Practice CIS-SIR Exam Online

Question 1

Which of the following is an action provided by the Security Incident Response application?

A : Create Outage state V1

B : Create Record on Security Incident state V1

C :

Create Response Task set Incident state V1

D : Look Up Record on Security Incident state V1

Answer: D

Question 2

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security

incident?

A : Post Incident Activity

B : Detection & Analysis

C : Preparation and Identification

D : Containment, Eradication, and Recovery

Answer: D

Question 3

The following term is used to describe any observable occurrence: __________.

A : Incident

B : Log

C : Ticket

D : Alert

E : Event

Answer: A

Question 4

Why is it important that the Platform (System) Administrator and the Security Incident administrator role be

separated? (Choose three.)

A :

Access to security incident data may need to be restricted

B : Allow SIR Teams to control assignment of security roles

C : Clear separation of duty

D : Reduce the number of incidents assigned to the Platform Admin

E : Preserve the security image in the company

Answer: B,C,D

Question 5

Chief factors when configuring auto-assignment of Security Incidents are __________.

A : Agent group membership, Agent location and time zone

B : Security incident priority, CI Location and agent time zone

C : Agent skills, System Schedules and agent location

D : Agent location, Agent skills and agent time zone

Answer: D

Name:	Certified Implementation Specialist - Security Incident Response
Exam Code:	CIS-SIR
Certification:	Certified Implementation Specialist
Vendor:	ServiceNow
Total Questions:	115
Last Updated:	Feb 10, 2026

ServiceNow CIS-SIR Answers