33 free ServiceNow CIS-VR practice questions from the CertStash pack of 132, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 33 free here, all 132 in the pack, and each step includes the one before it.
Get all 132 questions (US$39) · Download the first 10 as a PDF
Question 1
Which of the following provides a list of software weaknesses?
Show answer and explanation
Correct answer: C. CWE
CWE (Common Weakness Enumeration) is the authoritative list of software weaknesses maintained by MITRE. It provides a comprehensive, community-developed catalog of common software and hardware weaknesses with descriptions, relationships, and consequences. While NVD references vulnerabilities, CWE specifically catalogs the underlying weaknesses that enable those vulnerabilities.
Why the other options are wrong
- A. Third Party Entries is not a recognized standard database for software weaknesses.
- B. NVD (National Vulnerability Database) is a database of vulnerabilities, not weaknesses, though it references CWE.
- D. Vulnerable Items is not a recognized standard catalog or database of weaknesses.
Question 2
Filter Groups provide a way to:
Show answer and explanation
Correct answer: D. All of the above
Filter Groups in ServiceNow provide all three capabilities: they decouple grouping use from definition, allow building criteria once, and enable reusing those criteria across multiple places. This abstraction layer provides flexibility and consistency throughout the system.
Why the other options are wrong
- A. While this is one benefit, it is not the complete answer.
- B. While this is one benefit, it is not the complete answer.
- C. While this is one benefit, it is not the complete answer.
Question 3
Which module within the Vulnerability Response application could be used to get information from the National Vulnerability Database (NVD) at any moment?
Show answer and explanation
Correct answer: A. On-Demand Update
The On-Demand Update module within Vulnerability Response allows administrators to retrieve information from the National Vulnerability Database at any time according to their needs, rather than relying solely on scheduled automatic updates. This provides flexibility for immediate data synchronization when required.
Why the other options are wrong
- B. NVD Auto-Update performs scheduled automatic updates, not on-demand retrieval.
- C. Vulnerable Software is for managing software inventory, not for retrieving NVD data.
- D. NVD Patch is not a recognized module within Vulnerability Response.
Question 4
Which statement about patching is most correct?
Show answer and explanation
Correct answer: C. Patching is one of many responses to a Vulnerability
Patching is one response strategy among many for addressing vulnerabilities. A comprehensive vulnerability response program includes patching, but also encompasses mitigation, workarounds, compensating controls, and risk acceptance decisions. Vulnerability Response is the broader discipline that includes patching as a component.
Why the other options are wrong
- A. Mature organizations do not abandon patching; it remains a core security practice.
- B. While related, patch management and Vulnerability Response are distinct concepts; Vulnerability Response is broader.
- D. Active patching does not eliminate the need for comprehensive Vulnerability Response strategies.
Question 5
The Vulnerability Admin role (sn_vul.admin) can modify Vulnerability Application Properties and can be delegated to the following role(s):
Show answer and explanation
Correct answer: D. All of the above
The Vulnerability Admin role (sn_vul.admin) can be delegated to ServiceNow Security Operations Admin, Security Admin, and Vulnerability Response Admin roles. These three roles represent the appropriate administrative tiers that should have the capability to modify Vulnerability Application Properties.
Why the other options are wrong
- A. While correct, this is only one of the eligible roles.
- B. While correct, this is only one of the eligible roles.
- C. While correct, this is only one of the eligible roles.
- E. This is incorrect because the role can be delegated to these specific roles.
Question 6
sn_vul.itsm_popup is the property that is set to True or False based on the customer desire for a popup when creating a Problem or Change record from a Vulnerability or VI record.
Show answer and explanation
Correct answer: A. True
The sn_vul.itsm_popup property controls whether a popup appears when creating a Problem or Change record from a Vulnerability or Vulnerable Item record. This property is indeed set to True or False based on customer configuration preferences, making the statement accurate.
Why the other options are wrong
- B. The statement is correct; the property does function as described for popup control on ITSM record creation.
Question 7
Vulnerability Response can be best categorized as a ____________, focused on identifying and remediating vulnerabilities as early as possible.
Show answer and explanation
Correct answer: A. A proactive process
Vulnerability Response is fundamentally a proactive process because it focuses on identifying and remediating vulnerabilities as early as possible in the lifecycle, before they can be exploited. This early identification and remediation approach defines the proactive nature of the vulnerability management discipline.
