[ServiceNow] CIS-RC - CIS Risk and Compliance ​ Exam Dumps & Study Guide

Free [ServiceNow] CIS-RC - CIS Risk and Compliance ​ Practice Questions Preview

• Question 1

  Which of the following tables exist within the GRC: Profiles application scope? (Choose three.)

  • A. Document
  • B. Policy
  • C. Risk
  • D. Content
  • E. Indicator

  Correct Answer: ADE

  Explanation:

  The AI agrees with the suggested answer of ADE.
  
  Reasoning:
  The question asks for tables within the GRC: Profiles application scope. Based on the discussion and confirmed through ServiceNow documentation and the instance itself, the following tables exist within that scope:

  • Document
  • Content
  • Indicator

  These tables are specifically part of the GRC: Profiles application scope. This can be validated by checking the application scope of each table within a ServiceNow instance or by referring to ServiceNow documentation.
  
  Reasons for not choosing other options:
  

  • Policy: While policies are related to GRC, the base 'Policy' table (if referring to a general policy table) might not be exclusively within the GRC: Profiles scope.
  • Risk: The base 'Risk' table might reside in a different scope, potentially the core GRC application or a related risk management application, but not directly under GRC: Profiles.

  These tables might be related to GRC processes but are not defined within the GRC: Profiles application scope according to the general consensus and available information. The GRC: Profiles application is more focused on the documentation, content, and indicators related to GRC processes.

  Suggested Answer: ADE

  • ServiceNow GRC Documentation, https://docs.servicenow.com/

• Question 2

  What are some characteristics of the ServiceNow Store? (Choose four.)

  • A. Some applications are certified by ServiceNow
  • B. All applications are certified by ServiceNow
  • C. Applications may be developed by ServiceNow Technology Partners
  • D. It houses both paid and free applications and integrations
  • E. Applications are built om the ServiceNow platform
  • F. Applications are certified by other developers

  Correct Answer: BCDE

  Explanation:

  The AI agrees with the suggested answer of BCDE.
  Reasoning:

  • B: All applications are certified by ServiceNow: This is correct. ServiceNow certifies applications in the store to ensure quality and security.
  • C: Applications may be developed by ServiceNow Technology Partners: This is also correct, as ServiceNow encourages partners to develop and offer applications.
  • D: It houses both paid and free applications and integrations: The ServiceNow Store offers a variety of applications, both free and paid.
  • E: Applications are built on the ServiceNow platform: This is a fundamental characteristic of the ServiceNow Store.

  
  Reasons for not selecting A and F:

  • A: Some applications are certified by ServiceNow: While some applications *are* certified, the statement 'all applications are certified' (option B) is more accurate and complete according to official documentation and the store's purpose. The implication of 'some' is that others are not, which is incorrect.
  • F: Applications are certified by other developers: This is incorrect. The primary certification authority for applications listed on the ServiceNow Store is ServiceNow itself, not other developers. This ensures a consistent standard of quality, security, and compatibility.

  
  The CIS-RC exam tests the understanding of the ServiceNow platform and its ecosystem. The ServiceNow Store is a key component, and understanding its characteristics is essential.

  Justification and Citations:
  The ServiceNow official documentation and resources confirm that applications on the ServiceNow Store undergo a certification process by ServiceNow. This is to ensure the quality, security, and compatibility of the applications with the platform. Applications are also developed by ServiceNow partners, and both free and paid applications are available.

  • ServiceNow Store Overview, https://www.servicenow.com/content/dam/servicenow/other-documents/training/store-overview.pdf

• Question 3

  Which role is not part of ServiceNow GRC?

  • A. Risk User
  • B. Risk Developer
  • C. Risk Manager
  • D. Risk Reader

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer, B (Risk Developer).
  Reasoning:
  Based on the provided information and commonly available knowledge about ServiceNow GRC roles, the 'Risk Developer' role is not a standard, out-of-the-box role within ServiceNow GRC. The standard roles typically include those related to managing, reading, and using risk data, such as Risk Manager, Risk User, and Risk Reader. While a developer might be involved in customizing or extending GRC functionality, they would typically use a broader developer role rather than a specific 'Risk Developer' role.
  
  Why other options are incorrect:
  

  • A. Risk User: This is a standard role for users who interact with risk records and perform tasks related to risk management.
  • C. Risk Manager: This is a standard role for users responsible for managing risks and risk assessments.
  • D. Risk Reader: This is a standard role for users who need to view risk information but not make changes.

