Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Certified Implementation Specialist - Security Incident Response Exam

Last Update 12 hours ago Total Questions : 60

The Certified Implementation Specialist - Security Incident Response Exam content is now fully updated, with all current exam questions added 12 hours ago. Deciding to include CIS-SIR practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our CIS-SIR exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these CIS-SIR sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Certified Implementation Specialist - Security Incident Response Exam practice test comfortably within the allotted time.

Question # 11

If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?

A.

Build your own through the REST API Explorer

B.

Ask for assistance in the community page

C.

Download one from ServiceNow Share

D.

Look for one in the ServiceNow Store

Question # 12

Which of the following fields is used to identify an Event that is to be used for Security purposes?

A.

IT

B.

Classification

C.

Security

D.

CI

Question # 13

The benefits of improved Security Incident Response are expressed .

A.

as desirable outcomes with clear, measurable Key Performance Indicators

B.

differently depending upon 3 stages: Process Improvement, Process Design, and Post Go-Live

C.

as a series of states with consistent, clear metrics

D.

as a value on a scale of 1-10 based on specific outcomes

Question # 14

When the Security Phishing Email record is created what types of observables are stored in the record?

(Choose three.)

A.

URLs, domains, or IP addresses appearing in the body

B.

Who reported the phishing attempt

C.

State of the phishing email

D.

IP addresses from the header

E.

Hashes and/or file names found in the EML attachment

F.

Type of Ingestion Rule used to identify this email as a phishing attempt

Question # 15

What role(s) are required to add new items to the Security Incident Catalog?

A.

requires the sn_si.admin role

B.

requires the sn_si.catalog role

C.

requires both sn_si.write and catalog_admin roles

D.

requires the admin role

Question # 16

Which of the following tag classifications are provided baseline? (Choose three.)

A.

Traffic Light Protocol

B.

Block from Sharing

C.

IoC Type

D.

Severity

E.

Cyber Kill Chain Step

F.

Escalation Level

G.

Enrichment whitelist/blacklist

Question # 17

The severity field of the security incident is influenced by what?

A.

The cost of the response to the security breach

B.

The impact, urgency and priority of the incident

C.

The time taken to resolve the security incident

D.

The business value of the affected asset

Question # 18

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

A.

Post Incident Activity

B.

Detection & Analysis

C.

Preparation and Identification

D.

Containment, Eradication, and Recovery

Go to page: