31 free ServiceNow CIS-SIR practice questions from the CertStash pack of 125, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 31 free here, all 125 in the pack, and each step includes the one before it.
Get all 125 questions (US$39) · Download the first 10 as a PDF
Question 1
What is the fastest way for security incident administrators to remove unwanted widgets from the Security Incident Catalog?
Show answer and explanation
Correct answer: D. Through the Catalog Definition record
Widgets in the Security Incident Catalog are managed through the Catalog Definition record, which provides the administrative interface for configuring and removing catalog items. This is the proper administrative method rather than attempting UI shortcuts or contacting system administrators.
Why the other options are wrong
- A. Clicking an X button is not a supported method for removing widgets from the catalog.
- B. While system administrators could theoretically help, this is not the fastest or proper self-service method for incident administrators.
- C. Widgets can be removed; they are not permanently locked in the catalog.
Question 2
Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.
Show answer and explanation
Correct answer: C. Get Running Processes
Get Running Processes is the specific capability designed to retrieve and display a list of currently running processes on a Configuration Item from a host or endpoint. This is a direct host response action used in security investigations.
Why the other options are wrong
- A. Get Network Statistics retrieves network information rather than process lists.
- B. Isolate Host disconnects a device from the network rather than querying processes.
- D. Publish Watchlist distributes threat intelligence rather than querying endpoints.
- E. Block Action prevents malicious activities rather than retrieving process information.
- F. Sightings Search looks up threat intelligence sightings rather than querying running processes.
Question 3
Which Table would be commonly used for Security Incident Response?
Show answer and explanation
Correct answer: D. sn_si_incident
The sn_si_incident table is the primary table for storing and managing security incidents in ServiceNow's Security Incident Response module. This is the core data structure for all incident-related operations.
Why the other options are wrong
- A. sysapproval_approver is used for approval workflows, not incident management.
- B. sec_ops_incident is not the standard ServiceNow security incident table.
- C. cmdb_rel_ci tracks configuration item relationships, not security incidents.
Question 4
There are several methods in which security incidents can be raised, which broadly fit into one of these categories: __________. (Choose two.)
Show answer and explanation
Correct answer: B, C. Manually created; Automatically created
Security incidents can be raised through two broad categories: Manually created incidents, where users create them directly in the system, and Automatically created incidents, which are generated through integrations with security tools and detection systems. These two categories encompass all methods of incident creation.
Why the other options are wrong
- A. Integrations are a mechanism by which incidents are automatically created, not a separate category.
- D. Email parsing is a specific type of integration method, not a primary category.
Question 5
What is the first step when creating a security Playbook?
Show answer and explanation
Correct answer: B. Create a Flow
Creating a Flow is the first step when building a security Playbook in ServiceNow. The Flow defines the logical workflow and automation logic that the Playbook will execute. Subsequent steps involve creating Runbooks and Response Tasks based on this foundational Flow.
Why the other options are wrong
- A. Setting Response Task state occurs after the Flow and Runbook are created.
- C. Creating a Runbook comes after the Flow is established.
- D. Creating a Knowledge Article is a support activity, not part of Playbook creation.
Question 6
To configure Security Incident Escalations, you need the following role(s): __________.
Show answer and explanation
Correct answer: A. sn_si.admin
The sn_si.admin role is the required role to configure Security Incident Escalations. This administrative role has the necessary permissions to define and manage escalation policies and rules.
Why the other options are wrong
- B. The sn_si.manager role does not have escalation configuration permissions.
- C. The sn_si.ciso role is not required for escalation configuration.
- D. Neither manager nor analyst roles have the permissions needed to configure escalations.
Question 7
Which of the following are potential benefits for utilizing Security Incident assignment automation? (Choose two.)
Show answer and explanation
Correct answer: A, D. Decreased Time to Containment; Increased resolution process consistency
Security Incident assignment automation provides Decreased Time to Containment by routing incidents to appropriate responders faster, and Increased resolution process consistency by applying standardized assignment rules uniformly across all incidents. These are the primary operational benefits.
