Initial Domain Setup and Architecture
About 11% of the CIS-SP exam — see all 6 domains.
This domain covers turning on and structuring domain separation.
Enabling domain separation
Domain separation is activated through the Domain Support – Domain Extensions Installer plugin (com.glide.domain.msp_extensions.installer) and related platform configuration; it is a significant architectural decision and is typically planned before customers are onboarded. Enabling it is not casually reversible, so the architecture is designed up front.
Domain hierarchy and the sys_domain table
Domains are records in the sys_domain table arranged as a tree. Each domain has a parent; global sits at the root. Children inherit data visibility and process artifacts from ancestors. A clean, shallow, well-named hierarchy (one branch per customer beneath a provider TOP domain) is the recommended pattern. The sys_domain_path is auto-maintained to reflect each domain's place in the tree.
System properties and the domain picker
Behavior is tuned via domain system properties (for example, the default domain scope and whether the domain picker is shown). Administrators with sufficient rights use the domain picker in the banner to switch their working domain when creating domain-specific data or overrides.
Recommended architecture practices
- Keep hierarchies as flat as practical; deep nesting complicates visibility and performance.
- Put shared, reusable configuration high (global/TOP) and override low (customer domains).
- Avoid hard-coded domain references in scripts.
- Plan domain naming and the provider-vs-customer boundary before onboarding.
Sample questions from this domain
Three of the 33 in this domain, with the reasoning. The full set is in the question bank.
Which plugin must be activated to enable Domain Separation on a ServiceNow instance?
- A. Contextual Security: Role Management
- B. Domain Support - Domain Extensions Installer ✓
- C. Configuration Management (CMDB)
- D. Service Portal Core
Why: Domain Separation is delivered through the Domain Support - Domain Extensions Installer plugin (com.glide.domain.msp_extensions.installer), which activates the underlying domain framework. Contextual Security: Role Management governs ACL roles, not domains. Service Portal Core and CMDB are unrelated to enabling domain separation.
Which two system tables form the foundation of the ServiceNow domain model?
- A. sys_user and sys_user_group
- B. sys_domain and sys_domain_path ✓
- C. sys_security_acl and sys_security_acl_role
- D. sys_scope and sys_app
Why: sys_domain stores the domain records and their hierarchy, while sys_domain_path stores the materialized path used for efficient domain visibility queries. sys_user/sys_user_group are identity tables, sys_scope/sys_app relate to scoped applications, and the sys_security_acl tables are for contextual security.
In the ServiceNow domain hierarchy, what is the name of the implicit top-level domain that contains all other domains?
- A. Root
- B. TOP
- C. global ✓
- D. Default
Why: The 'global' domain sits at the top of the domain hierarchy and contains all other domains; records owned by global are generally visible across the instance. 'TOP' and 'Root' are not the platform terms, and 'Default' is not the top-level domain name in ServiceNow.