ServiceNow CIS CIS-SIR Questions & Answers

• Question 11:

  Which of the following are potential benefits for utilizing Security Incident assignment automation? (Choose two.)

  A. Decreased Time to Containment

  B. Increased Mean Time to Remediation

  C. Decreased Time to Ingestion

  D. Increased resolution process consistency

  Correct Answer: BD

• Question 12:

  Joe is on the SIR Team and needs to be able to configure Territories and Skills. What role does he need?

  A. Security Basic

  B. Manager

  C. Security Analyst

  D. Security Admin

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/quebec-security- management/page/product/security-incident- response/reference/installed-with-sir.html

• Question 13:

  The EmailUserReportedPhishing script include processes inbound emails and creates a record in which table?

  A. ar_sn_si_phishing_email

  B. sn_si_incident

  C. sn_si_phishing_email_header

  D. sn_si_phishing_email

  Correct Answer: A

• Question 14:

  What field is used to distinguish Security events from other IT events?

  A. Type

  B. Source

  C. Classification

  D. Description

  Correct Answer: C

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/concept/c_ScIncdUseAlrts.html

• Question 15:

  Which Table would be commonly used for Security Incident Response?

  A. sysapproval_approver

  B. sec_ops_incident

  C. cmdb_rel_ci

  D. sn_si_incident

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/quebec-security- management/page/product/security-incident- response/reference/installed-with-sir.html

• Question 16:

  What does a flow require?

  A. Security orchestration flows

  B. Runbooks

  C. CAB orders

  D. A trigger

  Correct Answer: D

• Question 17:

  Which of the following is an action provided by the Security Incident Response application?

  A. Create Outage state V1

  B. Create Record on Security Incident state V1

  C. Create Response Task set Incident state V1

  D. Look Up Record on Security Incident state V1

  Correct Answer: D

• Question 18:

  Which of the following fields is used to identify an Event that is to be used for Security purposes?

  A. IT

  B. Classification

  C. Security

  D. CI

  Correct Answer: B

  Reference: https://docs.servicenow.com/bundle/paris-it-operations- management/page/product/event- management/task/t_EMManageEvent.html

• Question 19:

  Correct Answer: A

• Question 20:

  When a service desk agent uses the Create Security Incident UI action from a regular incident, what occurs?

  A. The incident is marked resolved with an automatic security resolution code

  B. A security incident is raised on their behalf but only a notification is displayed

  C. A security incident is raised on their behalf and displayed to the service desk agent

  D. The service desk agent is redirected to the Security Incident Catalog to complete the record producer

  Correct Answer: A