Free ServiceNow Certified Implementation Specialist – Security Incident Response Exam CIS-SIR Exam Practice Test

What are two of the audiences identified that will need reports and insight into Security Incident Response reports? (Choose two.)

• Analysts
• Vulnerability Managers
• Chief Information Security Officer (CISO)
• Problem Managers

Which of the following tag classifications are provided baseline? (Choose three.)

• Traffic Light Protocol
• Block from Sharing
• IoC Type
• Severity
• Cyber Kill Chain Step
• Escalation Level
• Enrichment whitelist/blacklist

Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with 'sn_si'?

• Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix
• Because the Security Incident Response application uses a Secure Identity token
• Because ServiceNow checks the instance for a Secure Identity when logging on to this scoped application
• Because ServiceNow tracks license use against the Security Incident Response Application

Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)

• Access to security incident data may need to be restricted
• Allow SIR Teams to control assignment of security roles
• Clear separation of duty
• Reduce the number of incidents assigned to the Platform Admin
• Preserve the security image in the company

Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

• Work Instruction Playbook
• Flow
• Workflow
• Runbook
• Flow Designer

What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?

• User Reporting Phishing (for Forwarded emails)
• Scan email for threats
• User Reporting Phishing (for New emails)
• Create Phishing Email

Why should discussions focus with the end in mind?

• To understand desired outcomes
• To understand current posture
• To understand customer's process
• To understand required tools

Which of the following process definitions are not provided baseline?

• NIST Open
• SAN Stateful
• NIST Stateful
• SANS Open

There are several methods in which security incidents can be raised, which broadly fit into one of these categories: . (Choose two.)

• Integrations
• Manually created
• Automatically created
• Email parsing

Using the KB articles for Playbooks tasks also gives you which of these advantages?

• Automated activities to run scans and enrich Security Incidents with real time data
• Automated activities to resolve security Incidents through patching
• Improved visibility to threats and vulnerabilities
• Enhanced ability to create and present concise, descriptive tasks