Jan-2022 Latest PassReview CIS-SIR Exam Dumps with PDF and Exam Engine Free Updated Today!
Following are some new CIS-SIR Real Exam Questions!
NEW QUESTION 24
Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.
- A. Publish Watchlist
- B. Get Running Processes
- C. Sightings Search
- D. Get Network Statistics
- E. Block Action
- F. Isolate Host
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/quebec-security-management/page/product/security- operations-common/concept/get-running-processes-capability.html
NEW QUESTION 25
What is the purpose of Calculator Groups as opposed to Calculators?
- A. To provide metadata about the calculators
- B. To set the condition for all calculators to run
- C. To allow the agent to select which calculator they want to execute
- D. To ensure one at maximum will run per group
Answer: B
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response/reference/setup-assistant-reference.html
NEW QUESTION 26
A flow consists of one or more actions and a what?
- A. Change formatter
- B. NIST Ready State
- C. Trigger
- D. Catalog Designer
Answer: C
NEW QUESTION 27
Chief factors when configuring auto-assignment of Security Incidents are.
- A. Agent skills, System Schedules and agent location
- B. Security incident priority, CI Location and agent time zone
- C. Agent group membership, Agent location and time zone
- D. Agent location, Agent skills and agent time zone
Answer: D
NEW QUESTION 28
Which one of the following reasons best describes why roles for Security Incident Response (SIR) begin with
"sn_si"?
- A. Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix
- B. Because the Security Incident Response application uses a Secure Identity token
- C. Because ServiceNow checks the instance for a Secure Identity when logging on to this scoped application
- D. Because ServiceNow tracks license use against the Security Incident Response Application
Answer: B
NEW QUESTION 29
How do you select which process definition to use?
- A. By setting the Script Include record to Active
- B. By setting the process definition record to Active
- C. By selecting the desired process within the Process Selection module
- D. By selecting the desired process within the Process Definition module
Answer: C
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident- response/reference/setup-assistant-reference.html
NEW QUESTION 30
Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?
- A. SANS Stateful
- B. NIST Open
- C. NIST Stateful
- D. SANS Open
Answer: C
NEW QUESTION 31
Which Table would be commonly used for Security Incident Response?
- A. cmdb_rel_ci
- B. sysapproval_approver
- C. sn_si_incident
- D. sec_ops_incident
Answer: C
Explanation:
Explanation/Reference: https://docs.servicenow.com/bundle/quebec-security-management/page/product/security- incident-response/reference/installed-with-sir.html
NEW QUESTION 32
A Post Incident Review can contain which of the following? (Choose three.)
- A. Attachments associated with the security incident
- B. Key incident fields
- C. Post incident question:naires
- D. Performance Analytics reports
- E. An audit trail
Answer: B,C,E
NEW QUESTION 33
What three steps enable you to include a new playbook in the Selected Playbook choice list? (Choose three.)
- A. Navigate to the sys_playbook_flow.list table
- B. Search for the new playbook you have created using Flow Designer
- C. Add the sir_playbook tag to the playbooks that you want to include in the Selected Playbook choice list
- D. Navigate to the sys_hub_flow.list table
- E. Add the TLP: GREEN tag to the playbooks that you want to include in the Selected Playbook choice list
Answer: B,C,D
NEW QUESTION 34
What is the purpose of Calculator Groups as opposed to Calculators?
- A. To provide metadata about the calculators
- B. To set the condition for all calculators to run
- C. To allow the agent to select which calculator they want to execute
- D. To ensure one at maximum will run per group
Answer: B
NEW QUESTION 35
Which of the following is an action provided by the Security Incident Response application?
- A. Create Response Task set Incident state V1
- B. Create Record on Security Incident state V1
- C. Look Up Record on Security Incident state V1
- D. Create Outage state V1
Answer: C
NEW QUESTION 36
What is the key to a successful implementation?
- A. Sell customer the most expensive package
- B. Implementing everything that we offer
- C. Building custom integrations
- D. Understanding the customer's goals and objectives
Answer: D
NEW QUESTION 37
Which ServiceNow automation capability extends Flow Designer to integrate business processes with other systems?
- A. Workflow
- B. Subflows
- C. Integration Hub
- D. Orchestration
Answer: C
NEW QUESTION 38
If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?
- A. Ask for assistance in the community page
- B. Look for one in the ServiceNow Store
- C. Build your own through the REST API Explorer
- D. Download one from ServiceNow Share
Answer: B
NEW QUESTION 39
What plugin must be activated to see the New Security Analyst UI?
- A. Security Analyst UI Plugin
- B. Security Operations UI plugin
- C. Security Incident Response UI plugin
- D. Security Agent UI Plugin
Answer: D
NEW QUESTION 40
Which of the following tag classifications are provided baseline? (Choose three.)
- A. Severity
- B. Traffic Light Protocol
- C. IoC Type
- D. Block from Sharing
- E. Enrichment whitelist/blacklist
- F. Escalation Level
- G. Cyber Kill Chain Step
Answer: B,C,E
NEW QUESTION 41
For Customers who don't use 3rd-party systems, what ways can security incidents be created? (Choose three.)
- A. Security Incident Form
- B. Alert Management
- C. Security Service Catalog
- D. Inbound Email Parsing Rules
- E. Leveraging an Integration
Answer: A,C,D
NEW QUESTION 42
What factor, if any, limits the ability to close SIR records?
- A. Opened related INC records
- B. All post-incident review question:ers have to be completed first
- C. Best practice dictates that SIR records should be set to 'Resolved' never to 'Closed'
- D. Nothing, SIR records could be closed at any time
Answer: A
NEW QUESTION 43
Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)
- A. Access to security incident data may need to be restricted
- B. Allow SIR Teams to control assignment of security roles
- C. Preserve the security image in the company
- D. Reduce the number of incidents assigned to the Platform Admin
- E. Clear separation of duty
Answer: B,D,E
NEW QUESTION 44
What does a flow require?
- A. A trigger
- B. CAB orders
- C. Security orchestration flows
- D. Runbooks
Answer: A
NEW QUESTION 45
......
Resources From:
- 2022 Latest PassReview CIS-SIR Exam Dumps (PDF & Exam Engine) Free Share: https://www.passreview.com/CIS-SIR_exam-braindumps.html
Free Resources from PassReview, We Devoted to Helping You 100% Pass All Exams!