I85PREP
⌘ K
ServiceNow CIS-SecOps study materials
ServiceNow CIS-SecOps study resources

ServiceNow CIS-SecOps practice questions

One question at a time. Build your ServiceNow CIS-SecOps understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations Fundamentals and Setup

Which table stores Security Incident Response records in ServiceNow?

  1. sn_vul_vulnerable_item
  2. sn_si_incident Correct answer.
  3. incident
  4. sn_si_task

Explanation

Security Incident Response uses its own table, sn_si_incident, so that security incidents follow the SIR life cycle with security-specific fields and roles. It is deliberately separate from the ITSM incident table. Related work items are tracked on separate task tables.

Question 2Security Operations Fundamentals and Setup

Which role grants administrative configuration rights across Security Incident Response?

  1. sn_si.admin Correct answer.
  2. sn_si.analyst
  3. sn_si.read
  4. itil

Explanation

The sn_si.admin role is the administrative role for Security Incident Response and can change configuration such as assignment rules, templates, and playbook settings. Analyst roles work incidents but do not administer the application.

Question 3Security Operations Fundamentals and Setup

Which table holds threat intelligence indicators such as IP addresses, domains, and file hashes?

  1. sn_ti_indicator Correct answer.
  2. sn_vul_entry
  3. sn_si_observable
  4. sn_ti_sighting

Explanation

Indicators of compromise are stored as indicator records in the Threat Intelligence module, where they carry a type, value, and source feed. Observations of those indicators are recorded separately as sightings.

Question 4Security Operations Fundamentals and Setup

In Vulnerability Response, which record consolidates the vulnerable items found on the same configuration item?

  1. Vulnerability group Correct answer.
  2. CI lookup rule
  3. Remediation task
  4. Vulnerability entry record

Explanation

Individual scanner findings become vulnerable items, which roll up into a vulnerability group for a given configuration item. Remediation work is then driven from the group so the CI owner sees one consolidated unit of work.

Question 5Security Operations Fundamentals and Setup

A scanner reports hosts by IP address and hostname, but vulnerable items are never linked to CMDB records. Which configuration should be reviewed?

  1. CI lookup rules Correct answer.
  2. Escalation policies
  3. Discovery schedules
  4. Assignment rules

Explanation

CI lookup rules define how host identifiers from scanner integrations are matched to configuration items in the CMDB. When matching fails, findings stay unattached and cannot be rolled up per CI.

Question 6Security Operations Fundamentals and Setup

Which standards does the ServiceNow Threat Intelligence module use to exchange indicator data with external sources?

  1. SCIM and SAML
  2. SOAP and WSDL
  3. SNMP and syslog
  4. STIX and TAXII Correct answer.

Explanation

Threat Intelligence feeds commonly use STIX to describe indicators and TAXII as the transport for sharing them. ServiceNow supports these standards so feeds can be consumed and indicators shared with partners.

Question 7Security Operations Fundamentals and Setup

In the standard Security Incident Response life cycle, which state immediately follows Analysis?

  1. Containment Correct answer.
  2. Draft
  3. Under review
  4. Closed

Explanation

The SIR life cycle progresses from Draft to Analysis, then Containment, Eradication, Recovery, Review, and Closed. Containment comes directly after the analysis of the incident has been completed.

Question 8Security Operations Fundamentals and Setup

In Configuration Compliance, which record captures the outcome of evaluating a control against a configuration item?

  1. Vulnerability item
  2. Compliance policy
  3. Policy statement
  4. Test result Correct answer.

Explanation

Configuration Compliance evaluates tests against configuration items and stores each outcome as a test result with a pass or fail value. Aggregating these results produces the compliance posture for a policy and its CIs.

Question 9Security Operations Fundamentals and Setup

Which record links a threat intelligence indicator to a security incident in which it was observed?

  1. CI lookup rule
  2. Vulnerability group
  3. Policy statement
  4. Sighting Correct answer.

Explanation

A sighting records that an indicator from a threat intelligence source was seen in a specific context, such as a security incident. Sightings let analysts trace which incidents a known indicator has touched.

Question 10Security Operations Fundamentals and Setup

Which role is intended for users who need read-only visibility into Vulnerability Response data?

  1. sn_vul.manager
  2. sn_vul.read Correct answer.
  3. itil
  4. sn_vul.admin

Explanation

The sn_vul.read role grants view access to vulnerability records without allowing changes or remediation actions. Administrative and analyst roles add configuration or working privileges on top of that visibility.

Question 11Security Operations Fundamentals and Setup

What is the main purpose of Guided Setup in a Security Operations module?