Why the other options are wrong
- B. Increased Mean Time to Remediation contradicts automation benefits; automation should decrease remediation time.
- C. Time to Ingestion is not affected by assignment automation; ingestion occurs before assignment.
Question 8
What is the key to a successful implementation?
Show answer and explanation
Correct answer: C. Understanding the customer’s goals and objectives
Understanding the customer's goals and objectives is the foundational key to successful implementation. This knowledge drives all subsequent decisions about which features to deploy, how to configure the system, and how to measure success against actual business needs.
Why the other options are wrong
- A. Selling the most expensive package prioritizes revenue over customer success.
- B. Implementing everything available creates unnecessary complexity and cost without addressing specific needs.
- D. Custom integrations should be built only when standard capabilities do not meet identified objectives.
Question 9
A flow consists of one or more actions and a what?
Show answer and explanation
Correct answer: D. Trigger
A flow is a fundamental automation construct in ServiceNow that consists of one or more actions and a trigger. The trigger is what initiates the flow, determining when the actions should execute. This is the core architectural requirement for any flow definition.
Why the other options are wrong
- A. Change formatters are tools for data transformation, not a required component of flows.
- B. Catalog Designer is used for designing service catalogs, not for defining flow structure.
- C. NIST Ready State is a compliance framework concept, not a component of flows.
Question 10
Flow Triggers can be based on what? (Choose three.)
Show answer and explanation
Correct answer: A, B, D. Record changes; Schedules; Record inserts
Flow triggers can be based on record changes (when a record is modified), schedules (at specified times or intervals), and record inserts (when new records are created). These three represent the primary event sources that initiate flows in ServiceNow.
Why the other options are wrong
- C. Subflows are actions within flows, not trigger sources themselves.
- E. Record views are read operations and do not serve as reliable trigger events for flow execution.
What people say about the full CIS-SIR pack 5.0 from 1
I wasn’t sure where to start, but Cert Stash’s practice questions for CIS-SIR helped me organize topics well. After steady practice, I cleared it easily.
Question 11
Which of the following is an action provided by the Security Incident Response application?
Show answer and explanation
Correct answer: C. Create Response Task set Incident state V1
Create Response Task set Incident state V1 is an action provided by the Security Incident Response application. This action enables the creation of response tasks while setting the appropriate incident state within the application workflow.
Why the other options are wrong
- A. Create Outage state V1 is not a standard action provided by the Security Incident Response application.
- B. Create Record on Security Incident state V1 is not a recognized action in the application.
- D. Look Up Record on Security Incident state V1 is not provided as an action by the application.
Question 12
What field is used to distinguish Security events from other IT events?
Show answer and explanation
Correct answer: C. Classification
The Classification field is used to distinguish Security events from other IT events. This field provides the primary mechanism for categorizing events and routing them appropriately based on whether they are security-related or general IT events.
Why the other options are wrong
- A. Type field does not serve as the distinguishing factor for security events.
- B. Source field indicates the origin of an event but does not classify it as security-related.
- D. Description field contains event details but is not used as the formal distinction mechanism.
Question 13
Using the KB articles for Playbooks tasks also gives you which of these advantages?
Show answer and explanation
Correct answer: D. Enhanced ability to create and present concise, descriptive tasks
Using KB articles for Playbook tasks enhances the ability to create and present concise, descriptive tasks. Knowledge Base articles provide detailed documentation that can be referenced within playbooks, ensuring that tasks are clear, well-documented, and easily understood by incident responders.
Why the other options are wrong
- A. Automated activities for scans and enrichment are capabilities of playbook actions, not specifically related to KB article usage
- B. Automated patching resolution is a playbook capability but not specifically enhanced by KB article usage
- C. Visibility to threats and vulnerabilities comes from integration and data collection, not from KB articles in playbooks
Question 14
The severity field of the security incident is influenced by what?
