ServiceNow CIS-SIR Exam Prep
Certified Implementation Specialist - Security Incident Response (Page 10 )

• sn_si_admin is an SIR administrator role.
• The prefix helps prevent naming conflicts between applications.
• It does not refer to a “Secure Identity token” or an instance security check.

• Record changes — a flow can start when a record is updated or otherwise changes.
• Schedules — a flow can run at a specified date/time or on a schedule.
• Record inserts — a flow can start when a new record is created.

• Subflows are reusable flow components called by another flow; they are not normally trigger types.
• Record views do not generally initiate a Flow Designer flow.

• Post-Incident Review (A) is the after-action step used to capture lessons learned, identify process gaps, and drive improvements across the incident response lifecycle. This directly supports process maturity and a stronger security posture.
• Incident Analysis (D) focuses on investigating root causes during/after an incident, which is important but more of a diagnostic activity than a standalone baseline improvement to maturity.
• Fast Eradication (B) and Incident Containment (C) are tactical actions aimed at stopping the incident, not on maturing the process.

• terraform init is normally required first, especially for a new or changed working directory. It installs providers/modules and configures the backend.
• terraform plan previews the proposed changes.
• terraform apply applies those changes. It also creates a plan internally if you have not supplied a saved plan.

text 
terraform init 
terraform validate       # optional but recommended 
terraform plan 
terraform apply

• B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.
• C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.
• D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

• Tokens: Individual units of text processed by a model, such as words, subwords, or characters.
• Models: Systems that learn patterns and generate predictions or outputs.
• Binaries: Data represented using the binary number system, not semantic representations.

• Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.
• Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.
• DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

• Azure Machine Learning Studio is designed to build, test, train, and deploy machine-learning models, including predictive analytics.
• Azure Cosmos DB is a globally distributed NoSQL database. It can store data used by an AI solution, but it is not the primary service for developing and deploying predictive models.
• Therefore, the appropriate recommendation is Azure Machine Learning Studio, as shown in Question 15.

• Filtering harmful or inappropriate content
• Blocking specified topics
• Detecting and masking sensitive information
• Enforcing content policies suitable for children

• Amazon Rekognition analyzes images and videos; it does not control text generated by a language model.
• Amazon Bedrock playgrounds are for testing models and prompts, not enforcing production safety policies.
• Agents for Amazon Bedrock help models complete tasks and use tools; they do not primarily provide content-safety controls.

• LastName: Required.
• FirstName: Optional.
• AccountId: Optional; a Contact may be associated with an Account later or remain private, depending on organization settings.
• Name: A compound display field made from first and last name; it isn’t entered as a separate field.

• Relationship cardinality:

• Filter direction:

• Active versus inactive relationships: only active relationships automatically propagate filters.
• Blank or unmatched values: a fact-table value without a matching dimension row can create the model’s blank/unknown member.
• Uniqueness: the “one” side must contain unique values; duplicate keys generally belong on the “many” side.

• Layer 1: Check cables, power, and link lights.
• Layer 2: Check switching, VLANs, and MAC learning.
• Layer 3: Check IP addressing, routing, and gateways.
• Higher layers: Check services, applications, and user settings.

• Create a plan of action: Decide how to implement the fix.
• Implement the solution: Apply the selected fix.
• Verify functionality: Confirm the problem is resolved and systems work normally.

1. Search & Intelligence in the Microsoft 365 admin center — No

1. Audit in the Microsoft Defender portal — Yes

1. Audit in the Microsoft Purview portal — Yes

• Note the question number before leaving—for example, Question 38.
• Use the exam’s question navigator or Back/Previous button to return to that number.
• If you close or refresh the page, your position may not be saved, depending on the site. Reopen the page and select the question number again.
• Avoid using the browser’s Back button if it causes the exam page to reload; use the exam’s built-in navigation instead.

• Annual interest payments net of tax relief (A): future cash outflows for the issuer.
• Redemption value (B): the final cash outflow when the bond is redeemed.
• Market value now (C): the cash proceeds received now, acting as the initial cash flow in the IRR calculation.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• Power BI dataset — Reuses the existing tables, relationships, and measures. You mainly create new visualizations.
• SharePoint folder — Connects to the source files, but you would need to rebuild the model and measures.
• Power BI dataflows — Primarily provide reusable data preparation; they do not automatically provide the existing report’s measures and model.
• Excel workbook — Requires reconnecting to and modeling the source data again.

