72 free ServiceNow CIS-RC practice questions from the CertStash pack of 289, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 72 free here, all 289 in the pack, and each step includes the one before it.
Get all 289 questions (US$39) · Download the first 10 as a PDF
Question 1
Who can move a Policy into Review? (Choose two.)
Show answer and explanation
Correct answer: B, D. policy approver; policy owner
A Policy moves into Review state through actions by specific roles. The Policy Approver and Policy Owner are the roles authorized to initiate the move to Review status. The sys admin and policy reviewer do not have the authority to move policies into Review; their roles are either administrative overhead or occur after the Review state.
Why the other options are wrong
- A. Sys admin does not have policy workflow permissions to move policies into Review
- C. Policy reviewer reviews policies that are already in Review state; they do not move policies into Review
Question 2
The Citation table is a child table of which parent?
Show answer and explanation
Correct answer: A. Content
The Citation table is a child table of the Content table in the GRC data model. Citations reference sources and authorities that support content within policy and control documentation, establishing a parent-child relationship where Content is the parent entity.
Why the other options are wrong
- B. Authority Document is related to citations but is not the direct parent table
- C. Item is a separate entity and not the parent of Citation
- D. Document is too generic and not the specific parent table for Citation
Question 3
Control Failure Factor represents the impact of Control Failures on what score?
Show answer and explanation
Correct answer: B. Residual
Control Failure Factor represents the impact of control failures on the Residual risk score. The Residual risk score reflects the risk remaining after controls are applied, and control failures directly reduce the effectiveness of those controls, thereby affecting the residual risk calculation.
Why the other options are wrong
- A. Inherent risk is independent of control failures and is not impacted by the Control Failure Factor
- C. Total is not a standard risk score type in GRC frameworks
- D. Calculated is not the specific risk score impacted by Control Failure Factor
Question 4
Which one of the following is not a trigger for issue creation?
Show answer and explanation
Correct answer: C. Risk assessment returns the inherent and residual risk impact as ‘Very High’
Risk assessments returning inherent and residual risk impact as 'Very High' does not automatically trigger issue creation. While high-risk conditions warrant attention, the explicit triggers for automatic issue creation are manual creation, indicator failures, attestation failures, and control ineffectiveness in closed states. Risk level alone is not a system trigger unless configured as a specific business rule.
Why the other options are wrong
- A. Manual issue creation by authorized roles is a valid trigger
- B. Indicator failure is a configured trigger for automatic issue creation
- D. Attestation results of 'Not Implemented' trigger issue creation
- E. Ineffective controls in closed complete state trigger issue creation
Question 5
GRC Options in Interactive Filters are only available through which feature?
Show answer and explanation
Correct answer: C. Performance Analytics
GRC Options in Interactive Filters are exclusively available through the Performance Analytics feature. Performance Analytics provides the advanced filtering capabilities needed to segment and analyze GRC data across multiple dimensions using GRC-specific filter options.
Why the other options are wrong
- A. GRC Filtering is not the feature that makes GRC Options available in Interactive Filters
- B. Metrics Reporting does not provide GRC Options in Interactive Filters
- D. Trending Analytics does not feature GRC Options in Interactive Filters
Question 6
In which state can reviewers either send the Policy back to draft or forward it by requesting approval?
Show answer and explanation
Correct answer: D. Review
In the Review state, reviewers have the authority to either send the policy back to Draft for revisions or forward it by requesting approval from the appropriate approvers. This state represents the transition point where review feedback is incorporated or escalated.
Why the other options are wrong
- A. Retired is a final state with no review actions available
- B. Published is a final state after approval; reviewers cannot send it back to draft
- C. Awaiting Approval is the state after Review where approvers act, not reviewers
Question 7
The Risk Scoring values are entered on the Risk Statement. What records inherits the values from the Risk Statement?
Show answer and explanation
Correct answer: C. Registered Risk
Risk scoring values entered on the Risk Statement are inherited by Registered Risk records. The Registered Risk represents the instantiation of a risk in the organization's risk register and carries forward the scoring parameters defined at the Risk Statement level.
Why the other options are wrong
- A. Risk Criteria Matrix is used to define risk scoring methodology, not to inherit from Risk Statement
- B. Risk Framework is a structural element that does not inherit Risk Statement values
- D. Risk Response Issue is created in response to risks but does not inherit Risk Statement scoring values
Question 8
Which of the following statements correctly describe the risk management lifecycle process?
Show answer and explanation
Correct answer: C. Identify and Plan, Assess, Control, Review
The correct sequence of the risk management lifecycle is Identify and Plan, Assess, Control, and Review. This order reflects the logical flow: first identifying and planning for risks, then assessing their impact and probability, implementing controls to mitigate them, and finally reviewing the effectiveness of the overall process.
Why the other options are wrong
- A. Access is not a defined phase; the correct first phase is Identify and Plan
- B. This sequence is incorrect as Control comes after Review in this option
- D. This sequence places Review before Assess, which is illogical as assessment must occur before review
Question 9
Which of the following tables exist within the GRC: Profiles application scope? (Choose three.)
Show answer and explanation
Correct answer: A, D, E. Document; Content; Indicator
The GRC: Profiles application scope includes the Document, Indicator, and Content tables as core data entities. The Policy table exists in the broader GRC suite but is not part of the Profiles application scope specifically. The Risk table is also outside the Profiles application scope, belonging instead to the Risk Management application.
Why the other options are wrong
- B. Policy is part of the broader GRC suite but not within the Profiles application scope.
- C. Risk is managed in the Risk Management application, not the Profiles application scope.
Question 10
What are some characteristics of the ServiceNow Store? (Choose four.)
Show answer and explanation
Correct answer: B, C, D, E. All applications are certified by ServiceNow; Applications may be developed by ServiceNow Technology Partners; It houses both paid and free applications and integrations; Applications are built om the ServiceNow platform
The ServiceNow Store houses applications developed by ServiceNow and its Technology Partners. Applications are built on the ServiceNow platform and include both paid and free offerings. While some applications are certified by ServiceNow, not all applications carry ServiceNow certification, certification is selective rather than universal. Certification is specifically performed by ServiceNow, not by other developers.
