125 practice questions for ServiceNow Certified Implementation Specialist: Security Incident Response (CIS-SIR), with full explanations.
Every question comes with the correct answer, the reasoning behind it, and a short note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.
- 125 questions across all six CIS-SIR domains
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Instant delivery by email the moment you check out
- Free monthly updates for as long as the exam is live
- Pass or your money back
A CIS-SIR attempt costs US$450. This pack is US$39, paid once.
Try 10 questions free before you buy.
Last updated September 2026 · 125 questions
What makes the CIS-SIR hard
CIS-SIR is the Security Operations exam for the incident side of the house, and its blueprint is unusual for ServiceNow in that a single domain, Automation and Standard Processes, carries almost a third of the marks. That reflects where the product has gone: SIR is now mostly playbooks, runbooks and automated enrichment, and the exam, currently cut against the Zurich release, tests whether you can build that rather than just work a security incident by hand. It is 60 questions in 90 minutes.
Automation and Standard Processes is 30%: the Automate Security Incident Response framework, process automation with playbooks and runbooks, flow based response and User Reported Phishing. Overview and Data Visualization at 15% covers the SIR architecture and components and its dashboards. Security Incident Response Management at 15% covers the SIR Workspace, automated assignment options, escalation paths, security tags and process definitions.
Creation and Threat Intelligence at 14% covers how security incidents are created from email, alerts and integrations, major security incident management, threat intelligence concepts and the MITRE ATT&CK framework as it appears in the platform. Integrations at 14% covers the ServiceNow Store and Share, managing pre-built integrations with SIEM, EDR and threat feeds, building custom integrations and the Threat Intelligence Service Center. Risk Calculations and Post Incident Response at 12% covers calculator groups and risk scores, post incident reviews and the link to Event Management. Know the difference between a playbook and a runbook and where each executes; it comes up more than once.
About the exam
CIS-SIR (Certified Implementation Specialist, Security Incident Response) certifies the ability to implement ServiceNow Security Incident Response: overview and data visualisation, incident creation and threat intelligence, integrations, response management, risk calculations and post incident review, and automation with playbooks and runbooks. Prerequisite: the CIS Data Foundations (CMDB and CSDM) certification. ServiceNow recommends the Security Incident Response Fundamentals and Implementation courses.
Exam domains
- Security Incident Response Overview and Data Visualization: 15%
- Security Incident Creation and Threat Intelligence: 14%
- Security Incident and Threat Intelligence Integrations: 14%
- Security Incident Response Management: 15%
- Risk Calculations and Post Incident Response: 12%
- Automation and Standard Processes: 30%
60 multiple-choice and multiple-select questions, 90 minutes, passing score not published by ServiceNow, US$450 per attempt (instructor-led training includes one free attempt), Pearson VUE test centre or OnVUE online proctored, certification kept current with annual delta exams and the yearly Certification Maintenance Program fee.
Reviews
There are no reviews yet.