• Home
• ServiceNow Exams
• CIS-RC - Certified Implementation Specialist - Risk and Compliance

CIS-RC ServiceNow Practice Test Questions and Exam Dumps

Question 1:

Which of the following tables exist within the GRC: Profiles application scope? (Choose three.)

A. Document
B. Policy
C. Risk
D. Content
E. Indicator

Answer: B, C, D

Explanation:

The Governance, Risk, and Compliance (GRC): Profiles application scope is designed to manage various aspects related to governance, risk, and compliance within an organization. It involves managing policies, risks, and content, among other factors, to ensure that the organization is in compliance with relevant regulations and is mitigating risks appropriately.

Here’s an explanation of why B, C, and D are correct:

• Policy (B): The Policy table is part of the GRC: Profiles application scope. Policies define the rules and guidelines that the organization must follow to ensure compliance with laws, standards, and best practices. In GRC, policies are managed to ensure that the organization is operating within the necessary legal and ethical frameworks.

• Risk (C): The Risk table is also part of the GRC: Profiles application scope. Risks represent potential threats to the organization's assets, operations, or reputation. These risks are assessed, managed, and mitigated within the GRC framework to ensure that the organization can identify and reduce its exposure to various types of risk.

• Content (D): The Content table is relevant in the GRC: Profiles application scope as well. It refers to the documentation, guidelines, and other materials that support the creation and management of policies, risk assessments, and other compliance-related efforts. Content helps provide the context and reference materials necessary to execute and enforce policies.

Here’s why the other options are incorrect:

• Document (A): While Documents are important in the GRC context, the Document table is not typically included within the GRC: Profiles application scope. Documents are usually part of other GRC modules but not central to the profile management aspect.

• Indicator (E): Similarly, the Indicator table is not typically part of the GRC: Profiles application scope. Indicators may be part of performance or compliance monitoring but are not foundational within the profile-specific framework, which focuses more on policies, risks, and content.

In conclusion, the tables that exist within the GRC: Profiles application scope are Policy, Risk, and Content, so the correct answer is B, C, D.

Question 2:

What are some characteristics of the ServiceNow Store? (Choose four.)

A. Some applications are certified by ServiceNow
B. All applications are certified by ServiceNow
C. Applications may be developed by ServiceNow Technology Partners
D. It houses both paid and free applications and integrations
E. Applications are built on the ServiceNow platform
F. Applications are certified by other developers

Answer: A, C, D, E

Explanation:

The ServiceNow Store is a marketplace where users can find, download, and integrate various applications that extend the capabilities of the ServiceNow platform. These applications can either be developed by ServiceNow or by ServiceNow Technology Partners. Let’s break down each option:

A. Some applications are certified by ServiceNow

Correct. Not all applications in the ServiceNow Store are certified by ServiceNow, but some are. ServiceNow certifies certain applications to ensure they meet specific quality and compatibility standards. This certification process is crucial for maintaining the integrity and performance of applications within the ServiceNow ecosystem.

B. All applications are certified by ServiceNow

Incorrect. Not all applications in the ServiceNow Store are certified by ServiceNow. While many applications go through a certification process, others may be developed by third parties and are not necessarily certified by ServiceNow. Therefore, it’s important for users to verify the certification status of applications before deploying them.

C. Applications may be developed by ServiceNow Technology Partners

Correct. A significant number of applications in the ServiceNow Store are developed by ServiceNow Technology Partners. These partners are independent organizations or developers who create applications that integrate with or extend ServiceNow’s capabilities. They play a vital role in expanding the functionality of the ServiceNow platform.

D. It houses both paid and free applications and integrations

Correct. The ServiceNow Store offers both paid and free applications. Users can find a wide variety of applications, some of which are free to use, while others require a purchase or subscription. This provides flexibility for organizations to choose applications based on their needs and budget.

E. Applications are built on the ServiceNow platform

Correct. All applications available in the ServiceNow Store are built on the ServiceNow platform. This ensures that the applications are compatible with ServiceNow's features and architecture. Whether developed by ServiceNow or a third-party partner, the applications are designed to integrate seamlessly into the ServiceNow environment.

F. Applications are certified by other developers

Incorrect. While developers may create applications for the ServiceNow platform, the certification process is handled by ServiceNow, not other developers. Applications that undergo certification are tested and reviewed by ServiceNow to ensure they meet the required standards. Developers may contribute applications, but certification is officially provided by ServiceNow.

To summarize, the characteristics of the ServiceNow Store include the fact that some applications are certified by ServiceNow, they can be developed by ServiceNow Technology Partners, the store offers both paid and free applications, and all applications are built on the ServiceNow platform. Therefore, the correct answers are A, C, D, E.

Question 3:

Which role is not part of ServiceNow GRC?

A. Risk User
B. Risk Developer
C. Risk Manager
D. Risk Reader

Answer: B

Explanation:

ServiceNow's Governance, Risk, and Compliance (GRC) module provides a set of predefined roles that enable different users to interact with the system at varying levels of access and responsibility. These roles are designed to facilitate the management of risk, compliance, and governance activities within an organization.