Show answer and explanation
Correct answer: D. The business value of the affected asset
The severity field of a security incident is influenced by the business value of the affected asset. Higher-value assets warrant higher severity classifications because the potential impact and organizational consequence are greater when those assets are compromised.
Why the other options are wrong
- A. The cost of response is a consequence of severity, not a determinant of it.
- B. Impact, urgency, and priority are related concepts but severity is specifically tied to asset value and potential harm.
- C. Resolution time does not influence the severity rating; severity is determined at incident creation based on asset value.
Question 15
A flow consists of __________. (Choose two.)
Show answer and explanation
Correct answer: B, E. Actions; Triggers
A flow consists of Actions and Triggers. Actions represent the tasks or operations that the flow performs, while Triggers are the events that initiate the flow execution. Together, these components form the fundamental structure of a flow.
Why the other options are wrong
- A. Scripts are executable code but are not structural components that define what a flow consists of
- C. Processes are higher-level constructs; flows contain actions and triggers rather than processes
- D. Actors are not a standard component of flow structure in ServiceNow platform terminology
Question 16
Joe is on the SIR Team and needs to be able to configure Territories and Skills. What role does he need?
Show answer and explanation
Correct answer: D. Security Admin
The Security Admin role is required to configure Territories and Skills within the Security Incident Response system. These administrative functions control how incidents are routed to team members and how skill-based assignments are managed, requiring elevated permissions beyond standard analyst or manager roles.
Why the other options are wrong
- A. Security Basic role provides limited foundational access without administrative configuration capabilities.
- B. Manager role supervises personnel and work but does not include system configuration authority for Territories and Skills.
- C. Security Analyst role performs incident investigation and response but lacks administrative configuration permissions.
Question 17
The EmailUserReportedPhishing script include processes inbound emails and creates a record in which table?
Show answer and explanation
Correct answer: D. sn_si_phishing_email
The EmailUserReportedPhishing script processes inbound emails and creates a record in the sn_si_phishing_email table. This table is specifically designed to store phishing email reports that are then analyzed and processed for security incident creation.
Why the other options are wrong
- A. ar_sn_si_phishing_email is not the correct table name for this process
- B. sn_si_incident is where security incidents are created, not where the initial phishing email is recorded
- C. sn_si_phishing_email_header may contain email header information but is not the primary table for phishing email records
Question 18
Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with "sn_si"?
Show answer and explanation
Correct answer: A. Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix
In ServiceNow, scoped applications use a three-letter prefix to namespace their components. The Security Incident Response application uses the 'sn_si' prefix for all roles, script includes, tables, and other application-specific objects. This naming convention ensures that scoped application components remain isolated and do not conflict with other applications or the global scope.
Why the other options are wrong
- B. Secure Identity tokens are not the reason for the sn_si prefix naming convention.
- C. ServiceNow does not check for Secure Identity tokens during login to scoped applications; this is not the basis for the naming convention.
- D. License tracking against applications does not determine the role naming prefix structure.
Question 19
Chief factors when configuring auto-assignment of Security Incidents are __________.
Show answer and explanation
Correct answer: D. Agent location, Agent skills and agent time zone
Security Incident auto-assignment is configured using Agent location, Agent skills, and agent time zone. These three factors ensure that incidents are routed to the most appropriate available agent based on their geographic location, technical expertise, and working hours. Agent group membership alone does not determine assignment, CI Location is not a primary auto-assignment factor, and System Schedules are not a core configuration element for incident auto-assignment.
Why the other options are wrong
- A. Agent group membership and time zone are factors, but Agent location and CI Location distinction makes this incorrect.
- B. Security incident priority and CI Location are not primary auto-assignment configuration factors.
- C. System Schedules is not a chief factor in auto-assignment configuration for Security Incidents.
Question 20
Select the one capability that restricts connections from one CI to other devices.