Why the other options are wrong
- B. While vulnerability management may involve iterative cycles, the key characteristic emphasized here is the early identification and remediation, which defines a proactive rather than iterative process.
- C. Tentative processes are uncertain or provisional, whereas vulnerability response is a defined and committed security practice.
- D. Reactive processes respond to incidents after they occur, whereas vulnerability response seeks to prevent incidents by addressing vulnerabilities before exploitation.
Question 8
If a customer expects to ingest 2 million vulnerabilities during its initial load, which instance size should you recommend?
Show answer and explanation
Correct answer: C. XXL
For ingesting 2 million vulnerabilities during initial load, an XXL instance size is required to handle the substantial data volume and processing demands. This large capacity ensures adequate performance and system stability when managing such a significant initial data intake.
Why the other options are wrong
- A. An L instance size is too small to handle 2 million vulnerabilities efficiently during initial load.
- B. An XL instance size is insufficient for processing 2 million vulnerabilities; a larger capacity is needed.
- D. While Ultra might theoretically work, XXL is the recommended size specifically for this 2 million vulnerability scenario.
Question 9
What Business Rule creates a Configuration Item from a Vulnerable Item record?
Show answer and explanation
Correct answer: D. Create CI from Vulnerable Item Details
The business rule named 'Create CI from Vulnerable Item Details' is responsible for automatically generating Configuration Item records from Vulnerable Item records. This rule bridges vulnerability data with the CMDB by creating CI records based on the details captured in Vulnerable Item entries.
Why the other options are wrong
- A. This rule references Vulnerable Group Details rather than individual Vulnerable Item Details.
- B. This rule references Closed Item Details, not Vulnerable Item Details, and is not the primary CI creation mechanism.
- C. Determining CI from Network Details is not the appropriate business rule for this function; the rule must specifically source from Vulnerable Item Details.
Question 10
The components installed with Vulnerability Response include:
Show answer and explanation
Correct answer: A. Tables, Scheduled Jobs, Security Operations Common
The Vulnerability Response documentation lists its installed components as tables, scheduled jobs and roles, plus the Security Operations Common plugin it depends on. Option A is the only set that matches these installed components.
Why the other options are wrong
- B. Workflows are not listed as an installed component set of Vulnerability Response.
- C. Wizards and client scripts are not the listed installed components of Vulnerability Response.
- D. Vulnerability scanners are external third-party products, not components installed with the application.
Question 11
What do Vulnerability Exceptions require?
Show answer and explanation
Correct answer: A. An Approval by default
Vulnerability Exceptions require an approval by default within the Vulnerability Response application. This ensures proper oversight and authorization of any exceptions to vulnerability remediation.
Why the other options are wrong
- B. While exception workflows may be configured, approval is the default requirement, not a workflow per se.
- C. GRC integration is not a default requirement for vulnerability exceptions.
- D. Filter Groups are used for organizing and categorizing items, not for exception approval requirements.
Question 12
To facilitate the remediation of a Vulnerable Item what type of item is most commonly used?
Show answer and explanation
Correct answer: D. Create a Change
Creating a Change is the most commonly used item type to facilitate remediation of a Vulnerable Item, as it allows organizations to track and control the fix implementation process.
Why the other options are wrong
- A. Creating a Problem is used for incident management, not specifically for vulnerability remediation.
- B. Creating a Security Incident is for incident response, not the primary remediation workflow.
- C. Creating a KB article documents solutions but does not drive the remediation process itself.
Question 13
In regard to the Security Operations Process, which of the following statements defines the “Identify” phase?
Show answer and explanation
Correct answer: A. What processes and assets need protection?
The Identify phase of the Security Operations Process determines what processes and assets need protection. This phase focuses on discovery and understanding of the organization's security requirements and assets that require safeguarding. The other options describe different phases: techniques for identifying incidents relate to Detect, available safeguards relate to Protect, restoration capabilities relate to Recover, and incident impact containment relates to Respond.
Why the other options are wrong
- B. Identifying incident detection techniques is part of the Detect phase, not Identify.
- C. Determining available safeguards belongs to the Protect phase.
- D. Restoration capability techniques are part of the Recover phase.
- E. Incident impact containment techniques are part of the Respond phase.
Question 14
When an approval is rejected for a Vulnerable Item exception, what happens to the State field for that record?
