ServiceNow CIS-RC free question 6 / 10 · Domain 4: Policy and Compliance
Vulnerability Response has been installed on an instance, and an administrator opens the Integration Registry. Which statement about the entries used to request policy exceptions from VR matches the documentation?
- Two entries were created automatically: vulnerability group and vulnerable item
- A vulnerable item entry exists, while the group entry is added manually
- A vulnerability group entry exists, while the item entry is added manually
- No entries exist yet, so each VR entry must be added manually one by one
Show the answer and explanation
Answer: A
Why this is correct
The Policy Exception Integration with Vulnerability Response page says that when the Vulnerability Response application was installed, two policy exception integration records are automatically created and added to the Integration Registry, one for a vulnerability group and one for a vulnerable item. To configure the vulnerable item record, the compliance manager identifies the mapping of tables used to integrate the two applications, defines reasons for requesting exceptions, and optionally defines policy categories and creates questionnaires for the requester. The administrator in the question therefore finds both entries already in place.
Why the other options are wrong
"No entries exist yet, so each VR entry must be added manually one by one" … The entries are created automatically when Vulnerability Response is installed. What follows is configuring them, such as the table mapping and the reasons for exceptions.
"A vulnerable item entry exists, while the group entry is added manually" … Two records are created automatically. Besides the vulnerable item record, the record for a vulnerability group is there from the start.
"A vulnerability group entry exists, while the item entry is added manually" … Two records are created automatically. Besides the vulnerability group record, the record for a vulnerable item is there from the start.
Key point
The minimum role to raise a policy exception from an upstream application is business user or business user – lite. After approvals are received, the exception becomes active, patching of the vulnerable item is deferred until the exception expires, and on the Valid until date the vulnerable item changes from Deferred to Open.
Go to the ServiceNow CIS-RC practice app (10 free questions; purchase unlocks all questions)