Show answer and explanation
Correct answer: A. Isolate Host
Isolate Host is the capability that restricts network connections from one compromised indicator of compromise (CI) to other devices on the network. This endpoint containment action prevents lateral movement and further propagation of the incident. The other options retrieve information (Get Running Processes, Get Network Statistics, Sightings Search), perform blocking actions in different contexts (Block Action), or manage watchlists (Publish Watchlist).
Why the other options are wrong
- B. Sightings Search retrieves historical threat data rather than restricting connections.
- C. Block Action may perform blocking but is not the specific capability for isolating a host from network connections.
- D. Get Running Processes retrieves information about processes rather than restricting connections.
- E. Get Network Statistics retrieves connection information rather than restricting connections.
- F. Publish Watchlist manages threat intelligence lists rather than restricting connections.
Question 21
Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?
Show answer and explanation
Correct answer: B. NIST Stateful
NIST Stateful process definitions enforce sequential progression through defined steps without allowing step skipping. This stateful approach ensures that all required steps are completed in order, maintaining process integrity and compliance requirements.
Why the other options are wrong
- A. SANS Stateful is not a standard process definition model in ServiceNow security incident management.
- C. NIST Open allows flexible step progression rather than mandatory sequential ordering.
- D. NIST Open process definitions permit step skipping and non-linear progression.
Question 22
What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)
Show answer and explanation
Correct answer: B, C, D. Navigate to the sys_hub_flow.list table; Search for the new playbook you have created using Flow Designer; Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list
To include a new playbook in the Selected Playbook choice list, navigate to the sys_playbook_flow.list table, search for the new playbook created in Flow Designer, and add the sir_playbook tag to mark it for inclusion. The sir_playbook tag identifies which playbooks should appear in the security incident response selection list.
Why the other options are wrong
- A. The TLP: GREEN tag is used for traffic light protocol classification, not for selecting playbooks in the choice list.
- E. The sys_hub_flow.list table is not the correct table for this configuration; sys_playbook_flow.list is the appropriate table.
Question 23
What is calculated as an arithmetic mean taking into consideration different values in the CI, Security Incident, and User records?
Show answer and explanation
Correct answer: D. Risk Score
Risk Score is calculated as an arithmetic mean that takes into consideration different values from CI (Configuration Item), Security Incident, and User records. This composite calculation provides a holistic risk assessment by weighing factors across multiple record types. Priority is manually assigned, Business Impact is assessed qualitatively, and Severity is typically a discrete classification rather than a calculated mean.
Why the other options are wrong
- A. Priority is typically assigned manually or through business logic, not calculated as an arithmetic mean.
- B. Business Impact is generally assessed qualitatively or through specific business factors, not as a mean across record types.
- C. Severity is usually a discrete value or classification, not an arithmetic mean calculation.
Question 24
What makes a playbook appear for a Security Incident if using Flow Designer?
Show answer and explanation
Correct answer: B. Trigger set to conditions that match the security incident
A playbook appears for a Security Incident in Flow Designer when the trigger is configured with conditions that match the security incident. The trigger evaluates incoming security incidents against specified conditions, and when those conditions are met, the playbook is automatically displayed and available for execution.
Why the other options are wrong
- A. Actions that create tasks are part of the playbook's execution, not what makes it appear for a security incident.
- C. The Runbook property is not the mechanism that controls playbook visibility for security incidents.
- D. Service Criticality settings do not determine whether a playbook appears; trigger conditions do.
Question 25
What role(s) are required to add new items to the Security Incident Catalog?
Show answer and explanation
Correct answer: A. requires the sn_si.admin role
The sn_si.admin role is required to add new items to the Security Incident Catalog. This role grants administrative privileges specific to the Security Incident Management application and is the appropriate authorization level for catalog modifications. The sn_si.catalog role does not exist as a standard role, combining write and catalog_admin roles is unnecessarily complex, and the generic admin role is not the application-specific requirement.
Why the other options are wrong
- B. The sn_si.catalog role does not exist as a standard ServiceNow role.
- C. Requiring both sn_si.write and catalog_admin is not the correct combination; sn_si.admin is the appropriate single role.
