CIS-SIR Practice Test

CIS-SIR Practice Test practice questions, page 5 of 5, with answer review and explanations.

Question 21

What does a flow require?

  1. Security orchestration flows
  2. Runbooks
  3. CAB orders
  4. A trigger

Question 22

Knowledge articles that describe steps an analyst needs to follow to complete Security incident tasks might be associated to those tasks through which of the following?

  1. Work Instruction Playbook
  2. Flow
  3. Workflow
  4. Runbook
  5. Flow Designer

Question 23

Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?

  1. SANS Stateful
  2. NIST Stateful
  3. SANS Open
  4. NIST Open

Question 24

If the customer’s email server currently has an account setup to report suspicious emails, then what happens next?

  1. an integration added to Exchange keeps the ServiceNow platform in sync
  2. the ServiceNow platform ensures that parsing and analysis takes place on their mail server
  3. the customer’s systems are already handling suspicious emails
  4. the customer should set up a rule to forward these mails onto the ServiceNow platform

Question 25

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security incident?

  1. Post Incident Activity
  2. Detection & Analysis
  3. Preparation and Identification
  4. Containment, Eradication, and Recovery