A Post Incident Review can contain which of the following? (Choose three.)
APost incident questionnaires
BAn audit trail
CAttachments associated with the security incident
DKey incident fields
EPerformance Analytics reports
Events received from external tools should include what information? (Choose three.)
AA list of similar indicators that were discovered in the event details
BEvent description, which populates the description of the security incident
CEvent classification set to Security to distinguish them from other IT events
DWhitelisted and Blacklisted IP addresses
ENode set to the name, IP address, or sys_id of the CI that becomes the affected resource
Why should discussions focus with the end in mind?
ATo understand desired outcomes
BTo understand current posture
CTo understand customer’s process
DTo understand required tools
Chief factors when configuring auto-assignment of Security Incidents are __________.
AAgent group membership, Agent location and time zone
BSecurity incident priority, CI Location and agent time zone
CAgent skills, System Schedules and agent location
DAgent location, Agent skills and agent time zone
Which ServiceNow automation capability extends Flow Designer to integrate business processes with other systems?
AWorkflow
BOrchestration
CSubflows
DIntegration Hub
If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?
ABuild your own through the REST API Explorer
BAsk for assistance in the community page
CDownload one from ServiceNow Share
DLook for one in the ServiceNow Store
The time zone of a CI is determined by:
AThe time zone setting on the computer
BThe time zone field on the Clock
CThe time zone of the asset owner
DThe time zone of the location
The following term is used to describe any observable occurrence: __________.
AIncident
BLog
CTicket
DAlert
EEvent
There are several methods in which security incidents can be raised, which broadly fit into one of these categories: __________. (Choose two.)
AIntegrations
BManually created
CAutomatically created
DEmail parsing
What is the key to a successful implementation?
ASell customer the most expensive package
BImplementing everything that we offer
CUnderstanding the customer’s goals and objectives
DBuilding custom integrations
Risk Score weighting uses which of the following components? (Choose two.)
ABusiness impact of a CI or Security Incident
BSeverity and Priority of a Security incident
CCost and Risk of an affected service
DSLA and Schedule of an impacted service
EImpact and Urgency of a Security incident
Select all of the following which are the target personas for MITRE ATT&CK 2.0? (Choose three.)
ASOC Managers and CISO
BSecurity and Threat Intelligence Administrators
CSecurity Analysts
DCompliance Managers
EPenetration Testers
How does a user modify Risk Scores to suit their organizational needs?
Aalter values in the Risk Score Configuration module
Bamend constants in the RiskScoreUtil script include
Cchange the business impact for affected Business Services and Configuration Items
Drecode logic in the Risk Score Calculator
What are some of the ways SIR teams can increase their productivity? (Choose three.)
ARed/Blue automation
BExport to spreadsheet pivot tables
CProcess automation
DTraining
EForm personalization
How can you create a new record using the REST API?
AUsing a PATCH request
BUsing a POST request
CUsing a PUT request
DUsing a GET request
Which role must a user have to customize major security incident reports based on the incremental progress since last summary update?
Asn_msi.workspace_user
Bsn_msi.workspace_responder
Csn_msim.workspace_responder
Dsn_msi.workspace_manager
Who is responsible for identifying security incidents?
AEveryone
BManagers
CIT personnel
DSecurity analysts
Select all of the following which are key features of the Malware Information Sharing Platform (Choose three.)
ADedicated MISP workspace for managing major security incidents
BAuto-extract MITRE-ATT&CK™ information from MISP attributes and associate them to SIR security incidents
CAttribute enrichment including adding or updating tags, galaxies, or attributes
DSend malware to MISP for detonation
EAdd security incident associated observables as attributes to a MISP event
Which security tag should be used when a piece of information cannot be effectively acted upon by additional parties, and could lead to impacts on a party’s privacy, reputation, or operations if misused?
ATLP:WHITE
BTLP:RED
CTLP:GREEN
DTLP:AMBER
What is one of the Security Incident Response Team’s activities?
APatch vulnerabilities
BEscalate incidents to security incidents
CMonitor security alerts
DPenetration testing
Which of the following State Flows are provided for Security Incidents? (Choose three.)
ANIST Open
BSANS Open
CNIST Stateful
DSANS Stateful
What is the purpose of Calculator Groups as opposed to Calculators?
ATo provide metadata about the calculators
BTo allow the agent to select which calculator they want to execute
CTo set the condition for all calculators to run
DTo ensure one at maximum will run per group
What are two of the audiences identified that will need reports and insight into Security Incident Response reports? (Choose two.)
AAnalysts
BVulnerability Managers
CChief Information Security Officer (CISO)
DProblem Managers
What makes a playbook appear for a Security Incident if using Flow Designer?
AActions defined to create tasks
BTrigger set to conditions that match the security incident
CRunbook property set to true
DService Criticality set to High
The severity field of the security incident is influenced by what?