- D. The generic admin role is too broad; the application-specific sn_si.admin role is required.
Question 26
How do you select which process definition to use?
Show answer and explanation
Correct answer: B. By selecting the desired process within the Process Selection module
Process definitions are selected by using the Process Selection module within ServiceNow. This module allows administrators to choose which process definition will be used for handling specific types of work. Selecting within the Process Definition module itself does not activate it, setting a record to Active is a separate action, and Script Include records are not used for process definition selection.
Why the other options are wrong
- A. Selecting within the Process Definition module is not the correct method; the Process Selection module is required.
- C. Setting a record to Active is not how you select which process definition to use.
- D. Script Include records are not used for selecting process definitions.
Question 27
What factor, if any, limits the ability to close SIR records?
Show answer and explanation
Correct answer: A. Opened related INC records
Opened related INC (Incident) records limit the ability to close Security Incident Response (SIR) records. The system enforces data integrity by preventing SIR record closure when dependent incident records remain open, ensuring investigation continuity and proper documentation linkage. Best practices and questionnaires do not technically block closure, and closure can occur at appropriate times once all dependencies are resolved.
Why the other options are wrong
- B. Best practices recommend proper closure procedures but do not prevent closing as a technical restriction.
- C. There are functional restrictions on SIR record closure when related records exist.
- D. Post-incident review questionnaires should be completed but do not technically block closure operations.
Question 28
What is the name of the Inbound Action that validates whether an inbound email should be processed as a phishing email for URP v2?
Show answer and explanation
Correct answer: A. User Reporting Phishing (for Forwarded emails)
The inbound action named User Reporting Phishing (for Forwarded emails) is the action that validates whether an inbound email should be processed as a phishing email for URP v2. This action specifically handles emails that users forward as potential phishing attempts. Scan email for threats is a different security function, Create Phishing Email is an outbound action, and User Reporting Phishing (for New emails) handles direct phishing reports rather than forwarded emails.
Why the other options are wrong
- B. Scan email for threats is a different security capability focused on threat detection, not phishing report validation.
- C. User Reporting Phishing (for New emails) handles new phishing reports directly, not forwarded email validation.
- D. Create Phishing Email is not a validation action; it creates rather than validates phishing records.
Question 29
What does a flow require?
Show answer and explanation
Correct answer: D. A trigger
A trigger is the essential requirement for a flow. Every flow must have a trigger to define when the flow executes. Without a trigger, there is no event to initiate the sequence of actions that comprises the flow.
Why the other options are wrong
- A. Security orchestration flows are a specific type of flow, not a requirement for all flows.
- B. Runbooks are knowledge resources but not required components of flow definitions.
- C. CAB orders are change management artifacts unrelated to flow requirements.
Question 30
Which of the following process definitions are not provided baseline?
Show answer and explanation
Correct answer: A. NIST Open
NIST Open is not provided as a baseline process definition in security incident response frameworks. The framework provides baseline definitions for standard process types like NIST Stateful and SANS approaches, but NIST Open does not constitute a recognized baseline process definition in this context.
Why the other options are wrong
- B. SAN Stateful is a recognized baseline process definition.
- C. NIST Stateful is a standard baseline process definition provided by the framework.
- D. SANS Open is a recognized baseline process definition.
Question 31
Incident severity is influenced by the business value of the affected asset. Which of the following are asset types that can be affected by an incident? (Choose two.)
Show answer and explanation
Correct answer: A, B. Business Service; Configuration Item
Business Services and Configuration Items are the two primary asset types that can be affected by security incidents. Business Services represent the business-critical services that may be impacted, while Configuration Items represent the technical infrastructure components that may be compromised or affected.
Why the other options are wrong
- C. Calculator Group is not a valid asset type in the incident management context
- D. Severity Calculator is a tool for calculating severity, not an asset type that can be affected
That was 31 of 125.
The full ServiceNow CIS-SIR pack has all 125 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 60 free as one PDF by email. Get the Half Pack →