Certified Implementation Specialist CIS-SIR Exam Questions

Pdfprep2021-06-23T09:20:20+00:00

Certified Implementation Specialist CIS-SIR exam questions can make sure you pass the test on the first attempt. The ServiceNow CIS-SIR exam is available to ServiceNow customers, partners, employees, and others interested in becoming a ServiceNow Certified Implementation Specialist – Security Incident Response. Study Certified Implementation Specialist CIS-SIR exam free questions below.

Page 1 of 3

1. Which improvement opportunity can be found baseline which can contribute towards process maturity and strengthen costumer’s overall security posture?

Post-Incident Review

Fast Eradication

Incident Containment

Incident Analysis

2. Which of the following process definitions are not provided baseline?

NIST Open

SAN Stateful

NIST Stateful

SANS Open

3. Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

Get Network Statistics

Isolate Host

Get Running Processes

Publish Watchlist

Block Action

Sightings Search

4. Which of the following State Flows are provided for Security Incidents? (Choose three.)

NIST Open

SANS Open

NIST Stateful

SANS Stateful

5. Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)

Access to security incident data may need to be restricted

Allow SIR Teams to control assignment of security roles

Clear separation of duty

Reduce the number of incidents assigned to the Platform Admin

Preserve the security image in the company

6. Joe is on the SIR Team and needs to be able to configure Territories and Skills .

What role does he need?

Security Basic

Manager

Security Analyst

Security Admin

7. This type of integration workflow helps retrieve a list of active network connections from a host or endpoint, so it can be used to enrich incidents during investigation.

Security Incident Response C Get Running Services

Security Incident Response C Get Network Statistics

Security Operations Integration C Sightings Search

Security Operations Integration C Block Request

8. Which one of the following users is automatically added to the Request Assessments list?

Any user that adds a worknote to the ticket

The analyst assigned to the ticket

Any user who has Response Tasks on the incident

The Affected User on the incident

9. What role(s) are required to add new items to the Security Incident Catalog?

requires the sn_si.admin role

requires the sn_si.catalog role

requires both sn_si.write and catalog_admin roles

requires the admin role

10. The Risk Score is calculated by combining all the weights using.

an arithmetic mean

addition

the Risk Score script include

a geometric mean

Page 2 of 3

11. Incident severity is influenced by the business value of the affected asset.

Which of the following are asset types that can be affected by an incident? (Choose two.)

Business Service

Configuration Item

Calculator Group

Severity Calculator

12. What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?

User Reporting Phishing (for Forwarded emails)

Scan email for threats

User Reporting Phishing (for New emails)

Create Phishing Email

13. If the customer’s email server currently has an account setup to report suspicious emails, then what happens next?

an integration added to Exchange keeps the ServiceNow platform in sync

the ServiceNow platform ensures that parsing and analysis takes place on their mail server

the customer’s systems are already handling suspicious emails

the customer should set up a rule to forward these mails onto the ServiceNow platform

14. If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?

Build your own through the REST API Explorer

Ask for assistance in the community page

Download one from ServiceNow Share

Look for one in the ServiceNow Store

15. Which of the following tag classifications are provided baseline? (Choose three.)

Traffic Light Protocol

Block from Sharing

IoC Type

Severity

Cyber Kill Chain Step

Escalation Level

Enrichment whitelist/blacklist

16. When a record is created in the Security Incident Phishing Email table what is triggered to create a Security Incident?

Ingestion Rule

Transform flow

Transform workflow

Duplication Rule

17. To configure Security Incident Escalations, you need the following role(s):.

sn_si.admin

sn_si.admin or sn_si.manager

sn_si.admin or sn_si.ciso

sn_si.manager or sn_si.analyst

18. What are two of the audiences identified that will need reports and insight into Security Incident Response reports? (Choose two.)

Analysts

Vulnerability Managers

Chief Information Security Officer (CISO)

Problem Managers

19. What does a flow require?

Security orchestration flows

Runbooks

CAB orders

A trigger

20. A flow consists of one or more actions and a what?

Change formatter

Catalog Designer

NIST Ready State

Trigger

Page 3 of 3

21. Select the one capability that restricts connections from one CI to other devices.

Isolate Host

Sightings Search

Block Action

Get Running Processes

Get Network Statistics

Publish Watchlist

22. There are several methods in which security incidents can be raised, which broadly fit into one of these categories:. (Choose two.)

Integrations

Manually created

Automatically created

Email parsing

23. A pre-planned response process contains which sequence of events?

Organize, Analyze, Prioritize, Contain

Organize, Detect, Prioritize, Contain

Organize, Prepare, Prioritize, Contain

Organize, Verify, Prioritize, Contain

24. What is the key to a successful implementation?

Sell customer the most expensive package

Implementing everything that we offer

Understanding the customer’s goals and objectives

Building custom integrations

Certified Implementation Specialist CIS-SIR Exam Questions

Author