Why the other options are wrong
- A. Only some applications are certified by ServiceNow, not all of them.
- F. Applications are certified by ServiceNow itself, not by other developers.
Question 11
What GRC module would you access in order to update Entity Types?
Show answer and explanation
Correct answer: C. Scoping > Entity Types
In the ServiceNow GRC module, Entity Types are managed through the Scoping > Entity Types menu path. This is where administrators can create, view, and modify the different types of entities that can be used within the GRC scoping framework.
Why the other options are wrong
- A. Risk > Entities is used to manage individual entities or risks, not to configure the types themselves.
- B. Scoping > Profiles is where profiles are managed, not entity types.
- D. The CMDB is a separate module used for configuration management and is not the location for GRC entity type configuration.
Question 12
What baseline criteria determine when notifications are triggered in relation to audit tasks? (Choose two.)
Show answer and explanation
Correct answer: A, D. Expiration; Due date change
Audit task notifications are baseline-triggered by two primary criteria: Expiration (when an audit task reaches its expiration date) and Due date change (when the due date of an audit task is modified). These represent the standard baseline events that prompt the system to send notifications to relevant stakeholders. Completion percentage thresholds and reassignment events are not standard baseline notification triggers in audit task configuration.
Why the other options are wrong
- B. Completion percentages like 50% are not baseline notification criteria for audit tasks.
- C. Reassignment of audit tasks does not trigger baseline notifications in the standard configuration.
Question 13
What do you select when you create a new assessment scheduler record for initiating advanced risk assessments? (Choose two.)
Show answer and explanation
Correct answer: B, D. A published risk assessment methodology (RAM); Entities from the designated entity classes
When creating an assessment scheduler record for advanced risk assessments, you select a published Risk Assessment Methodology (RAM) and entities from the designated entity classes. These selections define which assessment template will be used and which organizational entities will be evaluated.
Why the other options are wrong
- A. You must select specific entities from designated classes, not any arbitrary active entity.
- C. Entity types are not the selection level; entity classes provide the more granular classification needed.
- E. Objects from ServiceNow tables are not the mechanism for selecting assessment scope; entity classes provide this function.
Question 14
What new related list was added to the risk statement and entity records after migrating to advanced risk assessment?
Show answer and explanation
Correct answer: B. Risk assessments related list
When migrating to advanced risk assessment, the Risk assessments related list was added to both risk statement and entity records. This related list provides visibility into all risk assessments associated with a particular risk statement or entity, enabling users to track assessment activities and results directly from the parent record.
Why the other options are wrong
- A. Aggregated risk related list is not the new related list introduced in advanced risk assessment migration.
- C. Risk tolerance related list is not a new related list added during this migration.
- D. Assessment instances related list does not match the actual related list added during advanced risk assessment migration.
Question 15
Which filter navigation syntax displays the default form view of the Risk table in the Content Frame?
Show answer and explanation
Correct answer: A. sn_risk_risk.form
The filter navigation syntax sn_risk_risk.form displays the default form view of the Risk table in the Content Frame. The lowercase .form notation is the correct syntax for accessing the default form in ServiceNow's filter navigation.
Why the other options are wrong
- B. .LIST in uppercase is not valid filter navigation syntax for this context.
- C. .FORM in uppercase is not the correct syntax; lowercase .form is required for proper filter navigation.
- D. .list in lowercase targets list views, not the form view of the Risk table.
Question 16
An Observation can also be commonly known as what during an audit?
Show answer and explanation
Correct answer: D. Finding
An Observation in the context of ServiceNow GRC and audit management is commonly referred to as a Finding. Findings represent the conclusions and documented results of audit activities, capturing issues, non-conformances, or noteworthy conditions identified during the audit process.
Why the other options are wrong
- A. Evidence refers to supporting documentation used to substantiate findings, not the findings themselves.
- B. Engagement refers to the audit engagement or engagement record, not individual observations.
- C. Problem is a different ServiceNow construct used in incident management, not the standard audit terminology for observations.
Question 17
The Entity Type table has a many-to-many relationship with which tables? (Choose two.)
Show answer and explanation
Correct answer: A, B. Risk Statement; Policy
The Entity Type table maintains many-to-many relationships with both Risk Statement and Policy tables. These relationships allow multiple entity types to be scoped to a single risk statement or policy, and conversely, allow a single entity type to be associated with multiple risk statements and policies, enabling flexible governance assignments across organizational structures.
Why the other options are wrong
- C. Entity Type does not have a many-to-many relationship with Control; controls are scoped to specific entities through different linkage mechanisms.
- D. Entity Type does not have a many-to-many relationship with Risk; risks are created as instances registered to specific entities rather than through entity type relationships.
Question 18
Which collection of tables extend the Document table?
Show answer and explanation
Correct answer: C. Risk Framework, Policy, Authority, Document
The Document table is extended by Risk Framework, Policy, Authority, and Document subtypes in the ServiceNow GRC module. These tables inherit from and extend the base Document table to provide specialized document management capabilities for different GRC artifact types.
Why the other options are wrong
- A. Risk and Control are separate entity types, not direct extensions of the Document table.
- B. Control Objective and Citation are related to documents but do not collectively extend the Document table as a group.
- D. Risk Statement and Citation are specific GRC constructs but do not represent the full set of Document table extensions.
Question 19
An Entity can belong to one or multiple of which of the following?
Show answer and explanation
Correct answer: A. Entity Types
An Entity can belong to one or multiple Entity Types. Entity Types provide a flexible classification mechanism that allows entities to be categorized in various ways simultaneously. This many-to-many relationship enables entities to be associated with multiple entity type classifications for organizational and reporting purposes.
Why the other options are wrong
- B. Information Objects are separate records that relate to entities but are not a grouping mechanism for entities.
