Practice CIS-SIR Exam Online

Question 1

Chief factors when configuring auto-assignment of Security Incidents are __________.

A : Agent group membership, Agent location and time zone

B : Security incident priority, CI Location and agent time zone

C : Agent skills, System Schedules and agent location

D : Agent location, Agent skills and agent time zone

Answer: D

Question 2

The following term is used to describe any observable occurrence: __________.

A : Incident

B : Log

C : Ticket

D : Alert

E : Event

Answer: A

Question 3

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security

incident?

A : Post Incident Activity

B : Detection & Analysis

C : Preparation and Identification

D : Containment, Eradication, and Recovery

Answer: D

Question 4

Why is it important that the Platform (System) Administrator and the Security Incident administrator role be

separated? (Choose three.)

A :

Access to security incident data may need to be restricted

B : Allow SIR Teams to control assignment of security roles

C : Clear separation of duty

D : Reduce the number of incidents assigned to the Platform Admin

E : Preserve the security image in the company

Answer: B,C,D

Question 5

Security Incidents can be created using a manual UI Action on which one of the following record types?

A : Event

B : Email Notification

C : Workflow

D : Alert

Answer: D

Name:	Certified Implementation Specialist - Security Incident Response
Exam Code:	CIS-SIR
Certification:	Certified Implementation Specialist
Vendor:	ServiceNow
Total Questions:	115
Last Updated:	Oct 01, 2026

ServiceNow CIS-SIR Answers