CIS-SIR Online Practice Questions and Answers

Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with "sn_si"?

A. Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix

B. Because the Security Incident Response application uses a Secure Identity token

C. Because ServiceNow checks the instance for a Secure Identity when logging on to this scoped application

D. Because ServiceNow tracks license use against the Security Incident Response Application

To configure Security Incident Escalations, you need the following role(s):.

A. sn_si.admin

B. sn_si.admin or sn_si.manager

C. sn_si.admin or sn_si.ciso

D. sn_si.manager or sn_si.analyst

A pre-planned response process contains which sequence of events?

A. Organize, Analyze, Prioritize, Contain

B. Organize, Detect, Prioritize, Contain

C. Organize, Prepare, Prioritize, Contain

D. Organize, Verify, Prioritize, Contain

If the customer's email server currently has an account setup to report suspicious emails, then what happens next?

A. an integration added to Exchange keeps the ServiceNow platform in sync

B. the ServiceNow platform ensures that parsing and analysis takes place on their mail server

C. the customer's systems are already handling suspicious emails

D. the customer should set up a rule to forward these mails onto the ServiceNow platform

Flow Triggers can be based on what? (Choose three.)

A. Record changes

B. Schedules

C. Subflows

D. Record inserts

E. Record views

Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

A. Work Instruction Playbook

B. Flow

C. Workflow

D. Runbook

E. Flow Designer

Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

A. Get Network Statistics

B. Isolate Host

C. Get Running Processes

D. Publish Watchlist

E. Block Action

F. Sightings Search

What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)

A. Add the TLP: GREEN tag to the playbooks that you want to include in the Selected Playbook choice list

B. Navigate to the sys_hub_flow.list table

C. Search for the new playbook you have created using Flow Designer

D. Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list

E. Navigate to the sys_playbook_flow.list table

Which of the following fields is used to identify an Event that is to be used for Security purposes?

A. IT

B. Classification

C. Security

D. CI

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

A. Post Incident Activity

B. Detection and Analysis

C. Preparation and Identification

D. Containment, Eradication, and Recovery