  1. To run automated penetration tests against configuration items on a schedule
  2. To import scanner data on a nightly schedule
  3. To generate auditor-facing compliance reports
  4. To step administrators through a module's configuration tasks Correct answer.

Explanation

Guided Setup presents the ordered configuration tasks an administrator must complete to activate and tailor a SecOps module. It tracks progress across those tasks but does not perform scanning, importing, or reporting itself.

Question 12Security Operations Fundamentals and Setup

An analyst has consolidated vulnerable items by configuration item and wants the patch team to perform the fix. What should be created?

  1. A security incident
  2. A remediation task Correct answer.
  3. A CI lookup rule
  4. A vulnerability entry

Explanation

Remediation tasks are the work records generated from vulnerability groups and assigned to the team that will apply the fix. They carry the target date and state used to track remediation to completion.

Question 13Security Operations Fundamentals and Setup

What is the purpose of response tasks on a security incident?

  1. To calculate the risk score of the incident
  2. To synchronize the incident with a scanner
  3. To store threat intelligence indicator hashes gathered for the incident
  4. To split the response into assignable work items Correct answer.

Explanation

Response tasks break the incident response into discrete, assignable units of work that can be tracked individually. They are typically generated from task templates so that standard steps are not missed.

Question 14Security Operations Fundamentals and Setup

What does the Anomaly Detection capability in Security Operations provide?

  1. Enforces password complexity on managed servers
  2. Maps scanner hostnames to CMDB configuration items
  3. Flags unusual user behavior using machine learning Correct answer.
  4. Continuously scans network devices for open ports and services

Explanation

Anomaly Detection applies machine learning to baseline normal activity and raise anomalies when behavior deviates significantly. Analysts use these anomalies as investigative leads that may become security incidents.

Question 15Security Operations Fundamentals and Setup

Why does Security Incident Response keep its records separate from ITSM incidents?

  1. Because security incidents never require approval or change records
  2. Because they need separate life cycles and access controls Correct answer.
  3. Because SIR records do not appear in platform reports or dashboards
  4. Because ITSM incidents cannot be assigned to individual users or groups

Explanation

Security incidents follow a containment-oriented life cycle and often carry sensitive details that must be restricted to the security team. A dedicated table lets the platform apply distinct states, roles, and confidentiality controls.

Question 16Security Operations Fundamentals and Setup

An organization wants vulnerability findings from Qualys pulled into ServiceNow on a recurring basis. Which approach fits?

  1. Upload CSV exports into the Vulnerability Entry table on a schedule
  2. Subscribe to a TAXII feed from the scanner vendor
  3. Create a CI lookup rule and wait for Discovery to populate vulnerability data
  4. Configure the vendor integration and its scheduled import Correct answer.

Explanation

Vulnerability Response integrates with major scanners through dedicated integrations that pull findings on a configured schedule. The integration creates vulnerable items, leaving CI lookup rules to handle the matching step afterwards.

Question 17Security Operations Fundamentals and Setup

What is the purpose of the Observables related list on a security incident?

  1. To track SLA timers for the response team
  2. To capture artifacts such as IP addresses, domains, and hashes Correct answer.
  3. To list the configuration items affected by the security incident
  4. To store the approval history of the security incident

Explanation

Observables are the forensic artifacts collected during analysis, such as IP addresses, domains, file hashes, and email addresses. They can be matched against threat intelligence and promoted into indicators for future detection.

Question 18Security Operations Fundamentals and Setup

Which SecOps module checks configuration items against internal hardening standards that the organization defines itself?

  1. Configuration Compliance Correct answer.
  2. Vulnerability Response module
  3. Anomaly Detection
  4. Threat Intelligence

Explanation

Configuration Compliance evaluates CIs against policies and tests authored by the organization, such as internal hardening baselines. It reports where a CI deviates from those defined standards rather than reporting third-party vulnerability findings.

Question 19Security Operations Fundamentals and Setup

Which application in the Security Operations suite manages the response life cycle for detected threats against the organization?

  1. Vulnerability Response
  2. Configuration Compliance
  3. Threat Intelligence Management
  4. Security Incident Response Correct answer.

Explanation

Security Incident Response provides the incident record, life cycle, tasks, and collaboration features used to investigate and contain threats. The other SecOps applications supply data or findings that can feed into that response process.

Question 20Security Operations Fundamentals and Setup

What does a vulnerability entry represent in Vulnerability Response?

