CIS-SIR practice examsIn development
ServiceNow Certified Implementation Specialist - Security Incident Response
The security operations line, where ServiceNow meets the SOC: the security incident as a record separate from an ITSM incident with restricted access, observables and the response lifecycle where containment precedes eradication, enrichment supplying context before an analyst reads the record, and risk scoring from CMDB criticality; then playbooks and flow-driven automation with irreversible actions gated, SIEM, endpoint and identity integrations, threat intelligence with retrospective hunting, vulnerable items and remediation tasks, and an implementation sequence that fixes the CMDB first.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| The response model, lifecycle and enrichment | Not published |
| Automation, integration, vulnerability response and implementation | Not published |
Two sample questions
1. What does a vulnerable item represent?
- One weakness across the whole estate
- One asset with several weaknesses
- One scan of a group of assets
- One weakness on one asset — correct
Why: The vulnerability entry describes it in general.
2. Why is containment a distinct state?
- Damage limit — correct
- It is optional
- It closes the case
- It skips analysis
Why: Containment as its own state ensures damage is limited before eradication.
The real CIS-SIR exam
| Length | 90 minutes |
|---|---|
| Questions | 60 |
| Pass mark | Scaled score; ServiceNow does not publish the percentage |
| Price | Included with a ServiceNow training partnership or purchased per attempt |
| Recommended before you sit it | ServiceNow Certified System Administrator, plus the mandatory Security Incident Response training. |
| Valid for | Maintained through the twice-yearly release delta courses |
Exam facts as published by ServiceNow; always check the vendor’s page before you book.
Study CIS-SIR with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.