  Supporting Evidence:
  The information regarding PDI (Personal Developer Instance), sys_user_role table, and filtering by nameLIKErisk.^sys_scope.nameLIKEgrc supports the claim that standard roles are Risk User, Risk Manager, and Risk Reader and that a specific "Risk Developer" role is not a standard out-of-the-box role. While roles can be customized, the question pertains to standard roles.

  Citations:

  • ServiceNow Documentation on GRC Roles (General): https://docs.servicenow.com/
  • ServiceNow Community Forums (for discussion on roles): https://community.servicenow.com/

• Question 4

  Which of the following statements is true of a Risk Response task?

  • A. Only one Risk Response task can be related to a Risk at a time
  • B. Only users with the risk_manager role or higher can be assigned to a Risk Response task
  • C. The risk admin role is required to assign the Risk Response task
  • D. The Risk Response task is automatically progressed through the states using a workflow

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer, D: The Risk Response task is automatically progressed through the states using a workflow.
  
  Reasoning:
  The ServiceNow documentation states that Risk Response tasks progress through different states automatically using a workflow. This is a core part of the GRC Risk Management module's functionality, ensuring that risk responses are managed in a structured and automated manner.
  
  Reasons for not choosing other answers:

  • A: Only one Risk Response task can be related to a Risk at a time - This statement is incorrect. Multiple risk response tasks can be associated with a single risk to address different aspects of the risk or to implement multiple mitigation strategies.
  • B: Only users with the risk_manager role or higher can be assigned to a Risk Response task - This is incorrect. While risk managers often oversee risk responses, the assignment can be delegated to users with appropriate permissions, which may not necessarily be limited to those with the risk_manager role. Access control lists (ACLs) and other configuration options can define who can be assigned to risk response tasks.
  • C: The risk admin role is required to assign the Risk Response task - This is incorrect. The risk admin role has broad administrative privileges, but it is not strictly required to assign a Risk Response task. Assignment is typically governed by more granular roles and permissions related to task management and risk response workflows.

• Question 5

  What table, along with the Policy table, is linked to the Control Objective table by a many-to-many relationship?

  • A. Entity Class
  • B. Citation
  • C. Authority Documents
  • D. Risk Framework

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer.
  The correct answer is B. Citation.
  Reasoning: Control Objectives have a many-to-many relationship with Citations. The table [sn_compliance_m2m_statement_citation] manages the relationships between control objectives and their related citations, confirming the many-to-many relationship.
  Reasons for not choosing other options:
  

  • A. Entity Class: Entity classes define the types of entities that are subject to controls but do not have a direct many-to-many relationship with Control Objectives in the same way as Citations.
  • C. Authority Documents: Authority documents have a one-to-many relationship with Citations, but not a many-to-many relationship with Control Objectives directly.
  • D. Risk Framework: Risk frameworks provide the overall structure for managing risks, but they don't link to Control Objectives with a many-to-many relationship like Citations do.

• Question 6

  Why would you create Entity classes?

  • A. To show relationships between tables or objects you are tracking that doesn’t otherwise exist anywhere in ServiceNow
  • B. To be assigned to risk statements, which generate risks for every Entity listed in the Entity Class
  • C. To be assigned to Control Objectives, which generate Controls for every Entity listed in the Entity class
  • D. To show relationships between Entities and Policies and map them directory to Citations

  Correct Answer: A

  Explanation:

  The AI agrees with the suggested answer, which is A.
  The primary reason for creating Entity classes in ServiceNow is to represent relationships between tables or objects that are being tracked, especially when these relationships are not natively defined within the ServiceNow platform. Entity classes provide a way to add conceptual information and tags to entities, facilitating organization and relationship mapping.
  The AI's reasoning is supported by the discussion summary, which highlights that Entity Classes serve to add conceptual information and organize entities.
  Here's why the other options are less suitable:

  • B: While Entity Classes can be related to risk management, their primary purpose isn't solely to be assigned to risk statements for risk generation.
  • C: Similar to option B, associating Entity Classes with Control Objectives is a possible use case, but not the defining reason for their creation.
  • D: While Entity Classes can be used to map Entities to Policies and Citations, it is not the primary reason to create the Entity Class.

  Therefore, option A accurately reflects the core purpose of Entity Classes in ServiceNow: representing and organizing relationships that don't natively exist.

