Free Practice Questions for ServiceNow CIS-SIR Exam

Question 1

Chief factors when configuring auto-assignment of Security Incidents are .

AAgent group membership, Agent location and time zone

BSecurity incident priority, CI Location and agent time zone

CAgent skills, System Schedules and agent location

DAgent location, Agent skills and agent time zone

Correct Answer: D. Agent location, Agent skills and agent time zone

Question 2

David is on the Network team and has been assigned a security incident response task. What role does he need to be able to view and work the task?

ASecurity Analyst

BSecurity Basic

CExternal

DRead

Correct Answer: A. Security Analyst

Question 3

Which one of the following users is automatically added to the Request Assessments list?

AAny user that adds a worknote to the ticket

BThe analyst assigned to the ticket

CAny user who has Response Tasks on the incident

DThe Affected User on the incident

Correct Answer: C. Any user who has Response Tasks on the incident

Question 4

Which ServiceNow automation capability extends Flow Designer to integrate business processes with other systems?

AWorkflow

BOrchestration

CSubflows

DIntegration Hub

Correct Answer: D. Integration Hub

Question 5

Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)

AAccess to security incident data may need to be restricted

BAllow SIR Teams to control assignment of security roles

CClear separation of duty

DReduce the number of incidents assigned to the Platform Admin

EPreserve the security image in the company

Correct Answer: B. Allow SIR Teams to control assignment of security roles; C. Clear separation of duty; D. Reduce the number of incidents assigned to the Platform Admin

Question 6

What field is used to distinguish Security events from other IT events?

AType

BSource

CClassification

DDescription

Correct Answer: C. Classification

Question 7

Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with "sn_si"?

ABecause SIR is a scoped application, roles and script includes will begin with the sn_si prefix

BBecause the Security Incident Response application uses a Secure Identity token

CBecause ServiceNow checks the instance for a Secure Identity when logging on to this scoped application

DBecause ServiceNow tracks license use against the Security Incident Response Application

Correct Answer: B. Because the Security Incident Response application uses a Secure Identity token

Question 8

Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

AGet Network Statistics

BIsolate Host

CGet Running Processes

DPublish Watchlist

EBlock Action

FSightings Search

Correct Answer: C. Get Running Processes

Question 9

Using the KB articles for Playbooks tasks also gives you which of these advantages?

AAutomated activities to run scans and enrich Security Incidents with real time data

BAutomated activities to resolve security Incidents through patching

CImproved visibility to threats and vulnerabilities

DEnhanced ability to create and present concise, descriptive tasks

Correct Answer: C. Improved visibility to threats and vulnerabilities

Question 10

When a service desk agent uses the Create Security Incident UI action from a regular incident, what occurs?

AThe incident is marked resolved with an automatic security resolution code

BA security incident is raised on their behalf but only a notification is displayed

CA security incident is raised on their behalf and displayed to the service desk agent

DThe service desk agent is redirected to the Security Incident Catalog to complete the record producer

Correct Answer: A. The incident is marked resolved with an automatic security resolution code