• Data Cloud combines data from multiple systems.
• It resolves and organizes that data into a unified customer view.
• That unified view enables downstream actions such as personalized campaigns, segmentation, analytics, and activation.

• A = core platform value
• D = a resulting business use case or benefit

• Root path cost
• Port priority
• Port ID

text 
interface GigabitEthernet0/1 
 spanning-tree vlan 10 port-priority 64

• Interface number: Helps form the port ID but is not normally configured as the preference value.
• VLAN priority: Not used to select a preferred forwarding interface.
• Hello time: Controls how often BPDUs are sent; it does not select a preferred port.

• Crash cart: Provides local physical access, not remote access.
• Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.
• Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

• httprint fingerprints Web servers by analyzing their HTTP responses. It can help identify the Web server type and sometimes its version, even when the banner has been modified or hidden.
• Wget is mainly used to download files or Web content.
• WinSSLMiM is associated with SSL man-in-the-middle testing.
• Whisker is an older Web-server vulnerability assessment tool, especially associated with IIS, rather than the expected banner-grabbing tool here.

1. Write a structured log entry to CloudWatch Logs containing:

1. Create a CloudWatch Logs metric filter that:

text 
ApiRequests 
Operation=GetOrders 
ResponseCode=500 
Version=2.4.0

• B is incorrect: CloudWatch Logs Insights queries analyze logs but do not directly publish metrics in this manner.
• C is incorrect: ALB access logs do not contain arbitrary Lambda response metadata as custom fields.
• D is incorrect: X-Ray traces and insights are not the appropriate mechanism for creating these custom, dimensioned application metrics.

• Company documents
• Databases
• Knowledge bases
• Current web or business data

• A: Describes diversity and inclusive design, not grounding.
• B: Describes explainability or model interpretability.
• D: Describes documenting a model’s capabilities and limitations.

• Suporta domínios personalizados.
• Oferece 50 GB de armazenamento — suficiente para os 10 GB de cada aplicação.
• Usa instâncias de computação dedicadas.
• Inclui balanceamento de carga entre instâncias.
• É o plano mais econômico entre as opções que atendem a todos esses requisitos.

• The users currently have Office 365 Enterprise E3 licenses assigned directly.
• Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.
• From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

• Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.
• Set-AzureAdUser does not remove product licenses.
• Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

• FTP — Transfers files using a client/server model and supports authentication. It uses separate control and data connections.
• TFTP — A very simple file-transfer protocol with no authentication and minimal features. Commonly used to transfer router or switch configuration files and IOS images.
• SCP — Securely copies files over SSH. It provides encryption and authentication.
• SFTP — Also transfers files securely through SSH, but provides more file-management capabilities than traditional SCP.
• HTTP/HTTPS — Primarily web protocols, but can also download files; HTTPS encrypts the session.

• TFTP = simple, unauthenticated file transfer
• FTP = file transfer with authentication, but not inherently encrypted
• SCP/SFTP = secure file transfer using SSH

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• Actions that call external APIs
• Subflows
• Connection and credential aliases
• Supporting integration logic

• Action — A reusable operation within a flow, such as “Create a record” or “Send email.”
• Connection — Defines how ServiceNow authenticates and communicates with an external system.
• Integration step — A general flow step, not the name for the packaged integration.

• Create the field in the CRM on the relevant person records—typically Lead and Contact in Salesforce.
• Give the Marketo Sync User read/write access to the field.

• Reporting relationships
• Organizational structures
• Leadership styles
• Team maturity
• Individual and group behavior
• Communication and motivation

• Acquire Project Team: Focuses on obtaining the people needed for the project.
• Develop Project Team: Focuses on improving team skills, relationships, and performance.
• Manage Project Team: Focuses on tracking performance, resolving issues, and managing changes within the team.

1. Initiate — establish the project, scope, team, and governance.
2. Plan — develop the detailed plan, schedule, resources, and implementation approach.
3. Execute — configure, integrate, migrate, test, and prepare the solution.
4. Deploy — move the solution into production and support go-live.
5. Close — complete handover, confirm outcomes, and formally close the project.

• MFA: Protects sign-in and authentication.
• Azure Key Vault: Protects deployment secrets and credentials.
• Answer: No (B).

