory from any tool.
What is the role of the SAM Content Service when processing newly discovered, unrecognized software?
- A. It matches each discovered installation directly to a software model and an entitlement, and then records the compliance result for the product
- B. It supplies updated normalization content so raw discovered software can be normalized to standard publisher, product, and version values ✓
- C. It adds publisher-specific license metrics and reconciliation logic so the new installs can be counted against entitlements
- D. It creates a custom software model for each unrecognized title so reconciliation can begin counting those installs right away
Why: The optional Content Service updates the normalization library (pattern rules) so raw discovered titles can be normalized to standard publisher, product, and version values; normalized discovery models are then matched to software models by model criteria, and reconciliation produces compliance results, which are separate steps. Adding publisher-specific license metrics and reconciliation logic describes a publisher pack, not the Content Service. The Content Service also does not create custom software models; an administrator creates those when no content exists for a product.