CIS-SIR practice test

1. Question 1 · 1

   What makes a playbook appear for a Security Incident if using Flow Designer?

   Choose one answer.

   • Actions defined to create tasks
   • Trigger set to conditions that match the security incident
   • Runbook property set to true
   • Service Criticality set to High

2. Question 2 · 1

   Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

   Choose one answer.

   • Get Network Statistics
   • Isolate Host
   • Get Running Processes
   • Publish Watchlist
   • Block Action
   • Sightings Search

3. Question 3 · 1

   Actions packaged in Scoped applications are called:

   Choose one answer.

   • Action Groups
   • Categories
   • Spokes
   • Subflows

4. Question 4 · 1

   When testing a flow, the action outcomes can be found where?

   Choose one answer.

   • Configuration Details
   • System Log
   • Execution Details
   • Content Record

5. Question 5 · 1

   Flow Logic in the baseline includes: (Choose two.)

   Choose all answers that apply.

   • For Each Loops
   • Interrupts
   • If Then conditions
   • Function Calls
   • Wait until

6. Question 6 · 1

   What contains a set of reusable operations that are designed to be used in multiple playbooks?

   Choose one answer.

   • Flows
   • Actions
   • Trigger
   • Subflows

7. Question 7 · 1

   What automates processes and supports triggers with a sequence of reusable actions?

   Choose one answer.

   • Subflows
   • Actions
   • Flows
   • Activities

8. Question 8 · 1

   Once a Phishing Email record is created, which Flow creates a new Security Incident record?

   Choose one answer.

   • Security Incident - Phishing Manual
   • Security Incident - Automated Phishing Playbook
   • Child Incident Automated Flow
   • Transform Phishing Email to Security Incident

9. Question 9 · 1

   When an inbound email is processed and identified as a phishing email what table is it stored in for URP v2?

   Choose one answer.

   • Security Incident Alert
   • Security Incident Phishing Email
   • Security Incident
   • Incident

10. Question 10 · 1

    In order to use User Reported Phishing v2, what must occur in Flow Designer?

    Choose one answer.

    • Transform Flow must be published
    • Transform Flow must be activated
    • Transform Action must be activated
    • Phishing Email Aggregation Subflow must be activated
    • Transform Flow must be copied and activated

11. Question 11 · 1

    When setting up a Playbook what field in the Flow Action for Creating a Response Task must contain the same value as the Runbook name?

    Choose one answer.

    • Short Description
    • Action
    • Runbook
    • Knowledge article

12. Question 12 · 1

    Which Table would be commonly used for Security Incident Response?

    Choose one answer.

    • sysapproval_approver
    • sec_ops_incident
    • cmdb_rel_ci
    • sn_si_incident

13. Question 13 · 1

    Runbook records utilize a link to what type record for content?

    Choose one answer.

    • Knowledge article
    • Response Tasks
    • Managed Document
    • Instruction Details

14. Question 14 · 1

    In a Flow, if the Create Response Task set Incident state V1 action is selected, what field contains the yes_no value that drives a question being asked in the playbook?

    Choose one answer.

    • Question Type
    • Outcome Type
    • SI State
    • Answer Type

15. Question 15 · 1

    Runbooks are used to create a relationship between what components? (Choose two.)

    Choose all answers that apply.

    • Events
    • Security Incident Response Task
    • Playbook Task
    • Alerts
    • Workflow Trigger
    • Knowledge article

Paid access to all 116 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.