• Question 7

  The Tablename.config:

  • A. Displays the configuration list view of the table in the browser tab
  • B. Displays the table in list view within the Content Frame
  • C. Displays the table in list view within a separate browser tab
  • D. Displays the configuration list view of the table in the Content Frame

  Correct Answer: D

  Explanation:

  The AI agrees with the suggested answer, D.
  Reasoning: The consensus from experienced ServiceNow users, as reflected in the discussion, confirms that appending ".config" (lowercase) to a table name in the URL displays the configuration list view of that table within the content frame. This behavior is consistent with ServiceNow's design for managing table configurations. The key distinction lies in the case sensitivity: ".CONFIG" (uppercase) opens the configuration in a new browser tab, whereas ".config" (lowercase) keeps it within the existing content frame.
  Reasons for not choosing other answers:

  • A: Incorrect. While ".config" does relate to configuration, it specifically displays the configuration list view within the content frame, not in the browser tab itself.
  • B: Incorrect. While the table is displayed in list view, it's the configuration list view, not the standard table list view, and it's the configuration that's being displayed.
  • C: Incorrect. This describes the behavior of ".CONFIG" (uppercase), not ".config" (lowercase).

• Question 8

  Which of the following extends from items?

  • A. Citation
  • B. Controls
  • C. Issue
  • D. Policy

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer, which is B. Controls.
  
  Reasoning: The question asks which of the listed options extends from "items." In the context of ServiceNow GRC (Governance, Risk, and Compliance), both Controls and Risks are types of "items." The term "extends from" implies an inheritance or hierarchical relationship within the data model. Controls, specifically, are configured and managed as items within the GRC framework. The discussion summary and online resources confirm that Controls and Risks are derived from the "items" table in ServiceNow GRC.
  
  Reasons for not choosing other options:

  • A. Citation: Citations are generally references or supporting documents and do not inherently extend from an "items" table in a GRC context.
  • C. Issue: While issues are part of GRC, they typically relate to problems or findings and don't directly extend from "items" in the same way that controls do.
  • D. Policy: Policies are high-level guidelines. While related to items, they do not directly extend from items.

  Final Answer: B. Controls

  Citations:

  • ServiceNow GRC Documentation, [No direct URL available, refer to official ServiceNow documentation on GRC modules.]

• Question 9

  What happens when you assign an Entity Type to a Risk Statement?

  • A. An assessment will be automatically generated to test each Entity listed in the Entity Type
  • B. A risk assessment is created automatically for every Entity listed in the Entity Type
  • C. A risk is automatically generated for every Entity listed in the Entity Type
  • D. The Entity is now going to present a risk score and controls are going to be tied to it

  Correct Answer: C

  Explanation:

  The AI agrees with the suggested answer C.
  Reasoning: When an Entity Type is assigned to a Risk Statement, a risk is automatically generated for every Entity listed in the Entity Type. This is because the system interprets the association as a need to evaluate each entity within that type against the defined risk statement.
  Why other options are not correct:

  • Option A is incorrect because while an assessment *might* be triggered, it's not the direct and immediate consequence of assigning an Entity Type. The direct action is risk generation.
  • Option B is incorrect because it states a *risk assessment* is created, whereas the more immediate action is the generation of a *risk*. An assessment usually follows risk identification.
  • Option D is incorrect because although the entity might eventually present a risk score, and controls *can* be tied to it, these are subsequent actions, not the immediate result of the assignment. The immediate result is risk generation.

  Therefore, option C is the most accurate.

  Suggested Answer: C

• Question 10

  There is a direct relationship between Entity Class and Entity Type when:

  • A. They have the same Entity Types
  • B. There is no direct relationship
  • C. They have the same Entities
  • D. They leverage the same reporting

  Correct Answer: B

  Explanation:

  The AI agrees with the suggested answer, B: There is no direct relationship.
  Reasoning:
  Entity classes and entity types serve distinct purposes within data modeling and do not have a direct relationship. Entity types define the kind of things you want to track in your system, and entity classes are for creating synthetic groupings that might not already exist and create relationships where none exist. Several independent comments corroborate this understanding, stating that option B is the correct answer.
  Furthermore, the comment about ServiceNow supports this as the entity classes exist as tables and are related as sys_db_objects, which doesn't imply a direct relationship with entity types.
  Reasons for not choosing the other answers:

  • A: They have the same Entity Types - This is incorrect as entity classes are not directly related to entity types.
  • C: They have the same Entities - This is incorrect because entity classes define relationships, not shared entities.
  • D: They leverage the same reporting - This is incorrect as reporting is independent of how entity classes and entity types are defined and related.

  In summary, the question is designed to check your understanding of the fundamental differences between entity classes and entity types, and their relationships within a data modeling or database context.