- C. Departments are organizational units; entities are assigned to departments through other mechanisms, not grouped within them.
- D. Entity Classes represent different record types but do not function as a grouping structure for entities themselves.
Question 20
The SOX content pack includes a series of policies, control, risks. How are all of these components linked together?
Show answer and explanation
Correct answer: C. Automatically
Components within the SOX content pack (policies, controls, and risks) are linked together automatically. The content pack is pre-configured with established relationships reflecting SOX compliance requirements, eliminating the need for manual linking and ensuring consistency.
Why the other options are wrong
- A. Mapping files are not required as the linking is built into the content pack.
- B. Manual linking is not necessary since the content pack provides automatic connections.
- D. Batch import is a data loading mechanism, not the method by which components are linked.
Question 21
Which methods does ServiceNow support when migrating new policies? (Choose three.)
Show answer and explanation
Correct answer: B, C, F. They can be imported via an API; They can be created manually; They can be imported from existing spreadsheets
ServiceNow supports policy migration through three primary methods: policies can be created manually within the system, imported via an API for programmatic integration, and imported from existing spreadsheets using data import tools. These methods provide flexibility for organizations transitioning policies from various sources into ServiceNow GRC.
Why the other options are wrong
- A. PDFs cannot be directly imported as policies; they would require manual data entry or conversion.
- D. Copying policies from the UCF (Unified Compliance Framework) is not a standard migration method.
- E. Importing directly from regulatory websites is not a supported automated method; regulatory content would need to be processed first.
Question 22
Which GRC application would you use to determine where the organization is the most vulnerable or has the most exposure?
Show answer and explanation
Correct answer: D. Risk Management
Risk Management is the GRC application used to determine where an organization is most vulnerable or has the most exposure. It provides tools to identify, assess, and prioritize risks, enabling organizations to understand their risk landscape and vulnerability areas.
Why the other options are wrong
- A. Vendor Risk Management focuses specifically on risks associated with third-party vendors, not overall organizational vulnerability.
- B. Audit Management evaluates compliance and control effectiveness through audits but is not designed to map organizational exposure.
- C. Policy and Compliance Management ensures adherence to policies and standards but does not determine overall organizational vulnerability.
Question 23
Risk criteria typically include definitions of different levels of what? (Choose two.)
Show answer and explanation
Correct answer: A, B. Impact; Likelihood
Risk criteria matrices typically define different levels of Impact (consequence magnitude) and Likelihood (probability of occurrence). These two dimensions are the standard components used to assess and categorize risks within a risk framework, allowing organizations to prioritize risk responses based on their severity and probability.
Why the other options are wrong
- C. Criticality is a derived concept rather than a standard foundational dimension in risk criteria definitions.
- D. Importance is not a standard risk criteria dimension; it is related to but distinct from the impact and likelihood framework.
- E. Priority is an outcome of risk assessment rather than a dimension used to define risk criteria levels.
Question 24
Which scheduled jobs in the GRC: Profiles scope help manage the population of Entity records? (Choose two.)
Show answer and explanation
Correct answer: A, C. GRC indicator nightly run; GRC Profile Generation
The scheduled jobs GRC Entity and Risk Statement Data Collection and GRC Profile Generation are the ones that manage the population of Entity records within the GRC: Profiles scope. These jobs ensure that entities are created, updated, and maintained automatically according to configured schedules.
Why the other options are wrong
- B. The GRC indicator nightly run manages indicators, not entity population.
- D. GRC Refresh Risk Scores updates risk scoring calculations, not entity record population.
Question 25
What types of tasks are specific to the Audit module? (Choose four.)
Show answer and explanation
Correct answer: B, C, D, E. Interview; Walkthrough; Control Test; Activity
Interview, Walkthrough, Control Test, and Activity are the specific task types used within the Audit module. These represent the distinct types of audit work that auditors perform to gather evidence, evaluate controls, and document their audit procedures and findings.
Why the other options are wrong
- A. Control Attestation is part of the Compliance module, not specific to the Audit module.
- F. Remediation is a task type used in the Risk and Compliance modules to address identified issues, not specific to Audit work.
Question 26
Santa Clara Facility and Boston Facility are examples of what?
Show answer and explanation
Correct answer: A. Entities
Santa Clara Facility and Boston Facility are specific instances of facilities within an organization. These are individual entities, concrete examples of distinct organizational units that can be scoped to various GRC items. Entity is the correct term for these specific instances.
Why the other options are wrong
- B. Entity Object is not the standard terminology; the correct term is Entity.
- C. Entity Class refers to the category or type definition (e.g., Facility as a class), not the specific instances themselves.
- D. Entity Type refers to the classification level (Facility type), not the individual instances like Santa Clara Facility.
Question 27
Which table stored the links from Entity to Entity Types?
Show answer and explanation
Correct answer: D. [sn_grc_m2m_profile_profile_type]
The table [sn_grc_m2m_profile_profile_type] is the many-to-many junction table used in ServiceNow GRC to store the relationships between Profiles (Entities) and Profile Types (Entity Types). This follows ServiceNow's naming convention where m2m indicates a many-to-many relationship table, and the grc prefix identifies it as part of the GRC module.
Why the other options are wrong
- A. This table references compliance and profile types but uses the compliance-specific prefix rather than the core GRC prefix.
- B. This table links risks to profiles, not profiles to profile types.
- C. This table links policies to profiles, which is a different relationship than entity-to-entity type mapping.
Question 28
Controls are generated from a Control Objective when what is applied to it?
Show answer and explanation
Correct answer: D. Entity Type
Controls are generated from a Control Objective when an Entity Type is applied to it. The Entity Type serves as a classifier that defines how the control objective maps to specific entities within the system, enabling the system to create appropriate control instances. This classification is essential for controlling where and how controls are implemented across the GRC application.
Why the other options are wrong
- A. Policy provides governance guidance but does not directly generate controls from control objectives.
- B. Citation refers to references or sources of information, not a mechanism for generating controls.
