Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by ServiceNow
Exam Format
Registration
Validity
Skills this practice test covers
- Install Security Incident Response and build dashboards and reports on security metrics.
- Create security incidents in several ways and enrich them with threat intelligence and MITRE ATT&CK.
- Configure pre-built integrations, and build custom ones with IntegrationHub and REST APIs.
- Set up automatic assignment and escalation, and choose the process definition that fits.
- Configure security incident calculators and run post incident reviews after closure.
- Build playbooks and runbooks, and automate the handling of phishing emails that users report.
Explore related topics
CIS-SIR exam content
6 domains · 22 topics · 203 of 263 questions sorted by domain
Security Incident Response Overview and Data Visualization32 questions
This domain covers what Security Incident Response is for, what it needs to install, and how its components fit into the ServiceNow platform. It also covers the dashboards and reports that show security metrics to analysts, managers and CISOs.
Skills tested
- Identify the installation requirements and the roles the application needs.
- Describe the major components of Security Incident Response and how they interact.
- Read the pre-built dashboards and interpret their security metrics.
- Create and customize reports for security analysts, security managers and CISOs.
Questions by topic
- Data Visualization10
- Introducing Security Incident Response16
- Security Incident Response - Components6
Security Incident Creation and Threat Intelligence28 questions
A security incident can start from a form, an email, an integration or an automated rule. This domain covers those creation methods, the handling of major security incidents, and the threat intelligence and MITRE ATT&CK mappings that add context to an incident.
Skills tested
- Create security incidents by hand, from email and through integrations.
- Separate the required fields of a security incident from the optional ones.
- Set the criteria and the escalation path for a major security incident.
- Enrich incidents with threat intelligence feeds and correlate threats across incidents.
- Map an attacker's activity to MITRE ATT&CK tactics and techniques.
Questions by topic
- MITRE ATT&CK Framework8
- Explore How to Create Security Incidents8
- Major Security Incident Management8
- Understanding Threat Intelligence4
Security Incident and Threat Intelligence Integrations28 questions
This domain connects Security Incident Response to other security tools. Candidates find apps in the ServiceNow Store, set up pre-built integrations in the Integration Configurations module, build custom integrations and configure the Threat Intelligence Service Center.
Skills tested
- Install and configure security integrations from the ServiceNow Store.
- Configure pre-built integrations, then monitor and troubleshoot their status.
- Build custom integrations with IntegrationHub and REST APIs.
- Manage several threat feeds and correlate intelligence across sources.
Questions by topic
- Threat Intelligence Service Center5
- ServiceNow Store and Share7
- Creating Custom Integrations7
- Managing Pre-Built Integrations7
- Understanding Threat Intelligence2
Security Incident Response Management38 questions
This domain covers the daily handling of incidents. Candidates work in the Security Incident Response Workspace, route incidents with assignment rules and escalation paths, label them with security tags and choose the process definition an organization follows.
Skills tested
- Customize the workspace and its widgets for the analysts who use it.
- Configure assignment rules, workload balancing and escalation paths.
- Create security tags and use them to group and report on incidents.
- Compare the NIST and SANS process definitions in their Open and Stateful forms.
Questions by topic
- Process Definitions and Selection10
- Standard Automated Assignment Options and Escalation Paths13
- Security Incident Response Workspace7
- Security Tags8
Risk Calculations and Post Incident Response30 questions
This domain covers how an incident's risk is rated and what happens once it is resolved. Candidates configure security incident calculators, run post incident reviews, and correlate events from Event Management with security incidents.
Skills tested
- Configure security incident calculators that set values when conditions match.
- Explain how risk scores are worked out for security incidents.
- Run a post incident review and track the improvement actions it produces.
- Correlate events with security incidents to reduce alert fatigue.
Questions by topic
- Security Incident Calculator Groups and Risk Scores13
- Post Incident Reviews11
- Event Management6
Automation and Standard Processes47 questions
The largest domain is about automating the response. Candidates decide where automation helps, create and change playbooks, set up runbooks and orchestration actions, and configure the process for phishing emails that users report.
Skills tested
- Identify which response steps are worth automating and choose the tool for each one.
- Create and modify playbooks for common incident types.
- Configure orchestration actions and runbook automation.
- Set up user reported phishing so that each suspicious email is analyzed automatically.
Questions by topic
- Security Incident Process Automation Using Playbooks and Runbooks28
- Automate Security Incident Response Overview8
- User Reported Phishing11
Requirements
- Required: the Security Operations Fundamentals and Security Incident Response Implementation courses. The second one makes a candidate eligible for an exam voucher.
- Recommended: Certified System Administrator first, though it is not mandatory for this exam.
- Recommended: three to six months on a Security Incident Response deployment project, or maintaining the application suite in an instance.
About the CIS-SIR exam
The CIS-SIR exam shows that an implementer can configure, deploy and maintain ServiceNow's Security Incident Response application. Security teams use this application to record incidents, add threat intelligence, assign the work and automate the response. The six domains run from the application's components and dashboards to incident creation, integrations, risk scores, post incident reviews and playbooks. Passing earns the ServiceNow Certified Implementation Specialist - Security Incident Response certification.
