CIS-SIR

Chief factors when configuring auto-assignment of Security Incidents are.A . Agent group membership, Agent location and time zoneB . Security incident priority, CI Location and agent time zoneC . Agent skills, System Schedules and agent locationD . Agent location, Agent skills and agent time zoneView AnswerAnswer: D Explanation: Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/task/t_ConfigureSIM.html

A pre-planned response process contains which sequence of events?A . Organize, Analyze, Prioritize, ContainB . Organize, Detect, Prioritize, ContainC . Organize, Prepare, Prioritize, ContainD . Organize, Verify, Prioritize, ContainView AnswerAnswer: A

Why should discussions focus with the end in mind?A . To understand desired outcomesB . To understand current postureC . To understand customer’s processD . To understand required toolsView AnswerAnswer: A

The benefits of improved Security Incident Response are expressed.A . as desirable outcomes with clear, measurable Key Performance IndicatorsB . differently depending upon 3 stages: Process Improvement, Process Design, and Post Go-LiveC . as a series of states with consistent, clear metricsD . as a value on a scale of...

What specific role is required in order to use the REST API Explorer?A . adminB . sn_si.adminC . rest_api_explorerD . security_adminView AnswerAnswer: A,C Explanation: Reference: https://developer.servicenow.com/dev.do#!/learn/learning-plans/orlando/technology_partner_program/app_store_learnv2_rest_orlando_introduction_to_the_rest_a pi_explorer

What does a flow require?A . Security orchestration flowsB . RunbooksC . CAB ordersD . A triggerView AnswerAnswer: D

A flow consists of one or more actions and a what?A . Change formatterB . Catalog DesignerC . NIST Ready StateD . TriggerView AnswerAnswer: D Explanation: Reference: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/flow-designer/concept/flows.html

The EmailUserReportedPhishing script include processes inbound emails and creates a record in which table?A . ar_sn_si_phishing_emailB . sn_si_incidentC . sn_si_phishing_email_headerD . sn_si_phishing_emailView AnswerAnswer: A

When the Security Phishing Email record is created what types of observables are stored in the record? (Choose three.)A . URLs, domains, or IP addresses appearing in the bodyB . Who reported the phishing attemptC . State of the phishing emailD . IP addresses from the headerE . Hashes and/or...

Which Table would be commonly used for Security Incident Response?A . sysapproval_approverB . sec_ops_incidentC . cmdb_rel_ciD . sn_si_incidentView AnswerAnswer: D Explanation: Reference: https://docs.servicenow.com/bundle/quebec-security-management/page/product/security-incident-response/reference/installed-with-sir.html