- C. An Indicator template is used for monitoring and assessment purposes, not for generating controls from objectives.
Question 29
What are the terms for level of risk before and after any actions are taken? (Choose two.)
Show answer and explanation
Correct answer: C, E. Inherent risk; Residual risk
Inherent risk is the level of risk that exists before any mitigation actions or controls are applied, representing the natural or baseline risk exposure. Residual risk is the level of risk that remains after mitigation actions, controls, or other risk responses have been implemented, representing the remaining exposure.
Why the other options are wrong
- A. Operational risk refers to risk from internal processes and operations, not a phase of risk assessment.
- B. Digital risk relates to cybersecurity and digital threats specifically, not a phase descriptor.
- D. Calculated risk is not a standard GRC terminology term for risk phases.
- F. Solutioned risk is not recognized terminology in the GRC framework for describing risk levels.
Question 30
What is the minimum role required for creating a policy acknowledgement campaign?
Show answer and explanation
Correct answer: B. sn_compliance.user
The minimum role required for creating a policy acknowledgement campaign is sn_compliance.user. This role provides the necessary permissions to design and deploy acknowledgement campaigns within the compliance module without requiring full administrative privileges.
Why the other options are wrong
- A. The sn_risk.user role is for risk management; policy acknowledgement campaigns are compliance-related.
- C. The sn_compliance.admin role exceeds the minimum requirement; sn_compliance.user is sufficient.
- D. The sn_compliance.manager role is not the minimum; a basic user role provides the necessary access.
- E. The sn_control.owner role is for control ownership; it does not provide policy acknowledgement campaign creation permissions.
Question 31
What three records need to be set-up when integrating with a provider RSS feed? (Choose three.)
Show answer and explanation
Correct answer: A, B, D. Feed sources record; Provider record; Connection and Credentials record
When integrating with a provider RSS feed, three records must be set up: Feed sources record (to define the RSS feed source), Provider record (to identify the regulatory or compliance provider), and Connection and Credentials record (to authenticate and establish the connection to the feed). These three components work together to enable the RSS feed integration.
Why the other options are wrong
- C. Regulatory Feed record is not a required setup record for RSS provider integration.
- E. Regulatory Change Task record is generated as an output after feed integration, not a prerequisite setup record.
Question 32
Possible regulations when Entity scoping for Healthcare: (Choose two.)
Show answer and explanation
Correct answer: A, C. HITRUST; HIPAA
When scoping entities in the healthcare sector, HITRUST and HIPAA are the primary regulations encountered. HITRUST is a comprehensive security framework specifically designed for healthcare organizations, while HIPAA is the foundational U.S. regulation governing protected health information privacy and security.
Why the other options are wrong
- B. FISMA (Federal Information Security Management Act) applies to U.S. federal government systems and agencies, not healthcare sector entities.
- D. HETRUST is not a recognized healthcare regulation or compliance framework; this appears to be a distractor option.
Question 33
Which of the following statements is true of a Risk Response task?
Show answer and explanation
Correct answer: D. The Risk Response task is automatically progressed through the states using a workflow
Risk Response tasks are automatically progressed through their states using a workflow mechanism within ServiceNow GRC. This automation ensures consistent state transitions and reduces manual administrative overhead. Multiple Risk Response tasks can be related to a single risk, assignment does not require the risk_manager role exclusively, and the risk admin role is not the sole requirement for assignment.
Why the other options are wrong
- A. Multiple Risk Response tasks can be related to a single Risk simultaneously.
- B. Risk Response task assignment is not restricted to users with only the risk_manager role or higher.
- C. The risk admin role is not required as the sole means to assign a Risk Response task.
Question 34
How does GRC: Policy and Compliance Management track compliance to Authority Documents?
Show answer and explanation
Correct answer: D. Citations are mapped to control objectives, and compliance is checked when controls are tested as compliant or non-compliant.
GRC: Policy and Compliance Management tracks compliance to Authority Documents by mapping citations from those documents to control objectives. Compliance is then verified by testing the controls associated with those objectives and marking them as compliant or non-compliant based on the test results. This approach ensures direct linkage between regulatory requirements and control effectiveness.
Why the other options are wrong
- A. Citations are mapped to control objectives, not directly to entity-scoped controls.
- B. Authority Documents are mapped to control objectives, not to individual policies.
- C. Authority Documents are mapped to control objectives through citations, with compliance checked via control testing, not via policy marking.
Question 35
A control objective has been related to a risk statement and they've been scoped with the same entity type. What can we expect to occur?
Show answer and explanation
Correct answer: B. A control for this control objective, with a matching entity, will be related to the registered risk for this risk statement as a mitigating control.
When a control objective and risk statement are related with the same entity type scoping, the system creates a linkage between a control (instantiated from that control objective with a matching entity) and the registered risk as a mitigating control. This establishes the control as a mitigation mechanism for the risk without automatically changing risk states or scores; rather, it documents the relationship for evaluation purposes.
Why the other options are wrong
- A. Risks do not automatically revert to Review state simply because a control objective is linked; state changes require explicit action.
- C. Linking a control objective to a risk does not automatically mark the control objective as compliant; compliance is determined through testing and assessment results.
- D. Risk scores do not automatically decrease; score changes require manual updates or recalculation based on assessment results, not just the presence of mitigating controls.
Question 36
There is a direct relationship between Entity Class and Entity Type when:
Show answer and explanation
Correct answer: B. There is no direct relationship
Entity Class and Entity Type do not have a direct relationship in GRC systems. Entity Class defines the classification or categorization of entities themselves, while Entity Type defines groupings of entities for risk and control purposes. They operate independently and serve different functions in the GRC framework.
Why the other options are wrong
- A. Entity Classes and Entity Types are separate constructs that do not need to share the same Entity Types.
- C. While both may reference entities, sharing entities does not establish a direct structural relationship between the two.
- D. Shared reporting capabilities do not constitute a direct relationship between Entity Class and Entity Type.