Show answer and explanation
Correct answer: D. It will be set back to its previous value
When an approval is rejected for a Vulnerable Item exception, the State field reverts to its previous value, allowing the exception request to be resubmitted or modified. This workflow pattern preserves the audit trail and gives the requestor the opportunity to address the concerns that led to the rejection while maintaining a clear state transition history.
Why the other options are wrong
- A. Analysis is not necessarily the previous state; the system reverts to whatever state preceded the approval, not a fixed state.
- B. New is too simplistic and does not account for the various states a Vulnerable Item exception can pass through before approval.
- C. In Review suggests the record stays in an active review state rather than reverting, which does not reflect the rejection outcome.
Question 15
What is the ID associated with the Vulnerability Response plugin?
Show answer and explanation
Correct answer: B. com.snc.vulnerability
The Vulnerability Response plugin is identified by the plugin ID 'com.snc.vulnerability'. This namespace convention follows ServiceNow's standard plugin naming structure and uniquely identifies the Vulnerability Response application.
Why the other options are wrong
- A. com.snc.threat.intelligence is a different plugin ID related to threat intelligence, not Vulnerability Response.
- C. com.snc.threat.feeds is associated with threat feed management, not the Vulnerability Response application.
- D. com.snc.security_incident relates to security incident management, not Vulnerability Response.
Question 16
Qualys asset tags can be loaded into a table related to the configuration item and used to support business processes or reporting. Set the Qualys Host parameter of asset_tags to a value of __________ to have asset tag information from Qualys be included in the XML payload.
Show answer and explanation
Correct answer: A. 1
The Qualys host list API uses flag values of 0 or 1, and setting the parameter to 1 includes the asset tag information in the XML payload. The tags can then be loaded into a table related to the configuration item for reporting and business processes.
Why the other options are wrong
- B. 3 is not a valid value for this Qualys flag parameter.
- C. 2 is not a valid value for this Qualys flag parameter.
- D. 0 excludes the asset tag information from the payload.
Question 17
What is the purpose of Scoped Applications?
Show answer and explanation
Correct answer: C. Scoping encapsulates and protects data and functionality
Scoped Applications serve to encapsulate and protect data and functionality within defined boundaries. Scoping isolates application logic and data, ensuring security and preventing unauthorized access or interference from other applications or global elements in the ServiceNow platform.
Why the other options are wrong
- A. Scoping is not a billing mechanism; suppliers charge based on licensing models, not application scope status.
- B. Scalability is independent of scope; both scoped and global applications can be designed to scale effectively.
- D. Applications do not need to be scoped to be deployed as plugins; plugins can operate within both scoped and global contexts.
Question 18
Ignoring a Vulnerable Item:
Show answer and explanation
Correct answer: D. Temporarily removes the item from the list of Active Vulnerable Items
Ignoring a Vulnerable Item temporarily removes it from the list of Active Vulnerable Items. This action can be reversed if the vulnerability needs to be reactivated later.
Why the other options are wrong
- A. Ignoring is temporary, not permanent; the item can be restored to the active list.
- B. The Slushbucket is not the destination for ignored items in the Vulnerability Response application.
- C. Ignoring does have an impact; it removes the item from the active list, though temporarily.
Question 19
Where can you find information related to the Common Vulnerabilities and Exposures (CVE)?
Show answer and explanation
Correct answer: B. MITRE
MITRE maintains and publishes information about Common Vulnerabilities and Exposures (CVE). MITRE is the authoritative source for the CVE List and provides the official CVE identifiers and vulnerability descriptions used throughout the security industry.
Why the other options are wrong
- A. Tenable is a vulnerability management software vendor but not the authoritative source for CVE information.
- C. NIST provides security guidance and standards but is not the primary source for CVE database maintenance.
- D. Qualys is a vulnerability management service provider but is not the official CVE information authority.
Question 20
Which Vulnerability maturity level provides advanced owner assignment?
Show answer and explanation
Correct answer: D. Improved remediation
The Improved Remediation maturity level provides advanced owner assignment capabilities, enabling organizations to assign remediation tasks more intelligently based on organizational roles and responsibilities.
Why the other options are wrong
- A. Enterprise risk trending focuses on analyzing vulnerability trends across the organization rather than owner assignment.
- B. Automated prioritization addresses how vulnerabilities are ranked and sequenced, not owner assignment.
- C. Manual operations is a lower maturity level that does not provide advanced assignment features.
Question 21
Best Practices dictate that when creating a Change task from a Vulnerable Item, which of the following fields should be used for assigning the Assigned To field on the Change task?
