ServiceNow CIS-SIR free question 2 / 10 · Domain 1: Security Incident Response Overview and Data Visualization
After Major Security Incident Management is installed, which two actions can a security incident analyst take? (Choose two.)
- Archive the collaboration folders as soon as the incident is promoted
- Link a major security incident as a child of a standard incident
- Propose a security incident as a major security incident candidate
- Promote a security incident directly to a major security incident
Show the answer and explanation
Answer: C, D
Why this is correct
A security incident analyst can propose a security incident as a major security incident candidate, which starts a review of whether an MSI is needed, or directly promote it to a major security incident without an additional review process.
Why the other options are wrong
"Archive the collaboration folders as soon as the incident is promoted" … Archiving is not an analyst action at promotion. The folders are archived as part of incident closure.
"Link a major security incident as a child of a standard incident" … The direction is reversed. A security incident is linked as a child incident to the major security incident, not the other way round.
Key point
Propose goes through a review; promote does not.
Go to the ServiceNow CIS-SIR practice app (10 free questions; purchase unlocks all questions)