Question 37
What is the condition that must exist to edit the factor guidance of a published risk assessment methodology (RAM)?
Show answer and explanation
Correct answer: C. All assessment instance records are deleted
To edit the factor guidance of a published risk assessment methodology (RAM), all assessment instance records must be deleted. This ensures no active or historical instances reference the methodology being modified, preventing inconsistencies and maintaining data integrity.
Why the other options are wrong
- A. Assessment instances in Monitor state still exist and reference the methodology, preventing modifications.
- B. Closed instances still exist in the system and may be referenced; deletion is the required condition.
- D. States of assessment instances are absolutely relevant; they must all be removed before editing published methodology.
- E. Canceled instances still exist in the system; complete deletion is required for factor guidance edits.
Question 38
Which role(s) has the capability to create Policies? Choose two.)
Show answer and explanation
Correct answer: A, B. Compliance Manager; Compliance admin
In ServiceNow Policy and Compliance, the Compliance Manager and Compliance Admin roles have write access to policies, so they can create them. Compliance Users mainly respond to and read compliance records.
Why the other options are wrong
- C. Compliance User is a lower-privilege role that cannot create policies.
- D. Risk Manager is a Risk Management role and does not grant rights to create policies.
Question 39
To allow other applications to request a policy exception, you must complete the integration registry form. In addition to providing the name of the registry entry, what additional information is needed to complete the form?
Show answer and explanation
Correct answer: C. You must indicate the policy exception target table
To allow other applications to request a policy exception through the integration registry form, you must provide the registry entry name and specify the policy exception target table. The target table is essential as it defines where the policy exception requests will be stored and processed.
Why the other options are wrong
- A. The audience for policy exceptions is not specified in the integration registry form; permissions are controlled separately.
- B. The Service Portal is not a required field in the integration registry form for policy exception requests.
- D. Policy acknowledgement campaigns are not related to the integration registry form for policy exception requests.
Question 40
Which of the following extends from Content Table? (Choose two.)
Show answer and explanation
Correct answer: A, C. Citation; Control Objective
Citation and Control Objective are the two records that extend from the Content table in ServiceNow's GRC module. Both of these record types inherit properties and structures from the parent Content table, allowing them to be organized and managed within the broader content management framework.
Why the other options are wrong
- B. Policy has its own parent table relationship and does not directly extend from the Content table.
- D. Authority Document maintains a separate table relationship and does not extend from the Content table.
Question 41
The ‘Add to Update Set’ utility is available for download via:
Show answer and explanation
Correct answer: A. ServiceNow Developer site
The 'Add to Update Set' utility is available for download through the ServiceNow Developer site, which hosts community-contributed tools, scripts, and utilities designed to enhance ServiceNow development and administration capabilities.
Why the other options are wrong
- B. The ServiceNow Store is for official ServiceNow applications and plugins, not developer utilities.
- C. ServiceNow Community is a discussion and knowledge-sharing forum, not a download repository for tools.
- D. ServiceNow HI (Health Insights) support does not distribute development utilities.
Question 42
The consolidated assessment feature can be used on which of the following? (Choose two.)
Show answer and explanation
Correct answer: B, D. Classic risk assessments; Control attestations
The consolidated assessment feature is used on classic risk assessments and control attestations. This feature enables the aggregation and consolidation of assessment data from multiple sources, providing a unified view of assessment results and facilitating reporting and analysis of attestation and risk assessment outcomes.
Why the other options are wrong
- A. Control tests are not a valid target for the consolidated assessment feature in this context.
- C. Issues do not support the consolidated assessment feature as part of the advanced risk assessment functionality.
Question 43
What mapping capability in the Classic UI allows customers to relate specific Entities to each other within an Entity Class?
Show answer and explanation
Correct answer: C. GRC Workbench Dependency Map
The GRC Workbench Dependency Map is the Classic UI feature that allows customers to relate specific Entities to each other within an Entity Class. This mapping capability enables visualization and management of dependencies and relationships between entities in the GRC framework.
Why the other options are wrong
- A. Entity Class Mapper is not the standard name for this GRC mapping feature.
- B. Entity Workbench does not specifically provide entity relationship mapping capabilities.
- D. GRC Entity Mapper is not the correct name for the Classic UI dependency mapping tool.
Question 44
What assessment types can be enabled when configuring a risk assessment methodology (RAM)? (Choose three.)
Show answer and explanation
Correct answer: C, D, E. Residual Assessment; Inherent Assessment; Control Assessment
When configuring a Risk Assessment Methodology (RAM), three assessment types can be enabled: Residual Assessment (measuring risk after controls), Inherent Assessment (measuring risk before controls), and Control Assessment (evaluating the effectiveness of controls). Operational, Application, and Project Risk Assessments are specific risk domains rather than assessment type configurations within RAM setup.
Why the other options are wrong
- A. Operational Risk Assessment is a risk domain, not an assessment type configuration option in RAM.
- B. Application Risk Assessment is a risk domain, not an assessment type configuration option in RAM.
- F. Project Risk Assessment is a risk domain, not an assessment type configuration option in RAM.
Question 45
The overall goal of Entity Classes is to:
Show answer and explanation
Correct answer: A. To enable reporting and to support advanced risk assessment
The overall goal of Entity Classes is to enable reporting and support advanced risk assessment. Entity Classes provide a framework for categorizing and organizing entities within the system, which enhances the ability to generate meaningful reports and conduct sophisticated risk assessments across different entity types.
Why the other options are wrong
- B. While Entity Classes relate to entities, they do not directly map entities to policies and Citations in the manner described.
- C. Associating Control Objectives and Risk Statements is done through Control and Risk objects, not primarily through Entity Classes.
- D. Providing specific ownership information about entities is a function of entity records themselves, not the primary goal of Entity Classes.
Question 46
Which of the following are the classic risk score types that ServiceNow tracks? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. Residual; Inherent; Calculated
The classic risk score types that ServiceNow tracks are Residual, Inherent, and Calculated. Residual risk is the risk remaining after controls are applied, Inherent risk is the baseline risk before controls, and Calculated risk is derived through assessment methodologies. Operational and Digital are not standard classic risk score types.
