ServiceNow CIS-SIR Online Practice Questions and Exam Preparation

ServiceNow CIS-SIR Online Questions & Answers

• Question 11:

  What is the fastest way for security incident administrators to remove unwanted widgets from the Security Incident Catalog?

  A. Clicking the X on the top right corner
  B. Talking to the system administrator
  C. Can't be removed
  D. Through the Catalog Definition record
  D. Through the Catalog Definition record

• Question 12:

  A Post Incident Review can contain which of the following? (Choose three.)

  A. Post incident QUESTION NO:naires
  B. An audit trail
  C. Attachments associated with the security incident
  D. Key incident fields
  E. Performance Analytics reports
  A. Post incident QUESTION NO:naires
  B. An audit trail
  D. Key incident fields

• Question 13:

  If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?

  A. Build your own through the REST API Explorer
  B. Ask for assistance in the community page
  C. Download one from ServiceNow Share
  D. Look for one in the ServiceNow Store
  D. Look for one in the ServiceNow Store

• Question 14:

  What does a flow require?

  A. Security orchestration flows
  B. Runbooks
  C. CAB orders
  D. A trigger
  D. A trigger

• Question 15:

  Which of the following State Flows are provided for Security Incidents? (Choose three.)

  A. NIST Open
  B. SANS Open
  C. NIST Stateful
  D. SANS Stateful
  A. NIST Open
  C. NIST Stateful
  D. SANS Stateful

• Question 16:

  What plugin must be activated to see the New Security Analyst UI?

  A. Security Analyst UI Plugin
  B. Security Incident Response UI plugin
  C. Security Operations UI plugin
  D. Security Agent UI Plugin
  D. Security Agent UI Plugin

• Question 17:

  Chief factors when configuring auto-assignment of Security Incidents are.

  A. Agent group membership, Agent location and time zone
  B. Security incident priority, CI Location and agent time zone
  C. Agent skills, System Schedules and agent location
  D. Agent location, Agent skills and agent time zone
  D. Agent location, Agent skills and agent time zone

• Question 18:

  If the customer's email server currently has an account setup to report suspicious emails, then what happens next?

  A. an integration added to Exchange keeps the ServiceNow platform in sync
  B. the ServiceNow platform ensures that parsing and analysis takes place on their mail server
  C. the customer's systems are already handling suspicious emails
  D. the customer should set up a rule to forward these mails onto the ServiceNow platform
  D. the customer should set up a rule to forward these mails onto the ServiceNow platform

• Question 19:

  The benefits of improved Security Incident Response are expressed.

  A. as desirable outcomes with clear, measurable Key Performance Indicators
  B. differently depending upon 3 stages: Process Improvement, Process Design, and Post Go-Live
  C. as a series of states with consistent, clear metrics
  D. as a value on a scale of 1-10 based on specific outcomes
  C. as a series of states with consistent, clear metrics

• Question 20:

  Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?

  A. SANS Stateful
  B. NIST Stateful
  C. SANS Open
  D. NIST Open
  B. NIST Stateful