ServiceNow CIS CIS-SIR Questions & Answers

• Question 31:

  A flow consists of one or more actions and a what?

  A. Change formatter

  B. Catalog Designer

  C. NIST Ready State

  D. Trigger

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/quebec-servicenow- platform/page/administer/flow-designer/ concept/flows.html

• Question 32:

  What is the purpose of Calculator Groups as opposed to Calculators?

  A. To provide metadata about the calculators

  B. To allow the agent to select which calculator they want to execute

  C. To set the condition for all calculators to run

  D. To ensure one at maximum will run per group

  Correct Answer: C

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/reference/setup-assistant- reference.html

• Question 33:

  Flow Triggers can be based on what? (Choose three.)

  A. Record changes

  B. Schedules

  C. Subflows

  D. Record inserts

  E. Record views

  Correct Answer: ABC

• Question 34:

  What role(s) are required to add new items to the Security Incident Catalog?

  A. requires the sn_si.admin role

  B. requires the sn_si.catalog role

  C. requires both sn_si.write and catalog_admin roles

  D. requires the admin role

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/orlando-it-service- management/page/product/service-catalog- management/task/t_DefineACatalogItem.html

• Question 35:

  What are two of the audiences identified that will need reports and insight into Security Incident Response reports? (Choose two.)

  A. Analysts

  B. Vulnerability Managers

  C. Chief Information Security Officer (CISO)

  D. Problem Managers

  Correct Answer: AB

  Reference: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc- type/resource- center/data-sheet/ds-security-operations.pdf

• Question 36:

  If the customer's email server currently has an account setup to report suspicious emails, then what happens next?

  A. an integration added to Exchange keeps the ServiceNow platform in sync

  B. the ServiceNow platform ensures that parsing and analysis takes place on their mail server

  C. the customer's systems are already handling suspicious emails

  D. the customer should set up a rule to forward these mails onto the ServiceNow platform

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/concept/urp-about.html

• Question 37:

  If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?

  A. Build your own through the REST API Explorer

  B. Ask for assistance in the community page

  C. Download one from ServiceNow Share

  D. Look for one in the ServiceNow Store

  Correct Answer: D

• Question 38:

  Security tag used when a piece of information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.

  A. TLP:GREEN

  B. TLP:AMBER

  C. TLP:RED

  D. TLP:WHITE

  Correct Answer: B

  

  Table

• Question 39:

  What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?

  A. User Reporting Phishing (for Forwarded emails)

  B. Scan email for threats

  C. User Reporting Phishing (for New emails)

  D. Create Phishing Email

  Correct Answer: A

• Question 40:

  This type of integration workflow helps retrieve a list of active network connections from a host or endpoint, so it can be used to enrich incidents during investigation.

  A. Security Incident Response ?Get Running Services

  B. Security Incident Response ?Get Network Statistics

  C. Security Operations Integration ?Sightings Search

  D. Security Operations Integration ?Block Request

  Correct Answer: B

  Reference: https://docs.servicenow.com/bundle/quebec-security- management/page/product/security-incident- response/concept/cj-sir-capfmw-about.html