Question 1
What specific role is required in order to use the REST API Explorer?
- A. admin
- B. sn_si.admin
- C. rest_api_explorer
- D. security_admin
Show Answer
Correct Answer:
C. rest_api_explorer
Free CIS-SIR Sample Questions — Certified Implementation Specialist - Security Incident Response
Certified Implementation Specialist - Security Incident Response (CIS-SIR) is a specialist-level ServiceNow certification exam. The blueprint splits the exam across 5 domains, starting with Security Operations, Incident Response, Vulnerability Management. On exam day you face around 117 questions in 90 minutes, in formats such as multiple choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The CIS-SIR is rated medium in difficulty, and most candidates prepare with at least 12 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 117+ question PDF.
- 20 free questions
- 90 min
- $300 official fee
- blueprint vcurrent
- Every free question shows the correct answer
- Questions follow the official 5-domain blueprint
- No account or email required
- 117+ questions in the full PDF
Looking for more? Click here to get the full PDF with 117+ practice questions for $10 for offline study and deeper preparation.
Question 2
Which of the following tag classifications are provided baseline? (Choose three.)
- A. Traffic Light Protocol
- B. Block from Sharing
- C. IoC Type
- D. Severity
- E. Cyber Kill Chain Step
- F. Escalation Level
- G. Enrichment whitelist/blacklist
Show Answer
Correct Answer:
- A. Traffic Light Protocol
- B. Block from Sharing
- G. Enrichment whitelist/blacklist
Question 3
Which of the following process definitions allow only single-step progress through the process defined without allowing step skipping?
- A. SANS Stateful
- B. NIST Stateful
- C. SANS Open
- D. NIST Open
Show Answer
Correct Answer:
B. NIST Stateful
Question 4
When a Post-Incident Review report is created, it can be found...
- A. as a published article in a knowledge base
- B. as an unpublished article in a knowledge base
- C. as an attachment to the original security incident
- D. as an article pending approval in a knowledge base
Show Answer
Correct Answer:
C. as an attachment to the original security incident
Question 5
Security Incidents can be created using a manual UI Action on which one of the following record types?
- A. Event
- B. Email Notification
- C. Workflow
- D. Alert
Show Answer
Correct Answer:
D. Alert
Question 6
How does a user modify Risk Scores to suit their organizational needs?
- A. alter values in the Risk Score Configuration module
- B. amend constants in the RiskScoreUtil script include
- C. change the business impact for affected Business Services and Configuration Items
- D. recode logic in the Risk Score Calculator
Show Answer
Correct Answer:
A. alter values in the Risk Score Configuration module
Question 7
Events within the platform that are utilized for the creation of Alerts and/or Security Incidents are held in which table?
- A. sir_event
- B. sysevent
- C. em_event
- D. sys_event
Show Answer
Correct Answer:
C. em_event
Question 8
Select all of the following which are key features of Microsoft Defender for Endpoint. (Choose three.)
- A. Perform host enrichment actions to gather more information about the endpoint, which includes host details, logged-in users, and observable related machines details
- B. Find indicators of compromise (IoC) and enrich security incidents with threat intelligence data
- C. Perform Enterprise Security Search to sight potential malicious observables across endpoints, and take remediation actions
- D. Perform response actions such as Isolate host, Remove isolation, Restrict app execution, Run antivirus scan, Remove app restriction, and Stop and quarantine file
Show Answer
Correct Answer:
- A. Perform host enrichment actions to gather more information about the endpoint, which includes host details, logged-in users, and observable related machines details
- B. Find indicators of compromise (IoC) and enrich security incidents with threat intelligence data
- D. Perform response actions such as Isolate host, Remove isolation, Restrict app execution, Run antivirus scan, Remove app restriction, and Stop and quarantine file
Question 9
What is included in the real-time data model in the right pane of the Flow Designer UI that may be dragged and dropped into fields in the main flow workspace?
- A. Record Objects
- B. Table References
- C. Data Pills
- D. Code Snippets
Show Answer
Correct Answer:
C. Data Pills
Question 10
Which role must a user have to customize major security incident reports based on the incremental progress since last summary update?
