ServiceNow CIS-SIR Exam Practice Test Instant Access

Question 1

A pre-planned response process contains which sequence of events?

AOrganize, Analyze, Prioritize, Contain

BOrganize, Detect, Prioritize, Contain

COrganize, Prepare, Prioritize, Contain

DOrganize, Verify, Prioritize, Contain

Answer : A

Question 2

Incident severity is influenced by the business value of the affected asset.

Which of the following are asset types that can be affected by an incident? (Choose two.)

ABusiness Service

BConfiguration Item

CCalculator Group

DSeverity Calculator

Answer : A, B

Question 3

If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?

ABuild your own through the REST API Explorer

BAsk for assistance in the community page

CDownload one from ServiceNow Share

DLook for one in the ServiceNow Store

Answer : D

Question 4

When a record is created in the Security Incident Phishing Email table what is triggered to create a Security Incident?

AIngestion Rule

BTransform flow

CTransform workflow

DDuplication Rule

Answer : A

Question 5

What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?

AUser Reporting Phishing (for Forwarded emails)

BScan email for threats

CUser Reporting Phishing (for New emails)

DCreate Phishing Email

Answer : A

Question 6

When the Security Phishing Email record is created what types of observables are stored in the record?

(Choose three.)

AURLs, domains, or IP addresses appearing in the body

BWho reported the phishing attempt

CState of the phishing email

DIP addresses from the header

EHashes and/or file names found in the EML attachment

FType of Ingestion Rule used to identify this email as a phishing attempt

Answer : A, D, E

Question 7

What factor, if any, limits the ability to close SIR records?

AOpened related INC records

BBest practice dictates that SIR records should be set to 'Resolved' never to 'Closed'

CNothing, SIR records could be closed at any time

DAll post-incident review Question:ers have to be completed first

Answer : A

ServiceNow Certified Implementation Specialist - Security Incident Response Exam Practice Test