ServiceNow CIS-VR free question 4 / 10 · Domain 2: Getting Data into Vulnerability Response
Which statement about the Common Weakness Enumerations screen is correct?
- It is where you escalate a vulnerability for remediation
- It lists the identifiers that third-party scanners use
- It collects the detections that scanners report
- It is for reference, and you cannot escalate from it
Show the answer and explanation
Answer: D
Why this is correct
The CWE library is a list of community-developed software weakness types, and each CWE record includes an associated knowledge article that describes the weakness. You cannot escalate a vulnerability from the Common Weakness Enumerations screen; it is for reference only.
Why the other options are wrong
"It is where you escalate a vulnerability for remediation" … The page says that you cannot escalate a vulnerability from this screen.
"It lists the identifiers that third-party scanners use" … Third-party vulnerabilities are kept in the Third-party library, not in the CWE library.
"It collects the detections that scanners report" … The CWE library is a list of weakness types, not of scanner findings.
Key point
Vulnerability Response stores three libraries: NVD, CWE, and Third-party. You perform CWE updates On Demand from the integration record by default, and you must configure it if you want it to run as a scheduled job.
Go to the ServiceNow CIS-VR practice app (10 free questions; purchase unlocks all questions)