ServiceNow CIS-SIR Exam Practice Questions

• 125 questions across all six CIS-SIR domains
• Answers and explanations for every question, including the wrong options
• A questions-only PDF for timed practice runs
• Delivered by email shortly after checkout
• Free monthly updates for as long as the exam is live
• Pass or your money back

A CIS-SIR attempt costs US$450. This pack is US$39, paid once.

What makes the CIS-SIR hard

CIS-SIR is the Security Operations exam for the incident side of the house, and its blueprint is unusual for ServiceNow in that a single domain, Automation and Standard Processes, carries almost a third of the marks. That reflects where the product has gone: SIR is now mostly playbooks, runbooks and automated enrichment, and the exam tests whether you can build that rather than just work a security incident by hand. It is 60 questions in 90 minutes.

Automation and Standard Processes is 30%: the Automate Security Incident Response framework, process automation with playbooks and runbooks, flow based response and User Reported Phishing. Overview and Data Visualization at 15% covers the SIR architecture and components and its dashboards. Security Incident Response Management at 15% covers the SIR Workspace, automated assignment options, escalation paths, security tags and process definitions.

Creation and Threat Intelligence at 14% covers how security incidents are created from email, alerts and integrations, major security incident management, threat intelligence concepts and the MITRE ATT&CK framework as it appears in the platform. Integrations at 14% covers the ServiceNow Store and Share, managing pre-built integrations with SIEM, EDR and threat feeds, building custom integrations and the Threat Intelligence Service Center. Risk Calculations and Post Incident Response at 12% covers calculator groups and risk scores, post incident reviews and the link to Event Management. Know the difference between a playbook and a runbook and where each executes; it comes up more than once.

About the exam

CIS-SIR (Certified Implementation Specialist, Security Incident Response) certifies the ability to implement ServiceNow Security Incident Response: overview and data visualisation, incident creation and threat intelligence, integrations, response management, risk calculations and post incident review, and automation with playbooks and runbooks. Prerequisite: the CIS Data Foundations (CMDB and CSDM) certification. ServiceNow recommends the Security Operations Fundamentals and Security Incident Response Implementation courses.