Certified Implementation Specialist - Event Management (CIS-EM) Mainline Exam Blueprint


Updated Jan 2026

 

Introduction

The ServiceNow Certified Implementation Specialist – Event Management Exam Specification document defines the purpose, audience, testing options, exam content coverage, test framework, and prerequisites for earning the ServiceNow Certified Implementation Specialist – Event Management certification.

 

Exam Purpose

The Certified Implementation Specialist – Event Management exam confirms you have the knowledge and skills to configure, implement, and maintain the ServiceNow Event Management application. This certification validates their ability to manage event processing, configure alerts, integrate event sources, and use features like operator workspace and dependency maps. Certified individuals optimize IT operations by proactively addressing and resolving issues. 

 

Exam Audience

The ServiceNow Certified Implementation Specialist – Event Management exam is available to ServiceNow customers, partners, employees, and others interested in becoming a ServiceNow Certified Event Management Implementer or Administrator. Here is the recommended experience: 

 

Exam Preparation

Exam questions are based on official ServiceNow training materials, the ServiceNow Product documentation site, and the ServiceNow developer site. Study materials posted elsewhere online are not official and should not be used to prepare for the examination.

ServiceNow recommends completing these training course(s) in preparation for the Certified Implementation Specialist - Event Management exam. 

Additional Resources

In addition to the above, these additional resources are valuable in preparation for the exam. 

Exam Scope

This table shows the exam domains, weightings, sub-topics, and the percentage of questions represented in each domain. The listed sub-skills should NOT be considered an all-inclusive list of the exam content.  

 

Number of Domain

Exam Domain

Percent of Exam

1

Event Management Overview

  • IT Operations Management (ITOM) solution
  • Define customer challenges
  • Event Management key features and capabilities
  • Graphical user interfaces (operator workspace, alert intelligence, dependency maps)
  • Common Service Data Model (business, application, and technical services)

7%

2

Architecture and Discovery

  • Discovery and MID server architecture 
  • Event Management architecture and CMDB 
  • The monitoring process 
  • Validate a MID server 

10%

3

Event Configuration and Use

  • Event setup (event processing, event rules, event filter, event thresholds, operator workspace) 
  • Event Management process flow (event table, message key, event processing jobs, event field mapping, CI binding, best practices) 
  • Connectors (preconfigured, customized) 
  • Scripting (Regex, JavaScript, PowerShell)

27%

4

Alerts and Tasks

  • Alert defined (alert record attributes, scheduled jobs 
  • Alerts process flow (alert management rules, CI binding, priority scores, priority groups, incidents, best practices) 
  • Alert grouping (correlation rules, alert aggregation) 
  • Alert intelligence in Service Operations Workspace
  • Alert management rules  
  • Alert impact profile (impact tree, impact rules, cluster example, SLAs) 

30%

5

Event Sources

  • Identify event sources 
  • Push vs. pull methods 
  • Use inbound actions 
  • Configure a monitoring connector 
  • Use Agent Client Collector Monitoring

16%

6

Metric Intelligence

  • Review metric intelligence capabilities
  • Connect a metric source
  • Review the metric data pipeline
  • Identify anomaly bounds and thresholds
  • Use metric intelligence in Service Operations

10%

 

100%

Exam Registration

Step 1: Register for your exam 

Step 2: Schedule your exam 

Step 3: Choose your exam delivery method 

Step 4: Complete your exam  

Exam Structure

Exam Duration

The exam duration is 60 minutes.

Number of Items

The exam consists of 30 questions.

 

Multiple Choice (single answer)

For each multiple-choice question on the exam, there are at least three possible responses. Select the correct response.

Multiple Select (select all that apply)

There are at least four possible responses for each multiple-select question on the exam. The question will state how many responses should be selected. Select ALL correct responses. Partial credit is not provided. 

 

Exam Result

An exam result notification is immediately displayed as a *conditional pass or fail after completing and submitting the exam.  

In addition, an exam result report is available and shows your exam result and the percentage of items in each section you answered correctly. Your exam result is conditional, meaning your results are preliminary and may be updated upon final review.  

*A conditional result means the exam can be audited and reviewed at any time, and the certification may be revoked after investigation if it is found that the ServiceNow Test Security Policies have been violated.   

 

 Understanding Your Results: 

 
Each question on the exam is worth one point. Your total score is compared to a predetermined cut score - this score is not publicly shared and is not always 70%  - to determine a pass or fail outcome. The section percentages on the exam result notification show how you performed in each domain, but they do not determine your overall result, should not be averaged, and do not indicate expertise. 

  

If You Pass: 

  • You will earn the Certified Implementation Specialist - Event Management certification and receive a Credly digital badge to showcase your achievement. 
  • To maintain your certification, complete annual maintenance exams (deltas) and pay the yearly Certification Maintenance Program (CMP) fee. 

 

If You Do Not Pass: 

  • Review the exam blueprint and the recommended training before retaking the exam. 
  • The retake policy requires a waiting period between attempts and payment of the exam fee for each attempt. 

 

Sample Questions

Sample Item #1

Which customer challenges/questions does Event Management help resolve?  (choose three)

A. What devices are we using? 

B. Did we deprecate assets we do not own?  

C. What is the current state of our IT infrastructure? 

D. How do we know what servers and applications provide services? 

E. How can I automate and prioritize remediation tasks and notifications? 

F. How can we consolidate our monitoring tools into a single management system

Answer: C,E,F

 

Sample Item #2

What type of system can a MID server be installed on?  (choose two)

A. Microsoft Windows Server 

B. Linux System 

C. Microsoft Windows Desktop 

D. Any system inside the customer firewall 

E. OpenVMS System 

F. Mac OS X System

Answer: A, B

 

Sample Item #3

If more than one event rule applies to a particular event or metric, which of the event rules will run based upon the order of execution number? 

A. Only the event rule with the lowest order of execution number will run. 

B. Only the event rule with the highest order of execution number will run. 

C. All event rules will run, from the highest to the lowest order of execution numbers. 

D. All event rules will run, from the lowest to the highest order of execution numbers. 

Answer: D

 

Sample Item #4

In Event Management, what module allows for automatic task creation? 

A. Alert Management Rules 

B. Event Rules 

C. Task Rules 

D. Correlation Rules

Answer: A

 

Sample Item #5

What is the default collection/polling interval applied to all event connectors? 

A. Every 5 seconds 

B. Every 40 seconds 

C. Every 60 seconds 

D. Every 120 seconds 

E. Every 10 minutes

Answer: D