Why the other options are wrong
- D. Operational is not a standard risk score type in ServiceNow's classic risk assessment framework.
- E. Digital is not a recognized risk score type in the classic risk assessment methodology.
Question 47
What would you leverage in order to provide users with an alternate user experience to view policies, create policy exceptions, and search for controls?
Show answer and explanation
Correct answer: D. Service Portal
The Service Portal provides users with an alternate, streamlined user experience specifically designed for policy viewing, policy exception creation, and control searching. It offers a more accessible interface tailored for end-users who need to interact with governance and compliance functions without requiring full application access.
Why the other options are wrong
- A. Help Desk Portal is focused on incident and request management, not policy and control management.
- B. Catalog Portal is designed for service catalog requests and fulfillment, not compliance activities.
- C. Access Portal is used for access request and identity management workflows, not policy and control management.
Question 48
Which of the following records does not have a lifecycle?
Show answer and explanation
Correct answer: A. Control Objective
Control Objective records do not have a lifecycle state progression. Policy, Policy Exception, and Control records all have defined lifecycle states (such as Draft, Active, Retired, etc.) that track their progression through organizational workflows. Control Objectives serve as static reference structures that map risks to controls without requiring state transitions.
Why the other options are wrong
- B. Policy records have a lifecycle with states such as Draft, Published, Retired, and Superseded.
- C. Policy Exception records have a lifecycle including states like Requested, Approved, Active, and Expired.
- D. Control records have a lifecycle with states such as Design, Tested, Active, and Inactive.
Question 49
Which role is not part of ServiceNow GRC?
Show answer and explanation
Correct answer: B. Risk Developer
Risk Developer is not a standard role within the ServiceNow GRC module. The GRC application includes roles such as Risk User, Risk Manager, and Risk Reader, which align with standard governance, risk, and compliance operational needs. Developer roles exist in ServiceNow but are not part of the GRC-specific role set.
Why the other options are wrong
- A. Risk User is a valid GRC role for users who interact with risk management features.
- C. Risk Manager is a core GRC role responsible for managing risks and related tasks.
- D. Risk Reader is a valid GRC role that provides read-only access to risk information.
Question 50
Critical parts of a successful GRC implementation are understanding the customers current: (Choose three.)
Show answer and explanation
Correct answer: A, C, E. Regulatory requirements; GRC processes; Audit failures
A successful GRC implementation requires understanding the customer's current regulatory requirements (compliance obligations), GRC processes (existing workflows and governance structures), and audit failures (past issues and deficiencies). Understanding risk and compliance personas (B) is useful but not critical to implementation, and data breaches (D) are historical security incidents rather than essential implementation knowledge.
Why the other options are wrong
- B. While personas inform stakeholder engagement, they are not critical implementation prerequisites.
- D. Specific data breaches are incident history, not essential implementation context.
Question 51
Service Level Agreements can be used for the which of the following? (Choose two.)
Show answer and explanation
Correct answer: A, D. Risk Issues; Risk Response Task
Service Level Agreements are used to define expected performance for Risk Issues (specific instances of identified risks) and Risk Response Tasks (actions taken to mitigate or manage risks). SLAs establish response times, resolution times, and performance metrics for both the issues themselves and the tasks assigned to address them. Risk, Risk Statement, and Risk Framework are broader concepts that guide risk management strategy rather than operational performance targets.
Why the other options are wrong
- B. Risk as a general concept is not something an SLA directly targets; SLAs address specific operational responses to risk.
- C. A Risk Statement is documentation of risk, not an operational entity that would have service level performance targets.
- E. A Risk Framework is a strategic structure for managing risk, not an operational deliverable that would be governed by SLAs.
Question 52
What are the four values leveraged for the Inherent and Residual Risk Score Types?
Show answer and explanation
Correct answer: D. Impact, Likelihood, SLE, ARO
The four values leveraged for calculating Inherent and Residual Risk Scores are Impact, Likelihood, SLE (Single Loss Expectancy), and ARO (Annualized Rate of Occurrence). These metrics form the foundational calculation methodology for risk quantification in ServiceNow GRC, allowing organizations to assess both potential impact and frequency of risk events.
Why the other options are wrong
- A. SLE and ARO are correct, but Probability is not the standard terminology used; Likelihood is the correct term.
- B. ALE (Annualized Loss Expectancy) is not one of the four core values used in this calculation method.
- C. Score is not a foundational value; it is the output calculated from the other metrics, not an input.
Question 53
Which of the following is the correct statement about Risk Scoring formulas?
Show answer and explanation
Correct answer: A. SLE × ARO = ALE
The correct risk scoring formula is SLE × ARO = ALE, where Single Loss Expectancy multiplied by Annual Rate of Occurrence equals Annual Loss Expectancy. This is the standard risk quantification formula used in information security and risk management to calculate expected annual losses from a particular risk.
Why the other options are wrong
- B. ALE is not multiplied by ARO; ARO is already a component of the ALE calculation.
- C. This reverses the correct formula; ALE results from SLE × ARO, not the other way around.
- D. Impact × Urgency relates to prioritization matrices, not the standard risk scoring formula.
Question 54
The content table (sn_grcs_content) is a parent table of:
Show answer and explanation
Correct answer: C. sn_risk_definition
The content table (sn_grcs_content) serves as a parent table to sn_risk_definition. Risk definitions extend from the content table, establishing the hierarchical relationship needed for organizing risk-related information in the GRC system.
Why the other options are wrong
- A. sn_grc_profile has a different parent table relationship within the GRC module structure.
- B. sn_risk_framework maintains its own parent table relationship independent of sn_grcs_content.
- D. sn_risk_risk does not extend from the content table; it has its own separate parent relationship.
Question 55
Where does a policy get published to when it is approved?