Show answer and explanation
Correct answer: B. Managed By on CMDB_CI
Best practice dictates using the Managed By field on the CMDB_CI record when assigning the Assigned To field on a Change task created from a Vulnerable Item. This ensures the change is assigned to the appropriate configuration item owner.
Why the other options are wrong
- A. The Assigned To field on the Vulnerable Item may not always be the optimal assignment target for the Change task.
- C. The Assigned To on CMDB_CI is not the field specified in best practices; the Managed By field is preferred.
- D. Best practices do provide specific guidance on this field mapping to ensure proper assignment.
Question 22
Select the three components of a Filter Condition: (Choose three.)
Show answer and explanation
Correct answer: A, C, D. Field; Operator; Value
A filter condition in ServiceNow consists of three essential components: the Field (what you're filtering on), the Operator (how you're comparing, such as equals, contains, or greater than), and the Value (what you're comparing against). Sum is an aggregation function used in reports and queries, not a component of a filter condition.
Why the other options are wrong
- B. Sum is an aggregation function used for calculations in reports, not a filter condition component.
Question 23
Changes made within a named Update Set in a different application scope:
Show answer and explanation
Correct answer: C. Will not be captured
Changes made within a named Update Set in a different application scope will not be captured. Update Sets are scope-specific and only capture changes made within their designated application scope. Changes made outside the Update Set's scope are excluded from capture, ensuring that only relevant modifications to the target application are included when the Update Set is exported or promoted.
Why the other options are wrong
- A. Changes outside the Update Set scope are intentionally excluded, not captured.
- B. Out-of-scope changes do not generate errors; they are simply not recorded in the Update Set.
- D. Changes are either fully captured (in scope) or not captured (out of scope); partial capture does not occur.
Question 24
A list of software weaknesses is known as:
Show answer and explanation
Correct answer: D. Common Weaknesses Enumeration (CWE)
Common Weaknesses Enumeration (CWE) is the standard list of software weaknesses and vulnerabilities. It provides a classification system for identifying and categorizing programming and design flaws that can lead to security vulnerabilities. NVD is a database of vulnerabilities with severity ratings, CVE is the system for identifying and naming specific vulnerabilities, and NIST is a standards organization that produces guidelines but is not itself a weakness list.
Why the other options are wrong
- A. NVD is a vulnerability database with scores and details, not a list of generic software weaknesses.
- B. CVE is an enumeration of specific known vulnerabilities, not a list of generic software weaknesses.
- C. NIST is a standards organization that publishes guidelines, not a weakness enumeration list.
Question 25
Some customers may have a clearly-defined, well-documented vulnerability exception process and some may even provide a diagram illustrating that process. What is the main advantage of having this documentation when translating it into a Flow or Workflow?
Show answer and explanation
Correct answer: B. Understand their internal process
The main advantage of having clear, well-documented vulnerability exception processes is understanding the customer's internal process. This understanding is foundational to accurately translating that process into a Flow or Workflow on the platform.
Why the other options are wrong
- A. While process improvement may be identified, the primary advantage is understanding the existing process first.
- C. Building directly into the platform is the outcome, not the advantage of documentation.
- D. Documentation provides significant advantage in ensuring accurate implementation of custom processes.
Question 26
In order for Vulnerability admins to configure integrations, they must have the following Role(s):
Show answer and explanation
Correct answer: D. admin and sn_vul_qualys.admin
To configure vulnerability integrations, administrators must have both the admin role and the sn_vul_qualys.admin role, which provides the necessary permissions for vulnerability and Qualys-specific configuration.
Why the other options are wrong
- A. The admin role alone is insufficient without the specific Qualys vulnerability admin role.
- B. The sn_vul.admin role alone does not include the Qualys-specific permissions needed for integration configuration.
- C. The sn_vul.vulnerability_write role provides write access but not admin-level configuration capabilities.
Question 27
Which one of the following record types can be considered the intersection of Vulnerability source information and CMDB CI records?
Show answer and explanation
Correct answer: D. Vulnerable Item (VI)
The Vulnerable Item (VI) record type represents the intersection between vulnerability source information and CMDB CI records. A Vulnerable Item links specific vulnerabilities discovered on particular Configuration Items, creating the association between vulnerability data and the assets affected by those vulnerabilities.
Why the other options are wrong
- A. Vulnerability records contain vulnerability details but do not directly intersect with CMDB CI information.
