ServiceNow CIS-SIR free question 3 / 10 · Domain 2: Security Incident Creation and Threat Intelligence
Which role is required to create a security incident manually from the Security Incident list?
- evt_mgmt_admin
- sn_si.admin
- sn_si.basic
- sn_ti.admin
Show the answer and explanation
Answer: C
Why this is correct
The procedure for creating a security incident from the Security Incident list lists sn_si.basic as the role required. Creating incidents is everyday work, so the administrative role is not needed.
Why the other options are wrong
"sn_si.admin" … sn_si.admin is an administrator role. It is not the role listed for creating a security incident from the Security Incident list.
"sn_ti.admin" … sn_ti.admin is the Threat Admin role of Threat Intelligence. It is required for tasks such as defining a threat source.
"evt_mgmt_admin" … evt_mgmt_admin is an Event Management role. It is not the role listed for creating a security incident from the Security Incident list.
Key point
Besides manual creation, security incidents are also created automatically, for example from alerts and events ingested through security integrations.
Go to the ServiceNow CIS-SIR practice app (10 free questions; purchase unlocks all questions)