ServiceNow CIS-VR and CIS-RIM - Vulnerability Response Risk Compliance IRM

By Marcus Chen · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,668
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.4 (13)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A security analyst discovers that a web application vulnerability (SQL injection) exists in a vendor-supplied component that cannot be patched immediately. The risk needs to be formally accepted by the CTO for a 90-day period. What is the correct workflow in Vulnerability Response and IRM?

Answer choices

  • A. Close the vulnerability as "Won't Fix" without documentation

  • B. Create a Risk Acceptance record in IRM — document the vulnerability details, link the Vulnerability Response record, specify the acceptance period (90 days), route to the CTO for formal digital approval, and document compensating controls (WAF SQL injection filter rules); create a Vulnerability Exception linked to the Risk Acceptance

  • C. Simply add a work note saying the CTO verbally approved

  • D. Remove the vulnerability finding from the next scan report

Question 2

A compliance team is preparing for a SOC 2 Type II audit. They need to demonstrate that controls were consistently in place and effective throughout the 12-month audit period, not just at one point in time. How does ServiceNow IRM help demonstrate continuous control effectiveness?

Answer choices

  • A. Conduct one comprehensive control assessment the week before the audit

  • B. Implement continuous control testing in IRM — scheduled automated control assessments run throughout the year (monthly or quarterly), with results stored in the compliance evidence repository; auditors can review the testing history showing control effectiveness over the entire audit period

  • C. Collect evidence once and claim it was collected monthly

  • D. The SOC 2 audit requires a separate tool; ServiceNow IRM is not suitable

Question 3

A company processes credit card payments and needs to demonstrate PCI-DSS compliance. Their QSA (Qualified Security Assessor) needs to review evidence for all 12 PCI-DSS requirements. How should ServiceNow IRM be configured to support the QSA review process?

Answer choices

  • A. Email spreadsheets and screenshots to the QSA

  • B. Configure PCI-DSS as a Compliance Framework in IRM — map all 12 requirement domains and sub-requirements to controls; perform control assessments with evidence attached; generate a PCI-DSS Compliance Report showing each requirement's compliance status, control test results, and evidence artifacts; provide QSA with read-only Audit Portal access

  • C. Compile evidence in SharePoint folders by requirement

  • D. Rely on the payment processor to handle PCI compliance

Question 4

A risk and compliance analyst wants to map ServiceNow IRM controls to multiple regulatory frameworks simultaneously (SOC 2, ISO 27001, NIST CSF, GDPR). Instead of creating separate control assessments for each framework, she wants to assess each control once and map to all relevant frameworks. Which IRM feature enables this?

Answer choices

  • A. Create four separate control libraries, one per framework

  • B. Unified Controls Framework (UCF) in ServiceNow IRM — a single control library maps each control to multiple regulatory/compliance frameworks simultaneously; one control assessment satisfies requirements for all mapped frameworks

  • C. Manually cross-reference controls in a spreadsheet

  • D. Only certify for one framework at a time

Question 5

An organization discovers that 200 of their vulnerability findings were incorrectly classified by the vulnerability scanner with wrong CVSS scores — they should be Critical (CVSS 9.0+) but were scanned as Medium (CVSS 5.0). How should these findings be corrected in Vulnerability Response without reimporting all findings?

Answer choices

  • A. Delete the 200 findings and reimport from scanner with corrected data

  • B. Use mass update or a background script to update the CVSS score and risk score fields on the 200 affected Vulnerability records; trigger SLA recalculation based on the updated severity; update assignment and priority based on new scores

  • C. Accept the incorrect CVSS scores as scanner output cannot be modified

  • D. Manually open and edit each of the 200 records one by one