- A. sn_msi.workspace_admin
- B. sn_msi.workspace_manager
- C. sn_msi.workspace_user
- D. sn_msim.workspace_manager
Show Answer
Correct Answer:
B. sn_msi.workspace_manager
Question 11
Which statement about Security Incident Calculators is correct?
- A. All Calculator Groups run in order but only the calculator with the highest order in that group runs
- B. All Calculator Groups run in order but only the first matching calculator from each group will apply
- C. All Calculator Groups run in order but only the first matching group will apply
- D. All Calculator Groups run in order and all calculators in the first matching group apply
Show Answer
Correct Answer:
B. All Calculator Groups run in order but only the first matching calculator from each group will apply
Question 12
A Post Incident Review can contain which of the following? (Choose three.)
- A. Post incident questionnaires
- B. An audit trail
- C. Attachments associated with the security incident
- D. Key incident fields
- E. Performance Analytics reports
Show Answer
Correct Answer:
- A. Post incident questionnaires
- B. An audit trail
- E. Performance Analytics reports
Question 13
LDAP, Direct Web Service, and SOAP are types of what?
- A. Integration methods
- B. Data mapping
- C. ServiceNow access protocol
- D. Reporting methods
Show Answer
Correct Answer:
A. Integration methods
Question 14
Why is it important that the Platform (System) Administrator and the Security Incident administrator role be separated? (Choose three.)
- A. Access to security incident data may need to be restricted
- B. Allow SIR Teams to control assignment of security roles
- C. Clear separation of duty
- D. Reduce the number of incidents assigned to the Platform Admin
- E. Preserve the security image in the company
Show Answer
Correct Answer:
- A. Access to security incident data may need to be restricted
- B. Allow SIR Teams to control assignment of security roles
- C. Clear separation of duty
Question 15
What is calculated as an arithmetic mean taking into consideration different values in the CI, Security Incident, and User records?
- A. Priority
- B. Business Impact
- C. Severity
- D. Risk Score
Show Answer
Correct Answer:
D. Risk Score
Question 16
If a desired pre-built integration cannot be found in the platform, what should be your next step to find a certified integration?
- A. Build your own through the REST API Explorer
- B. Ask for assistance in the community page
- C. Download one from ServiceNow Share
- D. Look for one in the ServiceNow Store
Show Answer
Correct Answer:
D. Look for one in the ServiceNow Store
Question 17
Runbook records utilize a link to what type record for content?
- A. Knowledge article
- B. Response Tasks
- C. Managed Document
- D. Instruction Details
Show Answer
Correct Answer:
A. Knowledge article
Question 18
Select the one capability that restricts connections from one CI to other devices.
- A. Isolate Host
- B. Sightings Search
- C. Block Action
- D. Get Running Processes
- E. Get Network Statistics
- F. Publish Watchlist
Show Answer
Correct Answer:
A. Isolate Host
Question 19
What is the main goal of the Security Incident Response process?
- A. Automate set processes
- B. Reduce time to contain
- C. Save the company money
- D. Minimize impact
Show Answer
Correct Answer:
B. Reduce time to contain
Question 20
Flow Logic in the baseline includes: (Choose two.)
- A. For Each Loops
- B. Interrupts
- C. If Then conditions
- D. Function Calls
- E. Wait until
Show Answer
Correct Answer:
- A. For Each Loops
- C. If Then conditions
CIS-SIR sample questions FAQ
Are these CIS-SIR sample questions from the real exam?
No. They are original practice questions written to match the format and topic mix of the Certified Implementation Specialist - Security Incident Response exam, which contains around 117 questions. Treat them as representative practice, not leaked exam content.
How many free CIS-SIR sample questions do I get?
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 117+ questions.
Do the sample questions include the correct answers?
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Is 20 sample questions enough to pass the CIS-SIR?
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 117+ question set under timed conditions before booking the exam.
Aced these? Get the Full Exam
Download the complete CIS-SIR study bundle with 117+ questions in a single printable PDF.