ServiceNow CIS CIS-SIR Questions & Answers

• Question 41:

  The severity field of the security incident is influenced by what?

  A. The cost of the response to the security breach

  B. The impact, urgency and priority of the incident

  C. The time taken to resolve the security incident

  D. The business value of the affected asset

  Correct Answer: D

• Question 42:

  Which of the following process definitions are not provided baseline?

  A. NIST Open

  B. SAN Stateful

  C. NIST Stateful

  D. SANS Open

  Correct Answer: A

• Question 43:

  Using the KB articles for Playbooks tasks also gives you which of these advantages?

  A. Automated activities to run scans and enrich Security Incidents with real time data

  B. Automated activities to resolve security Incidents through patching

  C. Improved visibility to threats and vulnerabilities

  D. Enhanced ability to create and present concise, descriptive tasks

  Correct Answer: C

• Question 44:

  When the Security Phishing Email record is created what types of observables are stored in the record? (Choose three.)

  A. URLs, domains, or IP addresses appearing in the body

  B. Who reported the phishing attempt

  C. State of the phishing email

  D. IP addresses from the header

  E. Hashes and/or file names found in the EML attachment

  F. Type of Ingestion Rule used to identify this email as a phishing attempt

  Correct Answer: ADE

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/concept/sighting-searches-on- phishing-attacks.html

• Question 45:

  The benefits of improved Security Incident Response are expressed.

  A. as desirable outcomes with clear, measurable Key Performance Indicators

  B. differently depending upon 3 stages: Process Improvement, Process Design, and Post Go-Live

  C. as a series of states with consistent, clear metrics

  D. as a value on a scale of 1-10 based on specific outcomes

  Correct Answer: C

• Question 46:

  A pre-planned response process contains which sequence of events?

  A. Organize, Analyze, Prioritize, Contain

  B. Organize, Detect, Prioritize, Contain

  C. Organize, Prepare, Prioritize, Contain

  D. Organize, Verify, Prioritize, Contain

  Correct Answer: A

• Question 47:

  Chief factors when configuring auto-assignment of Security Incidents are.

  A. Agent group membership, Agent location and time zone

  B. Security incident priority, CI Location and agent time zone

  C. Agent skills, System Schedules and agent location

  D. Agent location, Agent skills and agent time zone

  Correct Answer: D

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/task/t_ConfigureSIM.html

• Question 48:

  Which of the following tag classifications are provided baseline? (Choose three.)

  A. Traffic Light Protocol

  B. Block from Sharing

  C. IoC Type

  D. Severity

  E. Cyber Kill Chain Step

  F. Escalation Level

  G. Enrichment whitelist/blacklist

  Correct Answer: ACG

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-operations- common/task/create-class-group-and- tags.html

• Question 49:

  There are several methods in which security incidents can be raised, which broadly fit into one of these categories:. (Choose two.)

  A. Integrations

  B. Manually created

  C. Automatically created

  D. Email parsing

  Correct Answer: BC

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/concept/si-creation.html

• Question 50:

  To configure Security Incident Escalations, you need the following role(s):.

  A. sn_si.admin

  B. sn_si.admin or sn_si.manager

  C. sn_si.admin or sn_si.ciso

  D. sn_si.manager or sn_si.analyst

  Correct Answer: A

  Reference: https://docs.servicenow.com/bundle/paris-security- management/page/product/security-incident- response/task/escalate-security-incident.html