Free CIS-SIR Exam Dumps Preview

Question 1

Multiple choice

Which of the following are potential benefits for utilizing Security Incident assignment automation? (Choose two.)

1. A

   Decreased Time to Containment

2. B

   Increased Mean Time to Remediation

3. C

   Decreased Time to Ingestion

4. D

   Increased resolution process consistency

Reveal answer details Close answer details

Correct answersB, D

Question 2

Multiple choice

What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)

1. A

   Add the TLP: GREEN tag to the playbooks that you want to include in the Selected Playbook choice list

2. B

   Navigate to the sys_hub_flow.list table

3. C

   Search for the new playbook you have created using Flow Designer

4. D

   Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list

5. E

   Navigate to the sys_playbook_flow.list table

Reveal answer details Close answer details

Correct answersB, C, D

Explanation

References:
https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/concept/sir-new-ui-add-playbook.html

Question 3

Single choice

In order to see the Actions in Flow Designer for Security Incident, what plugin must be activated?

1. A

   Performance Analytics for Security Incident Response

2. B

   Security Spoke

3. C

   Security Operations Spoke

4. D

   Security Incident Spoke

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response-orchestration/concept/sir-flows-and-templates.html

Question 4

Multiple choice

Flow Triggers can be based on what? (Choose three.)

1. A

   Record changes

2. B

   Schedules

3. C

   Subflows

4. D

   Record inserts

5. E

   Record views

Reveal answer details Close answer details

Correct answersA, B, C

Question 5

Multiple choice

A Post Incident Review can contain which of the following? (Choose three.)

1. A

   Post incident QUESTION NO:naires

2. B

   An audit trail

3. C

   Attachments associated with the security incident

4. D

   Key incident fields

5. E

   Performance Analytics reports

Reveal answer details Close answer details

Correct answersA, B, D

Question 6

Single choice

What is the fastest way for security incident administrators to remove unwanted widgets from the Security Incident Catalog?

1. A

   Clicking the X on the top right corner

2. B

   Talking to the system administrator

3. C

   Can't be removed

4. D

   Through the Catalog Definition record

Reveal answer details Close answer details

Correct answerD

Question 7

Single choice

When a service desk agent uses the Create Security Incident UI action from a regular incident, what occurs?

1. A

   The incident is marked resolved with an automatic security resolution code

2. B

   A security incident is raised on their behalf but only a notification is displayed

3. C

   A security incident is raised on their behalf and displayed to the service desk agent

4. D

   The service desk agent is redirected to the Security Incident Catalog to complete the record producer

Reveal answer details Close answer details

Correct answerA

Question 8

Single choice

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

1. A

   Post Incident Activity

2. B

   Detection & Analysis

3. C

   Preparation and Identification

4. D

   Containment, Eradication, and Recovery

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://searchsecurity.techtarget.com/definition/incident-response

Question 9

Single choice

How do you select which process definition to use?

1. A

   By selecting the desired process within the Process Definition module

2. B

   By selecting the desired process within the Process Selection module

3. C

   By setting the process definition record to Active

4. D

   By setting the Script Include record to Active

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/reference/setup-assistant-reference.html