ServiceNow CIS-SIR Online Practice Questions and Exam Preparation

ServiceNow CIS-SIR Online Questions & Answers

• Question 51:

  David is on the Network team and has been assigned a security incident response task. What role does he need to be able to view and work the task?

  A. Security Analyst
  B. Security Basic
  C. External
  D. Read
  A. Security Analyst

• Question 52:

  What role(s) are required to add new items to the Security Incident Catalog?

  A. requires the sn_si.admin role
  B. requires the sn_si.catalog role
  C. requires both sn_si.write and catalog_admin roles
  D. requires the admin role
  D. requires the admin role

• Question 53:

  What is the purpose of Calculator Groups as opposed to Calculators?

  A. To provide metadata about the calculators
  B. To allow the agent to select which calculator they want to execute
  C. To set the condition for all calculators to run
  D. To ensure one at maximum will run per group
  C. To set the condition for all calculators to run

• Question 54:

  What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)

  A. Add the TLP: GREEN tag to the playbooks that you want to include in the Selected Playbook choice list
  B. Navigate to the sys_hub_flow.list table
  C. Search for the new playbook you have created using Flow Designer
  D. Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list
  E. Navigate to the sys_playbook_flow.list table
  B. Navigate to the sys_hub_flow.list table
  C. Search for the new playbook you have created using Flow Designer
  D. Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list

• Question 55:

  When a service desk agent uses the Create Security Incident UI action from a regular incident, what occurs?

  A. The incident is marked resolved with an automatic security resolution code
  B. A security incident is raised on their behalf but only a notification is displayed
  C. A security incident is raised on their behalf and displayed to the service desk agent
  D. The service desk agent is redirected to the Security Incident Catalog to complete the record producer
  A. The incident is marked resolved with an automatic security resolution code

• Question 56:

  In order to see the Actions in Flow Designer for Security Incident, what plugin must be activated?

  A. Performance Analytics for Security Incident Response
  B. Security Spoke
  C. Security Operations Spoke
  D. Security Incident Spoke
  C. Security Operations Spoke

• Question 57:

  For Customers who don't use 3rd-party systems, what ways can security incidents be created? (Choose three.)

  A. Security Service Catalog
  B. Security Incident Form
  C. Inbound Email Parsing Rules
  D. Leveraging an Integration
  E. Alert Management
  A. Security Service Catalog
  B. Security Incident Form
  C. Inbound Email Parsing Rules

• Question 58:

  Why should discussions focus with the end in mind?

  A. To understand desired outcomes
  B. To understand current posture
  C. To understand customer's process
  D. To understand required tools
  A. To understand desired outcomes

• Question 59:

  Which of the following process definitions are not provided baseline?

  A. NIST Open
  B. SAN Stateful
  C. NIST Stateful
  D. SANS Open
  A. NIST Open

• Question 60:

  What field is used to distinguish Security events from other IT events?

  A. Type
  B. Source
  C. Classification
  D. Description
  C. Classification