Question 1

Why is it important that the Platform (System) Administrator and the Security Incident administrator role beseparated? (Choose three.)

Options :

A : Access to security incident data may need to be restricted

B : Allow SIR Teams to control assignment of security roles

C : Clear separation of duty

D : Reduce the number of incidents assigned to the Platform Admin

E : Preserve the security image in the company

Answer: B,C,D

Question 2

Runbook records utilize a link to what type record for content?

Options :

A : Knowledge article

B : Response Tasks

C : Managed Document

D : Instruction Details

Answer: C

Question 3

Security Incidents can be created using a manual UI Action on which one of the following record types?

Options :

A : Event

B : Email Notification

C : Workflow

D : Alert

Answer: D

Question 4

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a securityincident?

Options :

A : Post Incident Activity

B : Detection & Analysis

C : Preparation and Identification

D : Containment, Eradication, and Recovery

Answer: D

Question 5

The following term is used to describe any observable occurrence: __________.

Options :

A : Incident

B : Log

C : Ticket

D : Alert

E : Event

Answer: A

Free CIS-SIR Mock Exam – Practice Online Confidently