10 free ServiceNow CIS-VR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 132 questions. Work through them, then open each answer to check your reasoning.
Get all 132 questions (US$39) · Download these 10 as a PDF
Question 1
Select the three components of a Filter Condition: (Choose three.)
Show answer and explanation
Correct answer: A, C, D
A. Field C. Operator D. Value A Filter Condition in ServiceNow consists of three essential components: the Field (what attribute to filter on), the Operator (how to compare the field value), and the Value (what to compare against). These three elements work together to create a logical filtering rule. Sum is a mathematical aggregation function and is not a component of a filter condition structure.
Why the other options are wrong
- B. Sum is an aggregation function used in reporting and calculations, not a filter condition component.
Question 2
SLAs are used to ensure VUL are processed in a timely matter.
Which field is used to determine the expected timeframe for remediating a VIT?
Show answer and explanation
Correct answer: C. Remediation target
The Remediation target field is used to determine the expected timeframe for remediating a vulnerability. This field sets the deadline or target date by which remediation should be completed according to the SLA. Updated tracks when changes occurred, Remediation status indicates the current state of remediation work, and Closed indicates completion, none of these define the expected timeframe for remediation.
Why the other options are wrong
- A. Updated tracks when records were modified, not the expected remediation timeframe.
- B. Remediation status shows current progress but does not define the expected timeframe.
- D. Closed indicates when work is finished, not when it should be completed by.
Question 3
What is the minimum role required to create and change Service Level Agreements for Vulnerability Response groups?
Show answer and explanation
Correct answer: D. sn_vul.admin
The sn_vul.admin role is the minimum role required to create and change Service Level Agreements for Vulnerability Response groups. This role provides the necessary administrative privileges specific to the Vulnerability Response module. While admin is a global administrative role that could perform this function, sn_vul.admin is the appropriate specialized role. The sla_manager role manages SLAs in general but not specifically for Vulnerability Response, and sn_vul.vulnerability_write is for writing vulnerability records, not managing SLAs.
Why the other options are wrong
- A. sla_manager handles general SLA management but not specifically for Vulnerability Response groups.
- B. admin is overly broad; the specific sn_vul.admin role is the minimum required.
- C. sn_vul.vulnerability_write allows writing vulnerability records, not creating or changing SLAs.
Question 4
Changes made within a named Update Set in a different application scope:
Show answer and explanation
Correct answer: C. Will not be captured
Changes made within a named Update Set in a different application scope will not be captured. Update Sets only capture changes within their defined application scope. When working outside the intended scope, the system does not record those modifications in the Update Set, preventing unintended or out-of-scope changes from being included.
Why the other options are wrong
- A. Changes in different scopes are explicitly not captured by the Update Set.
- B. The system does not throw errors; it simply does not capture out-of-scope changes.
- D. Out-of-scope changes are not partially captured; they are completely excluded.
Question 5
ServiceNow Vulnerability Response tables typically start with which prefix?
Show answer and explanation
Correct answer: D. sn_vul_
ServiceNow Vulnerability Response tables use the sn_vul_ prefix for their table names. This standardized naming convention is used throughout the Vulnerability Response module to organize and identify all related tables. The other options represent different naming schemes that are not used for the core Vulnerability Response tables.
Why the other options are wrong
- A. snvr_ is not the standard prefix used in ServiceNow Vulnerability Response.
- B. snvuln_ is not the correct prefix for Vulnerability Response tables.
- C. vul_ is too generic and not the official ServiceNow Vulnerability Response prefix.
Question 6
In regard to the Security Operations Process, which of the following statements defines the “Identify” phase?
Show answer and explanation
Correct answer: A. What processes and assets need protection?
The Identify phase of the Security Operations Process defines what processes and assets need protection. This phase focuses on discovery and prioritization of organizational assets and systems that require security safeguards. Techniques for identifying incidents belong to Detection, safeguards are part of Protection, restoration is part of Recovery, and impact containment relates to Response.
Why the other options are wrong
- B. Identifying incidents is part of the Detection phase, not Identify.
- C. Determining available safeguards is part of the Protection phase.
- D. Restoring capabilities is part of the Recovery phase.
- E. Containing impacts is part of the Response phase.
Question 7
Which module is used to adjust the frequency in which CVEs are updated?
Show answer and explanation
Correct answer: A. NVD Auto-update
The NVD Auto-update module is used to adjust the frequency in which CVEs are updated. This module manages the automated synchronization with the National Vulnerability Database to ensure vulnerability data is current according to the configured schedule. The other options do not represent actual ServiceNow modules for managing CVE update frequency.
Why the other options are wrong
- B. Update is too generic and not the specific module for CVE frequency adjustment.
- C. CVE Auto-update is not the correct module name in ServiceNow.
- D. On-demand update refers to manual updates, not frequency adjustment.
Question 8
A list of software weaknesses is known as:
Show answer and explanation
Correct answer: D. Common Weaknesses Enumeration (CWE)
Common Weaknesses Enumeration (CWE) is a list of software weaknesses. CWE provides a standardized categorization of software security flaws and weaknesses that can lead to vulnerabilities. The NVD is a database of vulnerabilities themselves, CVE is an identifier for specific vulnerabilities, and NIST is an organization that develops security standards, none of which define a list of weaknesses.
Why the other options are wrong
- A. NVD is a database of known vulnerabilities, not a list of weaknesses.
- B. CVE is an identifier for specific vulnerabilities, not a categorization of weaknesses.
- C. NIST is an organization that develops standards, not a list of software weaknesses.
Question 9
Vulnerability Response can be best categorized as a ____________, focused on identifying and remediating vulnerabilities as early as possible.
Show answer and explanation
Correct answer: A. A proactive process
Vulnerability Response is categorized as a proactive process because it focuses on identifying and remediating vulnerabilities as early as possible, rather than waiting for vulnerabilities to be exploited. This early identification and remediation approach is the hallmark of proactive security measures.
Why the other options are wrong
- B. While vulnerability management involves iteration, the defining characteristic emphasized in the question is the early identification and remediation, which is fundamentally proactive rather than iterative.
- C. Tentative processes are uncertain or provisional in nature, whereas vulnerability response is a deliberate, structured approach with clear objectives.
- D. Reactive processes respond after an event has occurred; vulnerability response aims to prevent exploitation by addressing issues before they become problems.
Question 10
If a customer expects to ingest 2 million vulnerabilities during its initial load, which instance size should you recommend?
Show answer and explanation
Correct answer: C. XXL
For ingesting 2 million vulnerabilities during initial load, the XXL instance size is recommended to handle the large volume of data being processed. This size provides sufficient computational resources, memory, and storage capacity to manage such a substantial initial data ingestion without performance degradation.
Why the other options are wrong
- A. L instance size lacks the capacity to efficiently handle 2 million vulnerabilities during initial load.
- B. XL instance size is intermediate but insufficient for managing 2 million vulnerabilities in an initial load scenario.
- D. Ultra size, while larger, is unnecessary for this volume and represents ove-rovisioning of resources.
That was 10 of 132.
The full ServiceNow CIS-VR pack has all 132 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.