• Domain controllers, because the requirement specifically excludes them. However, note that both member servers and domain controllers run Windows Server, so OS targeting alone cannot distinguish them unless the targeting option allows selecting the relevant server role/version. In the usual exam interpretation, target the applicable server OS category.
• Client computers, because they run a client Windows operating system.

• Domain: Targets membership in a domain, not the computer’s operating-system type.
• Security Group: Would require creating and maintaining a group containing all member servers, increasing administrative effort.
• Environment Variable: Not designed to reliably identify member servers.

• Set credit quotas for an account or individual virtual warehouses.
• Define monitoring intervals.
• Trigger actions when usage reaches thresholds, such as sending notifications or suspending a warehouse.
• Help control unexpected warehouse spending.

• Account Usage: Provides historical usage and billing data; it does not enforce credit limits.
• Warehouse Limit Parameter: Not the Snowflake object used for account-wide credit controls.
• Credit Consumption Tracker: Not a standard Snowflake object.

• Due diligence: Investigating and evaluating a third party before entering into or continuing a business relationship.
• Attestation: An independent party provides assurance about an organization’s claims or controls. A SOC 2 examination is an example of an attestation engagement, but the analyst requesting and reviewing the report is performing due diligence.
• Internal audit: Reviews the organization’s own internal controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• When the MVP will be defined — the MVP should already be understood sufficiently when assessing the business case.
• What the MVP is — useful information, but not the key requirement tested here.
• That the MVP is the same as project viability — incorrect. The MVP helps test viability; it is not identical to viability itself.

• The vulnerability scan identifies a vulnerability.
• The administrator verifies that the vulnerability is not present.
• Therefore, the scan produced a false positive.

• True positive: A vulnerability is reported and genuinely exists.
• False negative: A vulnerability exists, but the scan fails to detect it.
• True negative: No vulnerability exists, and the scan correctly reports no issue.

• PC A: 192.168.1.10/24
• PC B: 192.168.2.10/24

• Both PCs have a correct default gateway
• A router or Layer 3 switch connects the subnets
• Routing and firewall rules allow the traffic

• Due diligence: Researching and evaluating a third party before entering or continuing a business relationship.
• Internal audit: Evaluates controls within the organization itself.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A formal statement or report—such as a SOC 2 report—provided by an independent party about an organization’s controls.

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• A user connects with their Google account.
• Google associates the user’s SSH key with that identity.
• IAM roles determine whether they can log in.
• Access can be tied to a specific employee for auditing.
• Removing the IAM role removes their login access.

• compute.osLogin: regular OS login access
• compute.osAdminLogin: OS login with administrative privileges, typically including sudo

text 
enable-oslogin=TRUE

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• Highly polished, organization-wide presentations
• Advanced dashboard design and customization
• Broader business-user distribution and interaction
• Specialized BI governance and modeling features

• A — If there is no demand, there should be no production.

• B — Not all sales equal profit.

• C — Stocking up on inventory is bad for business.

• D — All costs, except materials, are considered fixed.

• E — Departments should operate at full capacity regardless of bottlenecks.

• Transport and handling
• Storage and warehousing
• Refrigeration
• Shelf-stacking or replenishment
• Other costs directly attributable to product P

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but it is not the primary control for switch-port MAC learning.
• NGFW: Protects at network boundaries but does not directly limit MAC addresses learned on access ports.

• A business-hours greeting
• An after-hours greeting
• A holiday greeting

• Weekday evenings/nights
• Saturdays and Sundays

1. Auto attendant 1

1. Auto attendant 2

• Response and resolution time frames
• Availability or uptime requirements
• Performance targets
• Support obligations
• Penalties for failing to meet requirements

• SOW (Statement of Work): Defines the project’s scope, tasks, and deliverables.
• MOA (Memorandum of Agreement): Describes cooperation and responsibilities between parties.
• MOU (Memorandum of Understanding): Records a general mutual understanding, usually without detailed enforceable service targets.

• Document feeder: A scratch, dirt, or debris on the feeder glass or rollers can create a line on every scanned image.
• Pickup rollers: Move paper through the printer; they would not normally create a scanner-only line.
• Corona wire: Affects toner charging and would cause defects on printed output.
• Drum assembly: Also affects printed pages, so faxes and computer print jobs would show the line too.