ServiceNow CIS CIS-SIR Questions & Answers

• Question 1:

  How do you select which process definition to use?

  A. By selecting the desired process within the Process Definition module

  B. By selecting the desired process within the Process Selection module

  C. By setting the process definition record to Active

  D. By setting the Script Include record to Active

  Correct Answer: B

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/reference/setup-assistant- reference.html

• Question 2:

  David is on the Network team and has been assigned a security incident response task. What role does he need to be able to view and work the task?

  A. Security Analyst

  B. Security Basic

  C. External

  D. Read

  Correct Answer: A

• Question 3:

  Which of the following State Flows are provided for Security Incidents? (Choose three.)

  A. NIST Open

  B. SANS Open

  C. NIST Stateful

  D. SANS Stateful

  Correct Answer: ACD

• Question 4:

  What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

  A. Post Incident Activity

  B. Detection and Analysis

  C. Preparation and Identification

  D. Containment, Eradication, and Recovery

  Correct Answer: D

  Reference: https://searchsecurity.techtarget.com/definition/incident-response

• Question 5:

  Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?

  A. SANS Stateful

  B. NIST Stateful

  C. SANS Open

  D. NIST Open

  Correct Answer: B

• Question 6:

  What is the key to a successful implementation?

  A. Sell customer the most expensive package

  B. Implementing everything that we offer

  C. Understanding the customer's goals and objectives

  D. Building custom integrations

  Correct Answer: C

• Question 7:

  The following term is used to describe any observable occurrence:.

  A. Incident

  B. Log

  C. Ticket

  D. Alert

  E. Event

  Correct Answer: E

• Question 8:

  What is the fastest way for security incident administrators to remove unwanted widgets from the Security Incident Catalog?

  A. Clicking the X on the top right corner

  B. Talking to the system administrator

  C. Can't be removed

  D. Through the Catalog Definition record

  Correct Answer: D

• Question 9:

  Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)

  A. Access to security incident data may need to be restricted

  B. Allow SIR Teams to control assignment of security roles

  C. Clear separation of duty

  D. Reduce the number of incidents assigned to the Platform Admin

  E. Preserve the security image in the company

  Correct Answer: BCD

• Question 10:

  What plugin must be activated to see the New Security Analyst UI?

  A. Security Analyst UI Plugin

  B. Security Incident Response UI plugin

  C. Security Operations UI plugin

  D. Security Agent UI Plugin

  Correct Answer: D