Automation and Standard Processes is the largest domain, and the PlanetCert practice test gives it the most questions, many of them on playbooks and runbooks. The explanations show which module, role or setting decides an answer, for example the Integration Configurations module for pre-built integrations. Study Mode suits the integrations and threat intelligence topics, where several module names look alike. Brainy AI Assistant can follow a reported phishing email step by step through the playbook that analyzes it.
How to earn the certification
- Earns
- ServiceNow Certified Implementation Specialist - Security Incident ResponseImplementation Specialist
The certification stays active through ServiceNow's delta exams and its yearly Certification Maintenance Program fee.
- Before
- CSA Certified System Administrator
ServiceNow's platform administrator certification. It is recommended before CIS-SIR, though not mandatory.
- CSA Certified System Administrator
- After
- CTA Certified Technical Architect
ServiceNow's expert architect program, covering architecture, design, integration, security and governance on the platform.
- CMA Certified Master Architect
ServiceNow's top architect credential, for those who guide complex digital transformation with the platform.
- CTA Certified Technical Architect
How to prepare for CIS-SIR
- 1
Take the two SecOps courses first
ServiceNow requires Security Operations Fundamentals and Security Incident Response Implementation before the exam. Finishing the second course is also the route to an exam voucher.
- 2
Work incidents in a test instance
Use a non-production instance with Security Incident Response installed. Create incidents by hand, from an email and from an integration, then assign, tag and escalate each one.
- 3
Spend the most hours on playbooks
Automation and Standard Processes is the largest domain. Build a playbook for one incident type, add an orchestration action, and follow a reported phishing email until its incident closes.
- 4
Set the process definitions side by side
Compare NIST Open, NIST Stateful, SANS Open and SANS Stateful, and note which one is the default. Then configure a security incident calculator and check which values it sets.
- 5
Close with full timed runs
Work through the CIS-SIR practice test in Study Mode one domain at a time, then take a full run in Timed Mode. Ask Brainy AI Assistant to explain any integration or calculator question that went wrong.
Start a timed CIS-SIRrun
ServiceNow requires its Security Operations Fundamentals and Security Incident Response Implementation courses. It also recommends foundation courses such as ServiceNow Administration Fundamentals, Flow Designer Fundamentals and IntegrationHub Fundamentals.
Who CIS-SIR is for
- ServiceNow partners and implementation specialists who deploy Security Operations for customers.
- Security engineers and security operations analysts who handle incidents inside ServiceNow.
- ServiceNow administrators adding Security Incident Response to an instance they already run.
- Security architects who plan how ServiceNow connects to the rest of the security toolset.
Typical job titles: ServiceNow implementation specialist · Security operations analyst · Security engineer · ServiceNow administrator · Security architect · ServiceNow consultant
CIS-SIR glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Assignment Rules
- Rules that give a new security incident to the right group or person automatically, based on its conditions.
- Event Management
- The ServiceNow application that turns events from monitoring tools into alerts, which can then be correlated with security incidents.
- Flow Designer
- The ServiceNow tool for building automated flows from a trigger and a series of actions, with little or no code. A flow starts when its trigger condition is met.
- Integration Configurations
- The Security Incident Response module that holds the pre-built integrations an administrator can set up.
- IntegrationHub
- The ServiceNow feature that lets flows call outside systems through ready-made spokes or custom REST steps.
- Major Security Incident Management
- The handling of security incidents serious enough to meet set criteria, which then follow their own escalation path and workflow.
- MITRE ATT&CK Framework
- A public knowledge base of attacker tactics and techniques. Security Incident Response uses it to map what an attacker did during an incident.
- NIST Stateful
- The default process definition in Security Incident Response. Its incident states follow the NIST incident response model in a set order.
- Playbooks
- Step-by-step response plans that combine automated actions and analyst tasks for one kind of security incident.
- Post Incident Review
- A review after an incident is resolved that records what happened, the lessons learned and the actions to improve.
- Process Definitions
- Settings that decide the states a security incident moves through. ServiceNow provides versions based on the NIST and SANS incident response models.
- Response Tasks
- Smaller pieces of work created on a security incident and assigned to the people or groups who carry them out.
- Round-robin
- An assignment method that gives each new incident to the next member of a group in turn, so the workload is shared.
- Security Incident Calculators
- Rules that set specific field values on a security incident when the incident matches their conditions.
- Security Incident Response Workspace
- The ServiceNow workspace where security analysts see, work on and close their security incidents from one screen.
- Security Tags
- Labels added to security incidents so that analysts can group, filter and report on related incidents.
- ServiceNow Store
- ServiceNow's marketplace of applications and integrations, including security integrations, that can be installed on an instance.
- User Reported Phishing
- The Security Incident Response feature that turns a suspicious email an employee reports into a security incident for analysis.