Show answer and explanation
Correct answer: D. Knowledge Base
When a policy is approved in ServiceNow GRC, it is published to the Knowledge Base. This makes the approved policy accessible to users across the organization and establishes it as an authoritative reference document for compliance and governance purposes.
Why the other options are wrong
- A. Knowledge Summit is not a standard ServiceNow publishing destination for approved policies.
- B. ServiceNow Library is not the target repository for published policy documents.
- C. While Authoritative Records may reference policies, the Knowledge Base is the primary publishing destination for approved policies.
Question 56
On which records is the entity a required field? (Choose two.)
Show answer and explanation
Correct answer: A, B. Risk; Control
Entity is a required field on both Risk and Control records. These records must be associated with an entity to provide organizational context and ensure proper governance tracking. Without an entity assignment, risk and control records cannot be effectively managed, reported, or linked to organizational stakeholders.
Why the other options are wrong
- C. Policy records do not require an entity field; policies are organizational-level documents.
- D. Control objective records do not mandate an entity field as they operate at a framework level.
- E. Risk statement records do not have entity as a required field in standard configurations.
Question 57
The ServiceNow Platform requires which external components in order to ingest data from other systems?
Show answer and explanation
Correct answer: D. The platform has Integration Service that allow users and developers to ingest data from a variety of sources
The ServiceNow Platform includes Integration Hub and Integration Service capabilities that allow users and developers to ingest data from a variety of external sources without requiring external components. These built-in integration services handle the necessary data mapping and transformation across different formats and systems.
Why the other options are wrong
- A. While ServiceNow supports Java development, the platform does not require an external SDK template as a prerequisite for data ingestion.
- B. ServiceNow does not require developers to build an external messaging bus; integration is handled through platform services.
- C. Although ServiceNow can process XML data, it does not require developers to manually leverage XSLT for mapping, the platform handles this internally.
Question 58
Which feature would you use to track completion of certain tasks?
Show answer and explanation
Correct answer: B. SLAs
Service Level Agreements (SLAs) are the feature used to track completion of certain tasks. SLAs define expected timeframes and conditions for task completion, monitor progress against these targets, and provide visibility into whether tasks are being completed as required.
Why the other options are wrong
- A. Related Lists display connected records but do not actively track task completion status.
- C. Workflow Editor creates and defines workflows but is not the primary mechanism for tracking completion of individual tasks.
- D. Notifications alert users about events and changes but do not inherently track task completion.
Question 59
Which of the following are ServiceNow classic risk score types? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Calculated; Inherent; Residual
The three classic risk score types in ServiceNow GRC are Calculated (derived from frequency and impact formulas), Inherent (baseline risk before controls), and Residual (remaining risk after controls are applied). Applied and Generated are not standard risk score type classifications in the classic GRC model.
Why the other options are wrong
- A. Applied is not a standard classic risk score type.
- D. Generated is not a standard classic risk score type classification.
Question 60
Control indicators may be triggered or scheduled in which state?
Show answer and explanation
Correct answer: B. Monitor
Control indicators are triggered or scheduled while a control is in the Monitor state. This is the active state where controls are being executed and their performance is being tracked through indicators. The Monitor state is specifically designed to support ongoing measurement and assessment of control effectiveness.
Why the other options are wrong
- A. Retired controls are no longer active and do not trigger or schedule indicators.
- C. Review is a state for periodic assessment, not for ongoing indicator triggering.
- D. Attest is a state for formal confirmation or sign-off, not for indicator scheduling.
- E. Draft is a preliminary state before a control is activated for monitoring.
Question 61
Which of the following tables are within the GRC: Policy and Compliance Management application scope? (Choose two.)
Show answer and explanation
Correct answer: A, C. Authority Document; Policy Exception
Authority Document and Policy Exception are both within the scope of the GRC: Policy and Compliance Management application. These tables directly support policy governance and exception management workflows.
Why the other options are wrong
- B. Assessment is part of the Risk Assessment Management application scope, not Policy and Compliance Management.
- D. Audit Task belongs to the Audit Management application scope, separate from Policy and Compliance Management.
Question 62
Which feature of classic risk scoring is frequently configured by customers?
Show answer and explanation
Correct answer: B. Risk Criteria Matrix
The Risk Criteria Matrix is the feature of classic risk scoring that is most frequently configured by customers. This matrix allows organizations to define risk levels based on combinations of likelihood and impact, providing a customizable framework for consistent risk assessment across the enterprise.
Why the other options are wrong
- A. Annualized Loss Expectancy is a calculation method but not the most commonly configured feature by customers.
- C. Control Failure Factor is a technical parameter used in risk calculations but not typically a primary configuration focus.
- D. Indicator Failure Factor is similarly a technical input rather than a primary configuration element for most organizations.
Question 63
In addition to continuous monitoring with indicators, customers can continuously monitor controls using the application, Configuration Compliance. For entities and controls to be created after associating a control objective and configuration test what needs to happen? (Choose two.)
Show answer and explanation
Correct answer: B, C. You must set the property sn_compliance.auto_create_profile_and_Control to true; You must confirm the “Create Controls Automatically” checkbox is checked on the Control Objective record
To enable automatic entity and control creation when associating a control objective with a configuration test in Configuration Compliance, the 'Create Controls Automatically' checkbox must be checked on the Control Objective record, and the system property sn_compliance.auto_create_profile_and_Control must be set to true. Both conditions are required for automatic control generation to function.
Why the other options are wrong
- A. The sn_compliance.cal_score_by_weighted_control property relates to scoring calculations, not automatic control creation.
- D. Updating PA Relationships is not a prerequisite for automatic control and entity creation in Configuration Compliance.
Question 64
Which of the following tables exist within the GRC: Profiles application scope? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. sn_grc_profile_type; sn_grc_indicator; sn_grc_profile_class
The GRC: Profiles application scope contains the tables sn_grc_profile_type (for profile type definitions), sn_grc_indicator (for profile indicators), and sn_grc_profile_class (for profile class configurations). These tables are specifically designed to support the Profiles application functionality. The compliance policy statement and risk definition tables belong to different application scopes within the GRC suite.