  1. A scanner integration schedule
  2. A specific configuration item with an open port detected by Discovery
  3. A known vulnerability definition from a vendor or scanner Correct answer.
  4. A remediation task assigned to the patch team

Explanation

A vulnerability entry is the definition of a known vulnerability, sourced from scanner content or a third-party vulnerability database. Vulnerable items reference an entry and record that a particular CI is affected by it.

Question 21Security Operations Fundamentals and Setup

Which statement best explains the relationship among vulnerability items, vulnerability groups, and remediation tasks?

  1. All three records are identical views of the same underlying scanner row
  2. Groups hold the raw scanner output while items are created only after remediation
  3. Items are created by analysts, groups by scanners, and tasks by change management
  4. Items record findings, groups consolidate per CI, and tasks drive remediation Correct answer.

Explanation

Scanner findings arrive as vulnerable items, which are grouped by configuration item so owners see a consolidated view. Remediation tasks are then generated from groups and track the actual fix work to completion.

Question 22Security Operations Fundamentals and Setup

A SecOps administrator wants new vulnerability findings of a given severity to route automatically to a specific group. Which configuration object handles this?

  1. A discovery schedule
  2. A compliance policy
  3. An assignment rule Correct answer.
  4. A CI lookup rule

Explanation

Assignment rules evaluate conditions on incoming records and set the assignment group or assignee automatically. They are the standard way to route SecOps records to the team that owns the affected asset or category.

Question 23Security Operations Fundamentals and Setup

When configuring an external threat intelligence feed in ServiceNow, what is typically required?

  1. A remediation task template
  2. A Qualys subscription in the same domain
  3. Feed URL, credentials, and an import schedule Correct answer.
  4. A dedicated CMDB CI class for every indicator type imported

Explanation

A feed configuration needs the provider endpoint, any authentication details, and a schedule that controls how often indicators are retrieved. Imported indicators are then stored as threat intelligence records with their source attribution.

Question 24Security Operations Fundamentals and Setup

A vulnerable item cannot be patched because the server supports a critical legacy application. What is the appropriate handling in Vulnerability Response?

  1. Close the item with no reason so the scanner record is cleared
  2. Duplicate the underlying vulnerability entry and defer the decision
  3. Delete the vulnerable item so it stops appearing in reports
  4. Record an exception with justification and an expiry date Correct answer.

Explanation

Compensating controls and accepted risk should be documented as an exception with a business justification and a review or expiry date. This keeps the finding visible and auditable until it can be remediated.

Question 25Security Operations Fundamentals and Setup

Why might a managed security service provider enable domain separation for Security Operations?

  1. To replace role-based access with a single global analyst role
  2. To reduce the number of plugins that must be activated
  3. To keep each customer's security incidents and vulnerability data isolated Correct answer.
  4. To allow all customer analysts to share one security incident queue by default

Explanation

Domain separation partitions data and configuration so each customer's records are visible only within its own domain. For a security provider this prevents one customer's incidents, indicators, and vulnerabilities from leaking into another's view.

Question 26Security Operations Fundamentals and Setup

In a ServiceNow instance, security incident records created by the Security Incident Response application are stored in which table?

  1. sn_si_task
  2. sn_si_observable
  3. incident
  4. sn_si_incident Correct answer.

Explanation

Security Incident Response keeps its records in a dedicated table, sn_si_incident, which is separate from the ITSM incident table. Child work items and observables use their own related tables, not the incident table itself.

Question 27Security Operations Fundamentals and Setup

Which role is intended for users who triage, investigate, and respond to security incidents?

  1. sn_si.admin
  2. sn_si.read
  3. sn_si.analyst Correct answer.
  4. itil

Explanation

The sn_si.analyst role grants the working capabilities an analyst needs to triage, investigate, and respond to security incidents. Read-only and administrative access are covered by different roles.

Question 28Security Operations Fundamentals and Setup

Which Security Incident Response feature provides a predefined, repeatable sequence of response steps that analysts follow for a given incident type?

  1. Assignment rules
  2. Response playbooks Correct answer.
  3. UI policies
  4. SLA definitions

Explanation

Playbooks guide analysts through an ordered set of response activities appropriate to the incident type, so handling is consistent across the team. They differ from form logic and routing configuration.

Question 29Security Operations Fundamentals and Setup

Which related list on a security incident shows the configuration items that the incident has impacted?

  1. Observables
  2. Work notes
  3. Response tasks
  4. Affected CIs Correct answer.

Explanation

The Affected CIs related list records the configuration items from the CMDB that the security incident has impacted. Observables record threat artifacts, and response tasks record assigned work.

