Free CIS-RC sample questions

Correct answers: Create a Policy Acknowledgement campaign.; Configure the 'Acknowledgement Audience' on the Policy record.

Policy Acknowledgement campaigns are the specific feature designed to send out requests for users to acknowledge that they have read and will comply with a policy. It tracks responses and manages reminders.

The 'Acknowledgement Audience' related list on the Policy record is where you define who needs to acknowledge the policy. This can be based on user groups (like 'Database Administrators'), roles, or individual users, and is a prerequisite for launching the campaign.

Correct answer: False

An Entity Class can be created on any table in ServiceNow, not just those extending from [cmdb_ci]. This allows organizations to define entities from tables like Core Company [core_company], Department [cmn_department], or even custom tables, providing flexibility to model the organization's structure.

Correct answer: The Risk Heatmap is configured to display the 'Residual Score' instead of the 'Inherent Score'.

Risk Heatmaps can be configured to plot risks based on either their inherent (pre-control) or residual (post-control) scores. Given that the controls are highly effective (90%), the residual score would be significantly lower than the inherent score. This would correctly place the risk in a lower-risk quadrant on a heatmap configured to show residual risk.

Correct answer: Create the 'Code of Conduct' as a parent policy and create the three regional 'Acceptable Use' policies as child policies linked to it.

Using the parent/child policy relationship is the designed best practice for this scenario. It allows for a clear hierarchy, separate ownership and review cycles for the regional child policies, and the ability to link common controls from the parent down to the children. This structure is scalable and easy to navigate.

Correct answer: sn_compliance.user

The sn_compliance.user role provides the correct baseline of permissions. It allows users to interact with compliance records, such as responding to requests and creating evidence, but does not grant high-level administrative or managerial permissions like approving exceptions or changing control states. It is the ideal starting point to clone for a junior analyst role.

Correct answer: Create an Entity Type and manually add the 30 department records to the Entities related list.

The Entity Type approach is ideal for this scenario. It is designed for creating a manually curated collection of entities that may not be easily grouped by a simple filter condition. Since the list of 30 departments is small and maintained by a specific team, an Entity Type provides a direct and simple way to group them for GRC purposes.

Correct answer: Creating, updating, and retiring Entities based on Entity Class filter conditions.

This scheduled job runs periodically to evaluate the filter conditions on all active Entity Classes. It creates new Entity (Profile) records for source records that now match the filter, retires Entities whose source records no longer match, and updates existing Entities if their source data has changed.

Correct answers: Accept; Mitigate

Accept is a standard risk response strategy where the organization acknowledges the risk and decides not to take any action to reduce it, often because the cost of mitigation outweighs the potential loss.

Mitigate is a common risk response strategy that involves implementing controls or countermeasures to reduce the likelihood or impact of the risk.

Correct answer: Create one Audit Engagement, add the 50 applications as Entities in scope, and generate control tests for the single control against all 50 entities.

This is the designed and most efficient process. A single Audit Engagement can scope multiple entities. The system can then automatically generate individual control test tasks for the 'Quarterly User Access Review' control for each of the 50 application entities, allowing for parallel execution and centralized tracking within one engagement.

Correct answer: Use a combination of hierarchical Entity Classes for regions and a separate, non-hierarchical Entity Class for financial systems. Use GRC User Group ownership and ACLs for regional security.

This hybrid approach is the most robust. The hierarchical Entity Classes for regions allow for both regional-specific control scoping and global roll-up reporting. A separate, flat Entity Class for financial systems provides a clear, dynamic group for applying SOX controls globally. Security can then be managed effectively using User Groups (e.g., 'EU Compliance Managers') assigned as owners to the regional entities, combined with ACLs to enforce visibility, satisfying all requirements.