ServiceNow CIS-SIR || with Error-free Answers.
Q) Why do roles for SIR begin with "sn_si"? correct answers Because SIR is a scoped
application with it's own prefix
Q) What is the goal of SIR? correct answers Containment as soon as possible
What are the different subscriptions available to purchase? correct answers Standard,
Professional, Enterprise
Q) The ServiceNow Security Operations Business Unit has specified a Security Incident
Response Customer Journey Maturity Model: correct answers Modernize, Transform, Innovate
Q) The benefits of improved Security Incident Response are expressed correct answers as a
series of states with consistent, clear metrics
Q) What parts of the SIR lifecycle are responsible for limiting the impact of a security incident?
correct answers Containment, Eradication, Recovery
Q) There are several methods in which security incidents can be raised, which broadly fit into
one of these categories: (Select two) correct answers Automatically, Manually
Q) What are three of the audiences identified that will need reports and insight into SIR reports?
correct answers CIO/CISO, Analysts, Managers
Q) What does an CIO/CISO need: (Select two) correct answers Single, clear indicators of health
& function & High level overviews
Q) What does an Analyst need: (Select two) correct answers Clear Prioritizations, up-to-the-min
views, granularity
, Q) What tables are commonly used as a source for reports? (Select 3) correct answers SI Audit
Log, Task, Security Incident
Q) What table are security incidents stored in? correct answers sn_si_incident
Q) What table would be commonly used for SIR? correct answers sn_si_incident
Q) Why should discussions focus with the end in mind? correct answers to understand desired
outcomes
Q) First-line responders are sometimes known as: correct answers CERT, CSIRT, SIRT
Q) What is the key to a successful implementation? correct answers Understanding the customers
goals and objectives
Q) The three main customer types likely to be encountered are? correct answers I want
everything, I want this thing, I know nothing
Q) A pre-planned response process contains which sequence of events? correct answers
Organize, Analyze, Prioritize, Contain (OAPC)
Q) What are the different factors to consider when building the SIR Team? correct answers
Skills, Knowledge, Goals, Capabilities, Tools, Metrics, Outcomes
Q) Why is it important that the Platform (System) Administrator and the Security Incident
administrator role be separated? (Select three.) correct answers Separation of duty, reduce
number of incidents for admin, allow SIR team to control assignments
Q) Why do roles for SIR begin with "sn_si"? correct answers Because SIR is a scoped
application with it's own prefix
Q) What is the goal of SIR? correct answers Containment as soon as possible
What are the different subscriptions available to purchase? correct answers Standard,
Professional, Enterprise
Q) The ServiceNow Security Operations Business Unit has specified a Security Incident
Response Customer Journey Maturity Model: correct answers Modernize, Transform, Innovate
Q) The benefits of improved Security Incident Response are expressed correct answers as a
series of states with consistent, clear metrics
Q) What parts of the SIR lifecycle are responsible for limiting the impact of a security incident?
correct answers Containment, Eradication, Recovery
Q) There are several methods in which security incidents can be raised, which broadly fit into
one of these categories: (Select two) correct answers Automatically, Manually
Q) What are three of the audiences identified that will need reports and insight into SIR reports?
correct answers CIO/CISO, Analysts, Managers
Q) What does an CIO/CISO need: (Select two) correct answers Single, clear indicators of health
& function & High level overviews
Q) What does an Analyst need: (Select two) correct answers Clear Prioritizations, up-to-the-min
views, granularity
, Q) What tables are commonly used as a source for reports? (Select 3) correct answers SI Audit
Log, Task, Security Incident
Q) What table are security incidents stored in? correct answers sn_si_incident
Q) What table would be commonly used for SIR? correct answers sn_si_incident
Q) Why should discussions focus with the end in mind? correct answers to understand desired
outcomes
Q) First-line responders are sometimes known as: correct answers CERT, CSIRT, SIRT
Q) What is the key to a successful implementation? correct answers Understanding the customers
goals and objectives
Q) The three main customer types likely to be encountered are? correct answers I want
everything, I want this thing, I know nothing
Q) A pre-planned response process contains which sequence of events? correct answers
Organize, Analyze, Prioritize, Contain (OAPC)
Q) What are the different factors to consider when building the SIR Team? correct answers
Skills, Knowledge, Goals, Capabilities, Tools, Metrics, Outcomes
Q) Why is it important that the Platform (System) Administrator and the Security Incident
administrator role be separated? (Select three.) correct answers Separation of duty, reduce
number of incidents for admin, allow SIR team to control assignments
