[Jan-2022] CIS-SIR Dumps are Available for Instant Access from ValidBraindumps
Study resources for the Valid CIS-SIR Braindumps!
Understanding utilitarian and specialized parts of ServiceNow Certified Implementation Specialist - Security Incident Response Exam
The accompanying will be examined in SERVICENOW CIS-SIR dumps:
- Customer Expectations
- Understanding Customer Goals and Meeting
- Data Visualization
- Introducing Security Incident Response
Certification Details for ServiceNow Certified Implementation Specialist - Security Incident Response Exam
- Language: English, Japanese, Spanish, German, French, Korean, Portuguese, Russian, Chinese
- Exam type: Multiple Choice Questions
- Duration: 120 minutes
- Number of Questions: 60 Questions
- Cut Score: 65%
- Exam Mode: On-line Proctored Exam
NEW QUESTION 14
In order to see the Actions in Flow Designer for Security Incident, what plugin must be activated?
- A. Security Incident Spoke
- B. Security Operations Spoke
- C. Performance Analytics for Security Incident Response
- D. Security Spoke
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response-orchestration/concept/sir-flows-and-templates.html
NEW QUESTION 15
Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.
- A. Get Network Statistics
- B. Get Running Processes
- C. Block Action
- D. Publish Watchlist
- E. Isolate Host
- F. Sightings Search
Answer: B
NEW QUESTION 16
There are several methods in which security incidents can be raised, which broadly fit into one of these categories: __________. (Choose two.)
- A. Manually created
- B. Integrations
- C. Automatically created
- D. Email parsing
Answer: A,C
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response/concept/si-creation.html
NEW QUESTION 17
There are several methods in which security incidents can be raised, which broadly fit into one of these categories:. (Choose two.)
- A. Manually created
- B. Integrations
- C. Automatically created
- D. Email parsing
Answer: A,C
NEW QUESTION 18
Security tag used when a piece of information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.
- A. TLP:GREEN
- B. TLP:RED
- C. TLP:AMBER
- D. TLP:WHITE
Answer: C
Explanation:
Explanation
Table Description automatically generated
NEW QUESTION 19
How do you select which process definition to use?
- A. By setting the Script Include record to Active
- B. By selecting the desired process within the Process Selection module
- C. By setting the process definition record to Active
- D. By selecting the desired process within the Process Definition module
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response/reference/setup-assistant-reference.html
NEW QUESTION 20
If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?
- A. Ask for assistance in the community page
- B. Look for one in the ServiceNow Store
- C. Download one from ServiceNow Share
- D. Build your own through the REST API Explorer
Answer: B
NEW QUESTION 21
A flow consists of one or more actions and a what?
- A. Change formatter
- B. Trigger
- C. NIST Ready State
- D. Catalog Designer
Answer: B
NEW QUESTION 22
Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with
"sn_si"?
- A. Because ServiceNow tracks license use against the Security Incident Response Application
- B. Because the Security Incident Response application uses a Secure Identity token
- C. Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix
- D. Because ServiceNow checks the instance for a Secure Identity when logging on to this scoped application
Answer: B
NEW QUESTION 23
Which of the following process definitions are not provided baseline?
- A. SAN Stateful
- B. SANS Open
- C. NIST Stateful
- D. NIST Open
Answer: D
NEW QUESTION 24
The severity field of the security incident is influenced by what?
- A. The time taken to resolve the security incident
- B. The impact, urgency and priority of the incident
- C. The business value of the affected asset
- D. The cost of the response to the security breach
Answer: C
NEW QUESTION 25
If the customer's email server currently has an account setup to report suspicious emails, then what happens next?
- A. the customer should set up a rule to forward these mails onto the ServiceNow platform
- B. an integration added to Exchange keeps the ServiceNow platform in sync
- C. the ServiceNow platform ensures that parsing and analysis takes place on their mail server
- D. the customer's systems are already handling suspicious emails
Answer: A
NEW QUESTION 26
What is the key to a successful implementation?
- A. Implementing everything that we offer
- B. Understanding the customer's goals and objectives
- C. Sell customer the most expensive package
- D. Building custom integrations
Answer: B
NEW QUESTION 27
What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?
- A. Preparation and Identification
- B. Detection & Analysis
- C. Post Incident Activity
- D. Containment, Eradication, and Recovery
Answer: D
Explanation:
Explanation/Reference: https://searchsecurity.techtarget.com/definition/incident-response
NEW QUESTION 28
Which of the following is an action provided by the Security Incident Response application?
- A. Create Record on Security Incident state V1
- B. Look Up Record on Security Incident state V1
- C. Create Outage state V1
- D. Create Response Task set Incident state V1
Answer: B
NEW QUESTION 29
Why should discussions focus with the end in mind?
- A. To understand customer's process
- B. To understand desired outcomes
- C. To understand required tools
- D. To understand current posture
Answer: B
NEW QUESTION 30
What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?
- A. User Reporting Phishing (for New emails)
- B. User Reporting Phishing (for Forwarded emails)
- C. Create Phishing Email
- D. Scan email for threats
Answer: B
NEW QUESTION 31
If the customer's email server currently has an account setup to report suspicious emails, then what happens next?
- A. the customer should set up a rule to forward these mails onto the ServiceNow platform
- B. an integration added to Exchange keeps the ServiceNow platform in sync
- C. the ServiceNow platform ensures that parsing and analysis takes place on their mail server
- D. the customer's systems are already handling suspicious emails
Answer: A
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response/concept/urp-about.html
NEW QUESTION 32
A flow consists of one or more actions and a what?
- A. Change formatter
- B. Trigger
- C. NIST Ready State
- D. Catalog Designer
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/flow- designer/concept/flows.html
NEW QUESTION 33
What is the first step when creating a security Playbook?
- A. Create a Flow
- B. Set the Response Task's state
- C. Create a Knowledge Article
- D. Create a Runbook
Answer: A
NEW QUESTION 34
Which Table would be commonly used for Security Incident Response?
- A. sec_ops_incident
- B. sn_si_incident
- C. sysapproval_approver
- D. cmdb_rel_ci
Answer: B
NEW QUESTION 35
Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.
- A. Get Network Statistics
- B. Get Running Processes
- C. Block Action
- D. Publish Watchlist
- E. Isolate Host
- F. Sightings Search
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/quebec-security-management/page/product/security- operations-common/concept/get-running-processes-capability.html
NEW QUESTION 36
Joe is on the SIR Team and needs to be able to configure Territories and Skills. What role does he need?
- A. Security Analyst
- B. Security Basic
- C. Manager
- D. Security Admin
Answer: D
NEW QUESTION 37
......
Updated CIS-SIR Tests Engine pdf - All Free Dumps Guaranteed: https://www.validbraindumps.com/CIS-SIR-exam-prep.html