CIS-SIR Practice Test

CIS-SIR practice test: what's covered

• Security Incident Response
• Threat Intel
• Playbooks
• Integrations
• Workflows
• Dashboards

Free CIS-SIR sample questions

1. An implementation team is mapping SIEM alerts into ServiceNow Security Incident Response records. Which response is the BEST fit?

   • A. Map incoming alerts to security incidents, observables, affected CIs, severity, and source fields using the SIR data model
   • B. Import every alert as a normal IT incident with no security fields
   • C. Store all alert content only in a free-text work note
   • D. Create a new custom table before reviewing SecOps tables
   Show answer

   Correct: A. Map incoming alerts to security incidents, observables, affected CIs, severity, and source fields using the SIR data model is the best answer because the SIR data model already provides security incident, observable, source, and CMDB relationships. The other choices do not fit the scenario: Import every alert as a normal IT incident with no security fields addresses the wrong layer or timing, Store all alert content only in a free-text work note skips a required control, and Create a new custom table before reviewing SecOps tables would create avoidable operational or security risk.

2. A security incident must show the affected business service and owner for prioritization. Which response is the BEST fit?

   • A. Relate the security incident to CMDB configuration items and business services with ownership data
   • B. Use only the short description to list the owner manually
   • C. Create a spreadsheet outside ServiceNow for every incident
   • D. Ignore CMDB because security incidents cannot reference CIs
   Show answer

   Correct: A. Relate the security incident to CMDB configuration items and business services with ownership data is the best answer because CMDB relationships let SecOps calculate impact and route work more accurately. The other choices do not fit the scenario: Use only the short description to list the owner manually addresses the wrong layer or timing, Create a spreadsheet outside ServiceNow for every incident skips a required control, and Ignore CMDB because security incidents cannot reference CIs would create avoidable operational or security risk.

3. The customer wants incidents grouped when the same observable appears across many alerts. Which response is the BEST fit?

   • A. Use observables and related lists to correlate incidents by IP, URL, hash, user, or host indicators
   • B. Duplicate the same observable as plain text in each task only
   • C. Close all but the first alert without correlation evidence
   • D. Use HR profile photos as the correlation key
   Show answer

   Correct: A. Use observables and related lists to correlate incidents by IP, URL, hash, user, or host indicators is the best answer because observables are designed to capture and correlate security indicators. The other choices do not fit the scenario: Duplicate the same observable as plain text in each task only addresses the wrong layer or timing, Close all but the first alert without correlation evidence skips a required control, and Use HR profile photos as the correlation key would create avoidable operational or security risk.

4. A SecOps architect is designing severity calculation. Which TWO choices should the engineer select? (Choose TWO)

   • A. Consider source severity, asset criticality, and confidence
   • B. Make the calculation transparent so analysts can understand prioritization
   • C. Set every imported event to critical by default
   • D. Base severity only on record creation time
   Show answer

   Correct: A and B. Consider source severity, asset criticality, and confidence and Make the calculation transparent so analysts can understand prioritization are correct because security incident severity should combine threat and business context in a defensible way. The distractors do not satisfy the requirement: Set every imported event to critical by default is incomplete for this case, and Base severity only on record creation time solves a different problem or weakens the design.

5. A team is tempted to customize core SIR tables heavily during week one. Which response is the BEST fit?

   • A. Prefer configuration and extension points first, documenting any customization with upgrade impact
   • B. Modify core tables directly without design review
   • C. Disable all ServiceNow updates to protect customization
   • D. Build the entire SIR workflow in email instead
   Show answer

   Correct: A. Prefer configuration and extension points first, documenting any customization with upgrade impact is the best answer because ServiceNow implementations should minimize upgrade-risk customizations when configuration can satisfy requirements. The other choices do not fit the scenario: Modify core tables directly without design review addresses the wrong layer or timing, Disable all ServiceNow updates to protect customization skips a required control, and Build the entire SIR workflow in email instead would create avoidable operational or security risk.

Last updated: 2026-10-19

CIS-SIR practice test FAQ