CIS-SIR by ServiceNow Valid Free Exam Practice Test

Question 1

What is the first step when creating a security Playbook?

A. Create a Knowledge Article B. Set the Response Task's state C. Create a Runbook D. Create a Flow

Correct Answer: D

Question 2

Using the KB articles for Playbooks tasks also gives you which of these advantages?

A. Automated activities to run scans and enrich Security Incidents with real time data B. Enhanced ability to create and present concise, descriptive tasks C. Automated activities to resolve security Incidents through patching D. Improved visibility to threats and vulnerabilities

Correct Answer: D

Question 3

There are several methods in which security incidents can be raised, which broadly fit into one of these categories:. (Choose two.)

A. Email parsing B. Automatically created C. Manually created D. Integrations

Correct Answer: B,C

Question 4

Which of the following State Flows are provided for Security Incidents? (Choose three.)

A. SANS Open B. NIST Open C. NIST Stateful D. SANS Stateful

Correct Answer: B,C,D

Question 5

If the customer's email server currently has an account setup to report suspicious emails, then what happens next?

A. the customer should set up a rule to forward these mails onto the ServiceNow platform B. the customer's systems are already handling suspicious emails C. the ServiceNow platform ensures that parsing and analysis takes place on their mail server D. an integration added to Exchange keeps the ServiceNow platform in sync

Correct Answer: A

Question 6

Security tag used when a piece of information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.

A. TLP:WHITE B. TLP:RED C. TLP:GREEN D. TLP:AMBER

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 7

What factor, if any, limits the ability to close SIR records?

A. Nothing, SIR records could be closed at any time B. Opened related INC records C. All post-incident review question:ers have to be completed first D. Best practice dictates that SIR records should be set to 'Resolved' never to 'Closed'

Correct Answer: B

ServiceNow Certified Implementation Specialist - Security Incident Response - CIS-SIR Exam Practice Test