CIS-SIR 시험 - ServiceNow실제시험문제와 답 - 60문항

Question No : 1

When the Security Phishing Email record is created what types of observables are stored in the record? (Choose three.)

A.URLs, domains, or IP addresses appearing in the body
B.Who reported the phishing attempt
C.State of the phishing email
D.IP addresses from the header
E.Hashes and/or file names found in the EML attachment
F.Type of Ingestion Rule used to identify this email as a phishing attempt

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/concept/sighting-searches-on-phishing-attacks.html

Question No : 2

The benefits of improved Security Incident Response are expressed.

A.as desirable outcomes with clear, measurable Key Performance Indicators
B.differently depending upon 3 stages: Process Improvement, Process Design, and Post Go-Live
C.as a series of states with consistent, clear metrics
D.as a value on a scale of 1-10 based on specific outcomes

정답:

Question No : 3

Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

A.Work Instruction Playbook
B.Flow
C.Workflow
D.Runbook
E.Flow Designer

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/task/perform-addtl-tasks-on-si.html

Question No : 4

Security tag used when a piece of information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.

A.TLP: GREEN
B.TLP: AMBER
C.TLP: RED
D.TLP: WHITE

정답:
Explanation:

Table
Description automatically generated

Question No : 5

Which Table would be commonly used for Security Incident Response?

A.sysapproval_approver
B.sec_ops_incident
C.cmdb_rel_ci
D.sn_si_incident

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/quebec-security-management/page/product/security-incident-response/reference/installed-with-sir.html

Question No : 6

What plugin must be activated to see the New Security Analyst UI?

A.Security Analyst UI Plugin
B.Security Incident Response UI plugin
C.Security Operations UI plugin
D.Security Agent UI Plugin

정답:

Question No : 7

What field is used to distinguish Security events from other IT events?

A.Type
B.Source
C.Classification
D.Description

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/concept/c_ScIncdUseAlrts.html

Question No : 8

The EmailUserReportedPhishing script include processes inbound emails and creates a record in which table?

A.ar_sn_si_phishing_email
B.sn_si_incident
C.sn_si_phishing_email_header
D.sn_si_phishing_email

정답:

Question No : 9

What specific role is required in order to use the REST API Explorer?

A.admin
B.sn_si.admin
C.rest_api_explorer
D.security_admin

정답:
Explanation:
Reference: https://developer.servicenow.com/dev.do#!/learn/learning-plans/orlando/technology_partner_program/app_store_learnv2_rest_orlando_introduction_to_the_rest_a pi_explorer

Question No : 10

Using the KB articles for Playbooks tasks also gives you which of these advantages?

A.Automated activities to run scans and enrich Security Incidents with real time data
B.Automated activities to resolve security Incidents through patching
C.Improved visibility to threats and vulnerabilities
D.Enhanced ability to create and present concise, descriptive tasks

정답:

Question No : 11

Which of the following fields is used to identify an Event that is to be used for Security purposes?

A.IT
B.Classification
C.Security
D.CI

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/paris-it-operations-management/page/product/event-management/task/t_EMManageEvent.html

Question No : 12

Chief factors when configuring auto-assignment of Security Incidents are.

A.Agent group membership, Agent location and time zone
B.Security incident priority, CI Location and agent time zone
C.Agent skills, System Schedules and agent location
D.Agent location, Agent skills and agent time zone

정답:
Explanation:
Reference: https://docs.servicenow.com/bundle/paris-security-management/page/product/security-incident-response/task/t_ConfigureSIM.html

Question No : 13

Why should discussions focus with the end in mind?

A.To understand desired outcomes
B.To understand current posture
C.To understand customer’s process
D.To understand required tools

정답:

Question No : 14

Which of the following are potential benefits for utilizing Security Incident assignment automation? (Choose two.)

A.Decreased Time to Containment
B.Increased Mean Time to Remediation
C.Decreased Time to Ingestion
D.Increased resolution process consistency

정답:

Question No : 15

What is the key to a successful implementation?

A.Sell customer the most expensive package
B.Implementing everything that we offer
C.Understanding the customer’s goals and objectives
D.Building custom integrations

정답:

ServiceNow CIS-SIR 시험