Question 30Security Operations Fundamentals and Setup

An administrator wants new security incidents to be routed automatically to the correct team based on fields such as category and priority. Which configuration should be used?

  1. Dictionary overrides on the incident table
  2. Security incident assignment rules Correct answer.
  3. UI policies on the incident form
  4. Access control lists on the incident table

Explanation

Assignment rules evaluate conditions on the incident and set the assignment group or assignee automatically, which is exactly the routing behavior described. The other options affect access, form behavior, or data definitions rather than routing.

Question 31Security Operations Fundamentals and Setup

What distinguishes the Work notes field from the Additional comments field on a security incident?

  1. Work notes are encrypted, while additional comments are stored as plain text.
  2. Work notes are overwritten each time the record is saved, while additional comments are retained.
  3. Work notes are internal to the response team, while additional comments can be seen by end users. Correct answer.
  4. Work notes are visible to end users, while additional comments are restricted to the assignment group.

Explanation

Work notes form the internal journal kept by the response team, whereas additional comments are the customer-facing communication channel. Both are retained as part of the record history.

Question 32Security Operations Fundamentals and Setup

An analyst has validated that an IP address on a security incident is malicious and wants future activity involving it to be matched. What action should be taken?

  1. Promote the observable to a threat intelligence indicator. Correct answer.
  2. Add the IP address to the affected CIs list.
  3. Convert the incident into a problem record.
  4. Attach the IP address as a work note on the incident.

Explanation

Observables that are confirmed malicious can be promoted to threat intelligence indicators, which then become part of the knowledge base used for matching and enrichment. The other actions do not make the value reusable for detection.

Question 33Security Operations Fundamentals and Setup

Which Threat Intelligence capability lets an analyst check whether known indicators have already been observed in the environment?

  1. Sighting search Correct answer.
  2. Vulnerability grouping
  3. Configuration compliance tests
  4. Assignment rules

Explanation

Sighting search compares known threat intelligence indicators against data in the instance to reveal where they have previously been observed. It is a matching capability, not a policy, grouping, or routing feature.

Question 34Security Operations Fundamentals and Setup

Before a security incident can be closed, what information typically must be supplied?

  1. A change request number and a business service
  2. An SLA definition and a contract
  3. A problem record and a knowledge article
  4. A close code and close notes Correct answer.

Explanation

Closure captures the resolution outcome through a close code plus close notes describing what was done, so the record is defensible for later review. The other items are unrelated record types.

Question 35Security Operations Fundamentals and Setup

Which data source supplies the configuration items that Vulnerability Response and Configuration Compliance assess?

  1. The user table
  2. The CMDB Correct answer.
  3. The asset import schedule
  4. The incident table

Explanation

Both applications work against configuration items held in the CMDB, which gives a common asset view for vulnerability and compliance evaluation. Import schedules only move data into that repository.

Question 36Security Operations Fundamentals and Setup

A SOC wants user-submitted phishing emails to become security incidents automatically. Which configuration mechanism is appropriate?

  1. A scheduled job that reads the mailbox and deletes messages
  2. A UI policy on the security incident form
  3. A client script on the incident form
  4. An inbound email action on the security incident table Correct answer.

Explanation

An inbound email action parses incoming messages and creates security incident records from them, which is the standard way to turn reported emails into incidents. Form-level configuration cannot create records from email.

Question 37Security Operations Fundamentals and Setup

Which platform feature is used to enforce response-time targets such as time to containment on security incidents?

  1. UI policies
  2. SLA definitions Correct answer.
  3. Dictionary overrides
  4. Access control lists

Explanation

SLA definitions attach timing targets and escalation behavior to task records such as security incidents. The other options govern form behavior, security, and data modeling rather than elapsed-time targets.

Question 38Security Operations Fundamentals and Setup

Which Threat Intelligence record represents the observation of a specific indicator in a particular security incident at a given time?

  1. Indicator
  2. Observable
  3. Security incident task
  4. Sighting Correct answer.

Explanation

An indicator describes a known-bad artifact, while a sighting records that the indicator was actually observed in a specific record such as a security incident, including when it was seen. This lets analysts trace where and how often an indicator appeared.

Question 39Security Operations Fundamentals and Setup

A playbook must isolate an infected host by calling an endpoint protection tool. Which integration capability enables this automated containment action?

  1. A scheduled job that runs nightly on the instance
  2. An integration with execution capability that the playbook invokes Correct answer.
  3. A UI action on the security incident form
  4. A read-only enrichment lookup of the host reputation

Explanation

Containment requires an integration that can execute an action against the third-party tool, invoked from the playbook at the right step. Read-only lookups and nightly jobs cannot perform an on-demand action on the endpoint.

