ServiceNow CIS-SIR Exam Practice Test Instant Access

Question 1

What field is used to distinguish Security events from other IT events?

AType

BSource

CClassification

DDescription

Answer : C

Question 2

Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

AWork Instruction Playbook

BFlow

CWorkflow

DRunbook

EFlow Designer

Answer : D

Question 3

What does a flow require?

ASecurity orchestration flows

BRunbooks

CCAB orders

DA trigger

Answer : D

Question 4

For Customers who don't use 3rd-party systems, what ways can security incidents be created? (Choose three.)

ASecurity Service Catalog

BSecurity Incident Form

CInbound Email Parsing Rules

DLeveraging an Integration

EAlert Management

Answer : A, B, C

Question 5

Which one of the following users is automatically added to the Request Assessments list?

AAny user that adds a worknote to the ticket

BThe analyst assigned to the ticket

CAny user who has Response Tasks on the incident

DThe Affected User on the incident

Answer : C

Question 6

Which Table would be commonly used for Security Incident Response?

Asysapproval_approver

Bsec_ops_incident

Ccmdb_rel_ci

Dsn_si_incident

Answer : D

Question 7

Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

AGet Network Statistics

BIsolate Host

CGet Running Processes

DPublish Watchlist

EBlock Action

FSightings Search

Answer : C

ServiceNow CIS-SIR ServiceNow Certified Implementation Specialist - Security Incident Response Exam Practice Test