Free CIS-VR sample questions

Correct answer: Create a new CI Lookup Rule with a high order number that specifically maps the 'Source FQDN' from the Discovered Item to the 'name' field on the `cmdb_ci_server` table.

The most effective and scalable solution is to create a new, high-priority CI Lookup Rule. This rule explicitly tells the matching engine how to correlate the data provided by the scanner (FQDN) with the data in the CMDB (`name` field on the server table). This automates the process correctly for all future imports. Manual reassignment is not scalable. Modifying the base table or the integration itself is more complex and less aligned with best practices than using the built-in lookup rule functionality.

Correct answer: Two separate rules: one for high CVSS assigning to 'Tier 3 Security', and a second, lower-order rule for EMEA databases assigning to 'EMEA DB Admin'.

ServiceNow assignment rules are processed in order. The most effective way to handle this is with two separate rules. The first rule (with a lower order number, e.g., 100) should have the condition 'CVSS Score >= 9.0' and assign to 'Tier 3 Security'. The second rule (with a higher order number, e.g., 200) would handle the condition for Oracle DBs in specific locations and assign to 'EMEA DB Admin'. This ensures the high-criticality override is always processed first. Trying to combine this logic into a single rule with complex OR/AND conditions is prone to error and less maintainable.

Correct answer: Submit an Exception Request from the Vulnerable Item, specifying a reason and a requested end date for the deferral.

The correct, out-of-the-box process for deferring a valid vulnerability is to use the Exception Management feature. From the Vulnerable Item (VIT), the user can request an exception, which formally documents the reason for the deferral, any compensating controls, and a requested duration. This request then goes through a formal approval process, providing an audit trail. Marking as a false positive is incorrect because the vulnerability is real. Closing it would remove it from active tracking. Changing the state to 'In Review' is not the final step for deferral.

Correct answers: A report source on the Vulnerable Item [sn_vul_vulnerable_item] table.; A report that uses a 'Group by' on the 'Configuration item.Business Service' field.; A filter condition on the report source for 'Risk Rating is Critical' AND 'State is not Closed'.

Correct answer: Application Vulnerability Response (AVR)

Application Vulnerability Response (AVR) is the specific ServiceNow module designed to ingest, track, and manage vulnerabilities found in application code by tools like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scanners. CVR is for container images, ITOM VR is a broader term, and Configuration Compliance deals with misconfigurations, not code-level vulnerabilities.

Correct answer: True

This is true. The 'Vulnerability Import since' property for the Tenable.io integration is set to 90 days by default. This is a configurable setting designed to prevent the import of a massive amount of historical, potentially irrelevant vulnerability data on the first run. Administrators can and often should adjust this value based on their specific requirements.

Correct answer: Vulnerability Calculator Group

Vulnerability Calculator Groups contain one or more Vulnerability Calculators that define how the risk score is calculated. To add custom logic, such as increasing the score based on a CI's relationship to a business service, you would typically clone the default calculator and modify its script. This script can query related records (like the Business Service) and adjust the score accordingly. This modified calculator is then made active within the group.

Correct answer: A Flow Designer flow triggered by the update of the Vulnerability Group record.

Flow Designer is ServiceNow's modern, low-code solution for process automation. It is the ideal tool for this scenario. A flow can be configured with a trigger that runs whenever a Vulnerability Group record is updated and its 'State' field changes to 'Awaiting Change'. The flow can then use the 'Create Record' action to generate a new change request, populating its fields with data from the vulnerability group.

Correct answer: Breakdown

In Performance Analytics, a Breakdown is used to group or filter indicator scores for more detailed analysis. To see MTTR (the Indicator) by operating system, you would create a Breakdown based on the 'Operating System' field of the Configuration Item table. This allows users to view the overall MTTR score and then drill down to see the scores for Windows, Linux, etc., individually.

Correct answer: Vulnerability, Application Name, and Branch Name

For Application Vulnerable Items (AVIs), ServiceNow needs to distinguish the same vulnerability (e.g., a specific CWE) across different codebases. The unique key is typically a combination of the specific vulnerability identifier (from the scanner), the application or repository being scanned, and the specific branch where the vulnerability was found. This allows for tracking the same SQL injection flaw in the 'main' branch and a 'feature' branch as two distinct AVIs.