ServiceNow CIS-SecOps - Security Operations Implementation - SIR Vulnerability Threat Intelligence SOAR

By Marcus Chen · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,718
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.4 (20)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A security compliance officer needs to demonstrate to auditors that all Critical Security Incidents from the past year were investigated within the required 1-hour SLA and contained within 24 hours. What is the BEST way to export this evidence from ServiceNow?

Answer choices

  • A. Ask each security analyst to write a summary email

  • B. Generate a Scheduled Report from ServiceNow SIR showing all Critical Security Incidents with: creation time, acknowledgment time, containment time, SLA compliance status, and analyst assigned — export as PDF or CSV for auditor submission

  • C. Manually compile incident details from emails and tickets

  • D. Screenshot each security incident record individually

Question 2

A security operations team needs to ensure that when a high-severity Security Incident remains unacknowledged for more than 30 minutes, it escalates to the on-call security manager automatically. What configuration achieves this?

Answer choices

  • A. The security manager sets a phone alarm and checks every 30 minutes

  • B. Configure a Security Incident SLA with breach condition: severity = High AND acknowledged = false AND SLA time > 30 minutes; on breach, trigger an escalation notification to the on-call security manager using on-call schedules from the On-Call Management module

  • C. A scheduled job that runs every 5 minutes checking unacknowledged incidents

  • D. Configure PagerDuty separately to handle escalations

Question 3

A Security Incident is being investigated and the analyst needs to preserve digital evidence from an affected system before it's wiped and rebuilt. What SecOps Evidence Management configuration supports this?

Answer choices

  • A. The analyst takes personal notes during investigation

  • B. Configure Evidence Collection tasks in the Security Incident playbook — automated steps collect forensic artifacts (memory dumps, disk images, log exports) via Integration Hub actions and store them as Evidence Artifacts attached to the Security Incident, with hash verification for chain of custody

  • C. Store evidence on the analyst's local workstation

  • D. Email evidence files to the security team distribution list

Question 4

A Security Operations team wants to implement automated threat hunting capabilities where specific queries run automatically against log data when a new Threat Intelligence IOC is imported, and results are surfaced as potential Security Incidents. What configuration is needed?

Answer choices

  • A. Analysts manually run threat hunting queries when they have time

  • B. Configure Threat Hunting automation: when a new critical IOC is imported into Threat Intelligence, a trigger activates a Flow that executes hunting queries via Integration Hub SIEM actions (Splunk, Sentinel), and any matches are automatically created as Security Incidents or Suspicious Activities for analyst review

  • C. Export IOCs to a spreadsheet and manually compare to log data

  • D. Wait for the SIEM to alert on IOCs automatically

Question 5

During a Security Incident investigation, an analyst determines that a user account was compromised via credential stuffing. They need to immediately disable the account in Active Directory and force a password reset. What is the CORRECT SecOps implementation for this automated response action?

Answer choices

  • A. Email the IT help desk to disable the account manually

  • B. Use an Integration Hub action or custom playbook step that calls the Active Directory Spoke (or LDAP API) to disable the account and set "must change password at next login" flag, all from within the Security Incident record

  • C. Create an ITSM change request to disable the account

  • D. Wait for the monthly security review to address compromised accounts