Question 40Security Operations Fundamentals and Setup

An administrator wants only SIEM events above a defined severity to create security incidents, so the SOC is not flooded. Where should this filtering be enforced?

  1. In an ACL on the security incident table
  2. In a UI policy on the security incident form
  3. In the SLA definition attached to the security incident
  4. In the filter conditions of the SIEM integration's event handling Correct answer.

Explanation

Filtering belongs at the point where events enter the platform, so unwanted events never become incidents or consume analyst time. Form logic, access controls, and SLAs act on records that already exist.

Question 41Security Incident Response

Which table stores security incident records in ServiceNow Security Incident Response?

  1. sn_si_incident Correct answer.
  2. sn_si_task
  3. sn_si_playbook
  4. sn_si_observable

Explanation

Security incidents are persisted in the sn_si_incident table, which is the core record analysts work from in SIR. Related records such as tasks, observables, and playbook definitions live in separate tables that reference the incident.

Question 42Security Incident Response

In the default security incident lifecycle, which state immediately precedes Review?

  1. Recover Correct answer.
  2. Analysis
  3. Eradicate
  4. Containment

Explanation

The default lifecycle runs New, Analysis, Containment, Eradicate, Recover, Review, Closed. Recover therefore sits directly before Review, after the threat has been eradicated and systems restored.

Question 43Security Incident Response

Which role grants full administrative access to Security Incident Response configuration and records?

  1. sn_si.admin Correct answer.
  2. sn_si.read
  3. sn_si.manager
  4. sn_si.analyst

Explanation

The sn_si.admin role is the administrative role for SIR and can configure the application as well as work records. Analyst, read, and manager roles provide progressively narrower operational or oversight access without full configuration rights.

Question 44Security Incident Response

Which security incident field holds the external identifier used to correlate the record with the alerting system that raised it?

  1. Assignment group
  2. Short description
  3. Correlation ID Correct answer.
  4. Close code

Explanation

The Correlation ID field carries an identifier from the source system so repeated or related alerts map back to the same incident. Short description, assignment group, and close code serve unrelated purposes.

Question 45Security Incident Response

Which table stores the response tasks that belong to a security incident?

  1. sn_si_response_task
  2. sn_si_work_item
  3. sn_si_task Correct answer.
  4. sn_si_incident

Explanation

Response tasks in SIR are stored in sn_si_task, with each task referencing its parent incident. The incident itself lives in sn_si_incident, and the other listed names are not the SIR task table.

Question 46Security Incident Response

By default, security incident records are numbered with which prefix?

  1. SNI
  2. SIR Correct answer.
  3. INC
  4. SEC

Explanation

The default number series for security incidents uses the SIR prefix, producing values such as SIR0001001. The INC prefix belongs to ITSM incidents, and the other prefixes are not the SIR default.

Question 47Security Incident Response

Which interface is designed as the primary analyst workspace for Security Incident Response?

  1. ITSM Agent Workspace
  2. CMDB Workspace
  3. CSM Configurable Workspace
  4. SIR Workspace Correct answer.

Explanation

The SIR Workspace gives analysts a unified view of incidents, observables, tasks, and threat intelligence in one place. The other workspaces target customer service, ITSM agents, and configuration management respectively.

Question 48Security Incident Response

Security Incident Response is delivered as part of which ServiceNow product suite?

  1. Security Operations Correct answer.
  2. IT Service Management
  3. Governance Risk and Compliance
  4. IT Operations Management

Explanation

SIR belongs to the Security Operations suite alongside Vulnerability Response and Threat Intelligence. The other suites address service delivery, operations event management, and risk and compliance respectively.

Question 49Security Incident Response

Which record type does a SIEM integration typically ingest when it forwards a detection to SIR?

  1. Problem
  2. Vulnerability item
  3. Change request
  4. Security alert Correct answer.

Explanation

SIEM integrations bring detections in as security alerts, which can then be correlated or promoted into security incidents. Problems, change requests, and vulnerability items belong to other ServiceNow processes.

Question 50Security Incident Response

What is the main purpose of observable enrichment in SIR?

  1. To add threat intel context to an observable Correct answer.
  2. To convert observables into configuration items
  3. To close the incident once an observable is found
  4. To reassign the incident to the threat intel team

Explanation

Enrichment attaches threat intelligence context such as reputation, related indicators, and sightings so analysts can judge whether an observable is malicious. It does not alter ownership, close the incident, or create configuration items.