Certified Implementation Specialist - Security Incident Response Free Sample Questions

Security orchestration flows

Runbooks

CAB orders

A trigger

Because SIR is a scoped application, roles and script includes will begin with the sn_si prefix

Because the Security Incident Response application uses a Secure Identity token

Because ServiceNow checks the instance for a Secure Identity when logging on to this scoped application

Because ServiceNow tracks license use against the Security Incident Response Application

Scripts

Actions

Processes

Actors

Triggers

URLs, domains, or IP addresses appearing in the body

Who reported the phishing attempt

State of the phishing email

IP addresses from the header

Hashes and/or file names found in the EML attachment

Type of Ingestion Rule used to identify this email as a phishing attempt

Type

Source

Classification

Description

NIST Open

SAN Stateful

NIST Stateful

SANS Open

an arithmetic mean

addition

the Risk Score script include

a geometric mean

Actions defined to create tasks

Trigger set to conditions that match the security incident

Runbook property set to true

Service Criticality set to High

The cost of the response to the security breach

The impact, urgency and priority of the incident

The time taken to resolve the security incident

The business value of the affected asset

Security Basic

Manager

Security Analyst

Security Admin