CIS-SIR Online Practice Questions and Answers

What specific role is required in order to use the REST API Explorer?

A. admin

B. sn_si.admin

C. rest_api_explorer

D. security_admin

What role(s) are required to add new items to the Security Incident Catalog?

A. requires the sn_si.admin role

B. requires the sn_si.catalog role

C. requires both sn_si.write and catalog_admin roles

D. requires the admin role

What makes a playbook appear for a Security Incident if using Flow Designer?

A. Actions defined to create tasks

B. Trigger set to conditions that match the security incident

C. Runbook property set to true

D. Service Criticality set to High

Select the one capability that retrieves a list of running processes on a CI from a host or endpoint.

A. Get Network Statistics

B. Isolate Host

C. Get Running Processes

D. Publish Watchlist

E. Block Action

F. Sightings Search

Why should discussions focus with the end in mind?

A. To understand desired outcomes

B. To understand current posture

C. To understand customer's process

D. To understand required tools

In order to see the Actions in Flow Designer for Security Incident, what plugin must be activated?

A. Performance Analytics for Security Incident Response

B. Security Spoke

C. Security Operations Spoke

D. Security Incident Spoke

A flow consists of. (Choose two.)

A. Scripts

B. Actions

C. Processes

D. Actors

E. Triggers

Which of the following is an action provided by the Security Incident Response application?

A. Create Outage state V1

B. Create Record on Security Incident state V1

C. Create Response Task set Incident state V1

D. Look Up Record on Security Incident state V1

How do you select which process definition to use?

A. By selecting the desired process within the Process Definition module

B. By selecting the desired process within the Process Selection module

C. By setting the process definition record to Active

D. By setting the Script Include record to Active