Free CIS-VRM sample questions

Correct answer: The Tiering Assessment record for 'Tier 2' has a lower order number than the one for 'Tier 1'.

ServiceNow evaluates tiering rules based on the 'Order' field, starting with the lowest number. If the conditions for 'Tier 2' (handles PII) are met by a rule with a lower order number, the system will assign that tier and stop processing further rules, even if the third party also meets the criteria for the 'Tier 1' rule which has a higher order number. The other options are incorrect because the script include `VdrTiering` handles the logic but is driven by the rule configuration, a data policy would prevent saving but not mis-tier, and UI policies only affect the user interface.

Correct answers: Questionnaire Templates; Third-party Risk Assessment records; The Inherent Risk Questionnaire (IRQ)

To automate assessment generation based on inherent risk, you need three key elements: 1) The IRQ to gather the initial risk data, 2) The Questionnaire Templates that will be sent out, and 3) Third-party Risk Assessment records (often called Assessment Templates or Due Diligence Requests in this context) which act as the trigger records that link the IRQ responses to the specific questionnaires.

Correct answer: In the Weight field on the corresponding Risk Area records.

The weighting for different risk categories (e.g., Cybersecurity, Financial, Reputational) used in the overall risk score calculation is defined in the 'Weight' field on the Risk Area [sn_vdr_risk_asmt_risk_area] records. By setting the weight for 'Cybersecurity' higher than other areas, it will have a greater impact on the final aggregated score.

Correct answer: False

False. The `sn_vdr_risk.vendor_contact` role grants access to the portal, but visibility into specific assessments is controlled by adding the contact to the 'Assessment contacts' related list on the individual Third-party Risk Assessment record. A contact can only see and respond to assessments they are explicitly assigned to.

Correct answer: Performance Analytics with an Automated Indicator and a Breakdown by Tier.

Performance Analytics (PA) is the ideal tool for this requirement. An automated indicator can be configured to collect data on the duration between the specified states (using a script or indicator source). A breakdown by the third-party's tier will allow the analyst to filter the data specifically for the 'Critical' tier and track this trend over time. Standard reports are good for real-time lists but not for historical performance tracking and trend analysis.

Correct answer: A Flow Designer flow triggered by an issue update, with conditional logic to request approval.

Flow Designer is the modern and recommended approach for creating complex, conditional approval workflows. A flow can be triggered when an issue is created or updated. It can then use 'If' logic to check if the issue's severity is 'High' and the related third party's tier is 'Tier 1'. If both conditions are met, it can use the 'Ask for Approval' action to route the request to the specified user or group.

Correct answer: From the vendor risk issue, create a Risk and link it to the appropriate Control Objective.

The standard ServiceNow GRC process is to elevate a vendor risk issue into a formal Risk record in the Risk Register. This allows for comprehensive risk assessment, scoring, and treatment planning. The Risk record can then be directly associated with the specific Control Objective (e.g., a specific HIPAA control from the UCF), creating a clear audit trail from the assessment finding to the compliance framework.

Correct answer: A Field Map for the 'Country' field with 'Referenced value field name' set to 'name'.

When mapping a source field containing a display value (like a country name) to a target reference field, the correct approach is to use a standard Field Map and specify the 'Referenced value field name'. By setting this to 'name', you instruct the Transform Map to look up records in the referenced table (`core_country`) where the 'name' field matches the incoming source value, and then populate the target field with the sys_id of the found record.

Correct answer: To be completed internally to determine the initial risk level and tier of a third party.

The IRQ is an internal-facing questionnaire. Its primary purpose is for the business owner or relationship manager to provide information about the nature of the engagement with the third party (e.g., what data they will access, how they will connect). The answers are then used to calculate an inherent risk score and automatically determine the third party's tier, which in turn drives the level of due diligence required.

Correct answer: The user is not listed in the 'Assigned to' field on the assessment record.

While the `sn_vdr_risk_asmt.vendor_assessor` role provides the necessary permissions to perform the action, the 'Generate Observations' UI action has a condition that requires the logged-in user to be the individual specified in the 'Assigned to' field of that specific assessment record. This ensures that only the designated assessor can advance the assessment.