Certified Implementation Specialist - Risk and Compliance Free Sample Questions

Risk Assessment Methodologies (RAMs) in Advanced Risk allow for highly customized scoring logic. Using a 'Factor' of type 'Scripted' enables a developer to write a custom script that can implement complex conditional logic, such as modifying the impact based on control effectiveness before calculating the final score. Standard qualitative factors or risk matrix configurations do not support this level of conditional logic.

The Entity Class approach is designed for this purpose. By creating a class on the Server table and using an advanced filter condition (dot-walking to the related application CI), entities can be generated dynamically and automatically. This is the most scalable and maintainable solution that leverages the CMDB relationship.

Policy Acknowledgement campaigns are the specific feature designed to send out requests for users to acknowledge that they have read and will comply with a policy. It tracks responses and manages reminders.

The 'Acknowledgement Audience' related list on the Policy record is where you define who needs to acknowledge the policy. This can be based on user groups (like 'Database Administrators'), roles, or individual users, and is a prerequisite for launching the campaign.

An Entity Class can be created on any table in ServiceNow, not just those extending from [cmdb_ci]. This allows organizations to define entities from tables like Core Company [core_company], Department [cmn_department], or even custom tables, providing flexibility to model the organization's structure.

Risk Heatmaps can be configured to plot risks based on either their inherent (pre-control) or residual (post-control) scores. Given that the controls are highly effective (90%), the residual score would be significantly lower than the inherent score. This would correctly place the risk in a lower-risk quadrant on a heatmap configured to show residual risk.

Using the parent/child policy relationship is the designed best practice for this scenario. It allows for a clear hierarchy, separate ownership and review cycles for the regional child policies, and the ability to link common controls from the parent down to the children. This structure is scalable and easy to navigate.

The sn_compliance.user role provides the correct baseline of permissions. It allows users to interact with compliance records, such as responding to requests and creating evidence, but does not grant high-level administrative or managerial permissions like approving exceptions or changing control states. It is the ideal starting point to clone for a junior analyst role.

The Entity Type approach is ideal for this scenario. It is designed for creating a manually curated collection of entities that may not be easily grouped by a simple filter condition. Since the list of 30 departments is small and maintained by a specific team, an Entity Type provides a direct and simple way to group them for GRC purposes.

This scheduled job runs periodically to evaluate the filter conditions on all active Entity Classes. It creates new Entity (Profile) records for source records that now match the filter, retires Entities whose source records no longer match, and updates existing Entities if their source data has changed.

Accept is a standard risk response strategy where the organization acknowledges the risk and decides not to take any action to reduce it, often because the cost of mitigation outweighs the potential loss.

Mitigate is a common risk response strategy that involves implementing controls or countermeasures to reduce the likelihood or impact of the risk.