ServiceNow CIS CIS-SIR Questions & Answers

• Question 21:

  What is calculated as an arithmetic mean taking into consideration different values in the CI, Security Incident, and User records?

  A. Priority

  B. Business Impact

  C. Severity

  D. Risk Score

  Correct Answer: B

• Question 22:

  What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)

  A. Add the TLP: GREEN tag to the playbooks that you want to include in the Selected Playbook choice list

  B. Navigate to the sys_hub_flow.list table

  C. Search for the new playbook you have created using Flow Designer

  D. Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list

  E. Navigate to the sys_playbook_flow.list table

  Correct Answer: BCD

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/concept/sir-new-ui-add- playbook.html

• Question 23:

  A flow consists of. (Choose two.)

  A. Scripts

  B. Actions

  C. Processes

  D. Actors

  E. Triggers

  Correct Answer: BE

  Reference: https://docs.servicenow.com/bundle/paris-servicenow- platform/page/administer/flow-designer/ concept/flows.html

• Question 24:

  In order to see the Actions in Flow Designer for Security Incident, what plugin must be activated?

  A. Performance Analytics for Security Incident Response

  B. Security Spoke

  C. Security Operations Spoke

  D. Security Incident Spoke

  Correct Answer: C

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response-orchestration/concept/sir-flows-and- templates.html

• Question 25:

  Why should discussions focus with the end in mind?

  A. To understand desired outcomes

  B. To understand current posture

  C. To understand customer's process

  D. To understand required tools

  Correct Answer: A

• Question 26:

  B. An audit trail

  C. Attachments associated with the security incident

  D. Key incident fields

  E. Performance Analytics reports

  Correct Answer: ABD

• Question 27:

  Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

  A. Get Network Statistics

  B. Isolate Host

  C. Get Running Processes

  D. Publish Watchlist

  E. Block Action

  F. Sightings Search

  Correct Answer: C

  Reference: https://docs.servicenow.com/bundle/quebec-security- management/page/product/security- operations-common/concept/get-running-processes- capability.html

• Question 28:

  Select the one capability that restricts connections from one CI to other devices.

  A. Isolate Host

  B. Sightings Search

  C. Block Action

  D. Get Running Processes

  E. Get Network Statistics

  F. Publish Watchlist

  Correct Answer: A

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/task/perform-addtl-tasks-on-si.html

• Question 29:

  Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

  A. Work Instruction Playbook

  B. Flow

  C. Workflow

  D. Runbook

  E. Flow Designer

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/task/perform-addtl-tasks-on-si.html

• Question 30:

  What makes a playbook appear for a Security Incident if using Flow Designer?

  A. Actions defined to create tasks

  B. Trigger set to conditions that match the security incident

  C. Runbook property set to true

  D. Service Criticality set to High

  Correct Answer: B