- B. Vulnerability Task records track remediation activities but are not the fundamental intersection of vulnerability sources and CI data.
- C. CMDB_CI_Vuln is not the standard record type used for this intersection in Vulnerability Response applications.
Question 28
After closing the Vulnerable Item (VI), it is recommended to:
Show answer and explanation
Correct answer: D. Compare the Vulnerability with subsequent scans
After closing a Vulnerable Item, it is recommended to compare the vulnerability with subsequent scans to verify that the remediation was effective and the vulnerability does not reappear.
Why the other options are wrong
- A. Updating Vulnerability Score Indicator values after closure is not a standard recommended practice.
- B. Vulnerable Items should not remain active after closure; the scanner should confirm closure on rescan.
- C. Marking the CI as exempt is used for accepted risks, not as a post-closure follow-up step for remediated items.
Question 29
ServiceNow Vulnerability Response tables typically start with which prefix?
Show answer and explanation
Correct answer: D. sn_vul_
ServiceNow Vulnerability Response tables use the sn_vul_ prefix as their standard naming convention. This prefix identifies tables as part of the Vulnerability Response module within the ServiceNow platform. The other options (snvr_, snvuln_, vul_) do not follow the actual naming convention used by ServiceNow for this module.
Why the other options are wrong
- A. snvr_ is not the correct prefix used for Vulnerability Response tables.
- B. snvuln_ is not the standard prefix for Vulnerability Response tables in ServiceNow.
- C. vul_ is too generic and not the actual ServiceNow Vulnerability Response module prefix.
Question 30
SLAs are used to ensure VUL are processed in a timely matter. Which field is used to determine the expected timeframe for remediating a VIT?
Show answer and explanation
Correct answer: C. Remediation target
The Remediation target field is used to determine the expected timeframe for remediating a vulnerability. This field sets the deadline by which a vulnerability should be fixed, allowing SLAs to track whether vulnerabilities are being addressed within the required timeframe. Updated tracks when records were last modified, Remediation status shows current progress state, and Closed indicates completion but doesn't define the expected timeframe.
Why the other options are wrong
- A. Updated tracks modification time but does not define the expected remediation timeframe.
- B. Remediation status shows the current state of remediation efforts but not the expected deadline.
- D. Closed indicates when remediation was completed, not the target deadline for completion.
Question 31
Which module is used to adjust the frequency in which CVEs are updated?
Show answer and explanation
Correct answer: A. NVD Auto-update
The NVD Auto-update module is used to adjust the frequency in which CVEs are updated in ServiceNow. This module controls how often the system checks for and imports new vulnerability data from the National Vulnerability Database. Update refers to general system updates, CVE Auto-update is not a standard module name, and On-demand update handles manual refresh operations rather than frequency scheduling.
Why the other options are wrong
- B. Update is a generic module name and does not specifically manage CVE update frequency.
- C. CVE Auto-update is not the correct module name for frequency adjustment.
- D. On-demand update is for manual/immediate updates, not for configuring update frequency.
Question 32
Which application provides the opportunity to align security events with organizational controls, automatically appraising other business functions of potential impact?
Show answer and explanation
Correct answer: C. Governance, Risk, and Compliance
Governance, Risk, and Compliance (GRC) provides the functionality to align security events with organizational controls and automatically notify business functions of potential impact, enabling comprehensive compliance management.
Why the other options are wrong
- A. Performance Analytics focuses on data analytics and reporting rather than control alignment and business function notification.
- B. Event Management handles security events but does not specifically align them with organizational controls and GRC frameworks.
- D. Service Mapping visualizes service dependencies but is not designed for control alignment and compliance impact assessment.
Question 33
In ServiceNow, which plugin needs to be added to enable Vulnerability Integration with Qualys, Tenable, or Rapid7?
Show answer and explanation
Correct answer: A. Vulnerability Response
The Vulnerability Response plugin needs to be added to ServiceNow to enable Vulnerability Integration with third-party vulnerability scanners including Qualys, Tenable, and Rapid7.
Why the other options are wrong
- B. Trusted Security Circles is not the plugin required for vulnerability scanner integration.
- C. Threat Intelligence plugin handles threat data but not vulnerability scanner integration.
- D. Security Incident Response plugin handles incident management, not vulnerability scanning integration.
That was 33 of 132.
The full ServiceNow CIS-VR pack has all 132 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 39 free as one PDF by email. Get the Half Pack →