Free CIS-VR sample questions

Correct answer: Submit an Exception Request from the Vulnerable Item, specifying a reason and a requested end date for the deferral.

The correct, out-of-the-box process for deferring a valid vulnerability is to use the Exception Management feature. From the Vulnerable Item (VIT), the user can request an exception, which formally documents the reason for the deferral, any compensating controls, and a requested duration. This request then goes through a formal approval process, providing an audit trail. Marking as a false positive is incorrect because the vulnerability is real. Closing it would remove it from active tracking. Changing the state to 'In Review' is not the final step for deferral.

Correct answers: A report source on the Vulnerable Item [sn_vul_vulnerable_item] table.; A report that uses a 'Group by' on the 'Configuration item.Business Service' field.; A filter condition on the report source for 'Risk Rating is Critical' AND 'State is not Closed'.

Correct answer: Application Vulnerability Response (AVR)

Application Vulnerability Response (AVR) is the specific ServiceNow module designed to ingest, track, and manage vulnerabilities found in application code by tools like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scanners. CVR is for container images, ITOM VR is a broader term, and Configuration Compliance deals with misconfigurations, not code-level vulnerabilities.

Correct answer: True

This is true. The 'Vulnerability Import since' property for the Tenable.io integration is set to 90 days by default. This is a configurable setting designed to prevent the import of a massive amount of historical, potentially irrelevant vulnerability data on the first run. Administrators can and often should adjust this value based on their specific requirements.

Correct answer: Vulnerability Calculator Group

Vulnerability Calculator Groups contain one or more Vulnerability Calculators that define how the risk score is calculated. To add custom logic, such as increasing the score based on a CI's relationship to a business service, you would typically clone the default calculator and modify its script. This script can query related records (like the Business Service) and adjust the score accordingly. This modified calculator is then made active within the group.

Correct answer: A Flow Designer flow triggered by the update of the Vulnerability Group record.

Flow Designer is ServiceNow's modern, low-code solution for process automation. It is the ideal tool for this scenario. A flow can be configured with a trigger that runs whenever a Vulnerability Group record is updated and its 'State' field changes to 'Awaiting Change'. The flow can then use the 'Create Record' action to generate a new change request, populating its fields with data from the vulnerability group.

Correct answer: Breakdown

In Performance Analytics, a Breakdown is used to group or filter indicator scores for more detailed analysis. To see MTTR (the Indicator) by operating system, you would create a Breakdown based on the 'Operating System' field of the Configuration Item table. This allows users to view the overall MTTR score and then drill down to see the scores for Windows, Linux, etc., individually.

Correct answer: Vulnerability, Application Name, and Branch Name

For Application Vulnerable Items (AVIs), ServiceNow needs to distinguish the same vulnerability (e.g., a specific CWE) across different codebases. The unique key is typically a combination of the specific vulnerability identifier (from the scanner), the application or repository being scanned, and the specific branch where the vulnerability was found. This allows for tracking the same SQL injection flaw in the 'main' branch and a 'feature' branch as two distinct AVIs.

Correct answer: Set the 'Order' of the FQDN rule to be lower than the NetBIOS and IP Address rules.

CI Lookup Rules are processed in ascending order. By setting the 'Order' field of the most reliable rule (FQDN) to a lower number (e.g., 100) than the other rules (e.g., NetBIOS at 200, IP at 300), you ensure it runs first. The matching process stops as soon as a successful match is found. Therefore, if the FQDN rule succeeds, the subsequent, less reliable rules will not be executed for that Discovered Item.

Correct answer: A higher-priority (lower order number) assignment rule with broad conditions is matching first.

Assignment rules are executed in order, from the lowest 'Order' number to the highest. A common issue is having a generic, catch-all rule (e.g., 'Assign all Windows vulnerabilities to IT Support') with a low order number. This rule matches the VITs before a more specific rule (e.g., 'Assign vulnerabilities on servers with Support Group X to Team Y') gets a chance to run. The solution is to ensure specific rules have a lower order number than generic ones.