ServiceNow CIS-RC free question 10 / 10 · Domain 6: Common Elements and Extended Capabilities
An indicator asks the network administrator to conduct the annual network penetration tests and attach the results to the task. What matches the Using indicator templates page?
- Evidence comes from the source table, and controls are unaffected
- No evidence is collected, and a failed result triggers GRC issues
- No evidence is collected, and issues for failures are made by hand
- Evidence comes from several tables, and a script sets the result
Show the answer and explanation
Answer: B
Why this is correct
The page gives this exact case as its example of a manual indicator: ask the network administrator to conduct the annual Network Penetration Tests and attach the results to the task. If a result indicates failed or not passed, it is used to trigger the creation of GRC issues. In the list of indicator types, Manual is the one where evidence is not collected and a third party data source is required. The person doing the test provides the result, and a failing result leads to GRC issues automatically.
Why the other options are wrong
"No evidence is collected, and issues for failures are made by hand" … The page says a failed or not passed result is used to trigger the creation of GRC issues. The issues are not left to be created by hand.
"Evidence comes from the source table, and controls are unaffected" … Collecting evidence from the source table is the Basic type. The status of controls is also calculated automatically from the linked indicator results.
"Evidence comes from several tables, and a script sets the result" … Collecting evidence from multiple source tables is the Scripted type. The penetration test is the page's example of a manual indicator.
Key point
On the Method tab, Short Description, Instructions, and Value Mandatory apply when Type is Manual. Examples of automated indicators are checking that all servers in the CMDB are up to date and that all LDAP passwords are less than three months old. Collection frequency can be Daily, Weekly, Monthly, Quarterly, Semi-Annually, or Annually.
Go to the ServiceNow CIS-RC practice app (10 free questions; purchase unlocks all questions)