Certified Implementation Specialist - Security Incident Response Questions and Answers
200 questions organized by topic with detailed explanations
ServiceNow
CIS-SIR
200 questions
6 topics
Updated May 2026Security Incident Response Overview and Data Visualization
30 questions8 easy14 medium8 hard~15% of exam
Security Incident Creation and Threat Intelligence
28 questions8 easy14 medium6 hard~14% of exam
A service desk agent is reviewing a Security Request that should become a security incident. Which action supports that ...An organization wants to avoid creating duplicate security incidents from Incident Management. Which setting should be e...A security incident was created from network monitoring data ingested through CrowdStrike. Which field identifies CrowdS...
Security Incident and Threat Intelligence Integrations
28 questions6 easy14 medium8 hard~14% of exam
Security Incident Response Management
30 questions7 easy16 medium7 hard~15% of exam
A team decides to directly promote a security incident to a major security incident. What is required?What is a key capability of Major Security Incident Management for complex events with many related incidents?A responder wants to flag an incident as a possible major security incident without promoting it yet. Which combination ...
Risk Calculations and Post Incident Response
24 questions7 easy10 medium7 hard~12% of exam
Automation and Standard Processes
60 questions16 easy32 medium12 hard~30% of exam
How should security incident groups be configured for role inheritance to work as intended?An incident already has a specific playbook attached and it is still active. What happens if the analyst tries to add th...Which statement correctly describes how inbound Security Operations email is handled after it reaches a configured email...
All Questions
| # | Question | Topic | Difficulty |
|---|---|---|---|
| 1 | Which observable types are enriched by the Shodan integration? | Security Incident and Threat Intelligence Integrations | easy |
| 2 | A manager wants to understand how Overview widgets are organized before filtering them. Which groupi... | Security Incident Response Overview and Data Visualization | medium |
| 3 | A team decides to directly promote a security incident to a major security incident. What is require... | Security Incident Response Management | hard |
| 4 | How should security incident groups be configured for role inheritance to work as intended? | Automation and Standard Processes | easy |
| 5 | An incident already has a specific playbook attached and it is still active. What happens if the ana... | Automation and Standard Processes | easy |
Sign in to see all 200 questions
Create a free account to browse all questions — completely free during our launch phase.
Ready to test your knowledge?
Take a full Certified Implementation Specialist - Security Incident Response practice test with timed exam simulation.
Start Practice Test