ServiceNow CIS-SIR free question 8 / 10 · Domain 6: Automation and Standard Processes
A Security Incident Response flow from the phishing response playbook is active. When does it run?
- When the Security Operations spoke is installed
- When the flow is given a published status
- When its subflows are annotated
- When its trigger condition is met
Show the answer and explanation
Answer: D
Why this is correct
The flow runs when its trigger condition is met, so the response starts without anyone launching it by hand.
Why the other options are wrong
"When the Security Operations spoke is installed" … Installing the Security Operations spoke is what gives you access to these flows. It is a prerequisite, not the event that runs a flow.
"When the flow is given a published status" … Published is a status of the flow definition. A published flow still runs only when it is active and its trigger condition is met.
"When its subflows are annotated" … Annotations on actions and subflows are there for readability. They do not change when the flow runs.
Key point
If a flow does not run, check two things in order: is it activated, and is its trigger condition actually met by the incident?
Go to the ServiceNow CIS-SIR practice app (10 free questions; purchase unlocks all questions)