Why the other options are wrong
- C. sn_grc_compliance_policy_statement is part of the Policy and Compliance Management scope, not Profiles.
- D. sn_grc_risk_definition is part of the Risk Management scope, not Profiles.
Question 65
Which collection of tables extend the Item (sn_grc_item) table? (Choose two.)
Show answer and explanation
Correct answer: A, D. Risk; Control
Both Risk and Control tables extend the Item (sn_grc_item) base table. This extension allows risks and controls to inherit common item properties and behaviors while maintaining their specialized characteristics. Risk and Control are primary GRC object types that build upon the Item table foundation.
Why the other options are wrong
- B. Citation does not extend the Item table; citations are reference entities with a different structure.
- C. Policy does not extend the Item table; policies have their own distinct table structure separate from the Item hierarchy.
Question 66
Which filter navigation syntax displays the table in list view within a separate browser tab?
Show answer and explanation
Correct answer: C. Tablename.LIST
The correct ServiceNow filter navigation syntax to display a table in list view within a separate browser tab is Tablename.LIST, using uppercase for the LIST segment. This syntax follows ServiceNow's navigation framework conventions for accessing list views.
Why the other options are wrong
- A. Tablename_LIST uses an underscore rather than dot notation and does not properly conform to ServiceNow navigation syntax.
- B. Tablename.list uses lowercase, which does not match the required uppercase convention for this navigation syntax.
- D. Tablename.List uses mixed case, which does not conform to ServiceNow's uppercase requirement for the LIST segment.
Question 67
In which state is the Policy once all approvals are received?
Show answer and explanation
Correct answer: B. Published
Once all approvals are received, a Policy transitions to Published state. This indicates that the policy has completed its approval workflow and is now active and effective for use. Published policies are the official, approved versions that govern organizational processes and are binding on users.
Why the other options are wrong
- A. Review is a stage during the approval process, not the final state after all approvals.
- C. Draft is the initial state before approvals are submitted; a policy cannot return to Draft once approvals are completed.
- D. Retired indicates a policy that has been deactivated and is no longer in use.
- E. Awaiting Approval is a stage during the approval process, not the state after approvals are complete.
Question 68
What happens when you assign an Entity Type to a Risk Statement?
Show answer and explanation
Correct answer: C. A risk is automatically generated for every Entity listed in the Entity Type
When you assign an Entity Type to a Risk Statement, the system automatically generates a separate risk record for each individual Entity that belongs to that Entity Type. This enables risk management at the entity level, allowing organizations to track and manage risks across multiple instances of a particular entity category.
Why the other options are wrong
- A. Assessments are not automatically generated; risks are generated instead.
- B. Risk assessments are not created; individual risks are created for each entity.
- D. Entity Type assignment does not automatically establish risk scores or control ties at the Entity Type level itself.
Question 69
Which tables extend the Content (sn_grc_content) table? (Choose two.)
Show answer and explanation
Correct answer: A, C. sn_compliance_citation; sn_compliance_policy_statement
The sn_compliance_citation and sn_compliance_policy_statement tables both extend from the Content (sn_grc_content) table. This inheritance allows these compliance-related records to inherit content management properties and maintain consistent data structures across the compliance domain.
Why the other options are wrong
- B. sn_grc_issue does not extend from the Content table; it has a separate parent structure.
- D. sn_risk_risk does not extend from the Content table; risk records inherit from different parent tables.
Question 70
For advanced risk assessment, risk response can be handled in the following ways: (Choose two.)
Show answer and explanation
Correct answer: A, B. Create multiple risk response tasks; Skipped entirely based on attributes defined in the RAM
Risk response can be handled by creating multiple risk response tasks to address different aspects of a single risk, or it can be skipped entirely if the risk attributes defined in the RAM (Risk Assessment Methodology) indicate that no response is necessary. Options C and D are incorrect because risk response is not mandatory, it depends on the risk assessment outcome and organizational decisions.
Why the other options are wrong
- C. Risk response is not always mandatory; it depends on the risk evaluation and organizational choices.
- D. Creating at least one risk response task is not required; risks can be accepted or skipped based on RAM attributes.
Question 71
For classic risk assessment, while a Risk is in the Assess state, reviewers can do which of the following? (Choose two.)
Show answer and explanation
Correct answer: A, D. Answer the assessment, moving the Risk to Respond; Set the Risk back to Draft
While a Risk is in the Assess state, reviewers can answer the assessment which moves the Risk to the Respond state, and they can also set the Risk back to Draft if needed for revision. Moving to Monitor (option B) is not a direct action from Assess, and deleting a Risk in Assess state (option C) is not permitted during active assessment.
Why the other options are wrong
- B. Setting to Monitor is not an available action while in Assess state; Monitor is reached through different workflow paths.
- C. Deleting a Risk during active assessment in Assess state is not permitted; risks must complete their workflow before deletion.
Question 72
The Calculated Risk Score utilizes data from the Inherent and Residual Risk scores to determine an adjusted ALE and Score. What other data drives the adjustments?
Show answer and explanation
Correct answer: D. Control and Indicator Failure Factors
The Calculated Risk Score uses Inherent and Residual Risk scores along with Control and Indicator Failure Factors to adjust the ALE and overall risk score. These failure factors measure the effectiveness of controls and leading indicators, directly impacting how much the residual score differs from the inherent score. Audit Scores, Attestation Scores, and Configuration Test Scores do not drive these specific score calculations.
Why the other options are wrong
- A. Audit Scores measure audit findings but are not direct inputs to the Calculated Risk Score formula.
- B. Attestation Score reflects management assertions but does not factor into the ALE and risk score adjustment.
- C. Configuration Test Score relates to control testing but is not the mechanism for risk score adjustment.
That was 72 of 289.
The full ServiceNow CIS-RC pack has all 289 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 139 free as one PDF by email. Get the Half Pack →