Let’s break down each option:

• Risk User (A): This role is part of ServiceNow GRC. A Risk User typically has access to view and interact with risk-related records, but their access might be limited based on the configurations in the system. This role is essential for users who need to access risk data without the ability to configure or develop within the system.

• Risk Developer (B): The Risk Developer role is not part of the ServiceNow GRC module. While ServiceNow does allow for the customization of risk management processes, the term Risk Developer is not a predefined role in the system. Developers typically use the System Administrator or Application Developer roles to modify and customize applications, including the GRC application.

• Risk Manager (C): The Risk Manager role is a predefined role within the ServiceNow GRC module. This role is for users who are responsible for managing and overseeing risk management activities, and they generally have higher-level access to risk data and can perform key actions like approving risks or mitigation plans.

• Risk Reader (D): The Risk Reader role is also part of the ServiceNow GRC module. It provides users with view-only access to risk data, allowing them to review risk records without being able to make changes. This role is important for stakeholders who need to monitor risks but do not require the ability to edit or act on the data.

Thus, the Risk Developer role (B) does not exist as a predefined role in ServiceNow GRC. The roles related to GRC in ServiceNow are typically Risk User, Risk Manager, and Risk Reader.

Therefore, the correct answer is B.

Question 4:

Which of the following statements is true of a Risk Response task?

A. Only one Risk Response task can be related to a Risk at a time
B. Only users with the risk_manager role or higher can be assigned to a Risk Response task
C. The risk admin role is required to assign the Risk Response task
D. The Risk Response task is automatically progressed through the states using a workflow

Answer: B – Only users with the risk_manager role or higher can be assigned to a Risk Response task

Explanation:

A Risk Response task is a task related to managing and mitigating risks identified in the system. The task is part of a broader workflow that addresses how the organization deals with these risks. Let’s break down each option and why B is the correct answer:

A. Only one Risk Response task can be related to a Risk at a time

Incorrect. Multiple Risk Response tasks can be associated with a single Risk. This is because risks might require multiple actions or tasks, such as assessments, mitigations, or continuous monitoring, that can be tracked simultaneously. There is no restriction to a single response task.

B. Only users with the risk_manager role or higher can be assigned to a Risk Response task

Correct. In most systems that manage risks (such as ServiceNow’s Risk Management module), users with the risk_manager role or higher typically have the necessary permissions to be assigned Risk Response tasks. This ensures that those responsible for addressing and mitigating risks are the ones tasked with handling the response tasks.

C. The risk admin role is required to assign the Risk Response task

Incorrect. While administrators may have the authority to assign tasks, the risk_manager role typically has the necessary permissions for handling Risk Response tasks. The risk_admin role is more about managing the configuration and administration of the risk management system, not necessarily assigning individual tasks related to risk responses. Therefore, this statement is not true in most cases.

D. The Risk Response task is automatically progressed through the states using a workflow

Incorrect. While workflows can certainly help automate certain processes within risk management systems, Risk Response tasks are generally manually progressed by the assigned users. The workflow might facilitate the movement of tasks between different states (e.g., open, in progress, closed), but it does not automatically progress tasks without user input or action.

To summarize, only users with the risk_manager role or higher typically have the permissions necessary to be assigned a Risk Response task. This role ensures that the task is given to someone responsible for managing and mitigating risks within the organization. Therefore, the correct answer is B – Only users with the risk_manager role or higher can be assigned to a Risk Response task.

Question 5:

What table, along with the Policy table, is linked to the Control Objective table by a many-to-many relationship?

A. Entity Class
B. Citation
C. Authority Documents
D. Risk Framework

Answer: B

Explanation:

In the ServiceNow Governance, Risk, and Compliance (GRC) module, the Control Objective table plays a key role in defining specific goals related to the control of risks within an organization. The Policy table contains the policies that organizations put in place to address those risks and governance requirements. These policies, along with control objectives, are linked by a many-to-many relationship to ensure that a policy can address multiple control objectives, and a control objective can be linked to multiple policies.

The correct table that is linked to the Control Objective table, along with the Policy table, by a many-to-many relationship is the Citation table. Here’s why:

• Citation (B): The Citation table is used to store references to external documents, laws, or regulations that are cited within the GRC framework. It connects to both the Policy and Control Objective tables in a many-to-many relationship. The relationship ensures that a control objective or policy can refer to multiple sources of citation, and vice versa. This is important for compliance and governance tracking, as citations provide the legal or regulatory context that supports control objectives and policies.

Let’s examine why the other options are incorrect:

• Entity Class (A): The Entity Class table is used to define the entities (such as assets, locations, or business units) to which policies and controls are applied. It is not directly linked to the Control Objective table in a many-to-many relationship with the Policy table. While it is important in managing what entities are associated with specific policies or controls, it does not fulfill the many-to-many relationship described in this question.

• Authority Documents (C): The Authority Documents table is used to store formal documents that provide authority or justification for certain controls or policies. Although authority documents are important for compliance tracking, they are not typically used in a many-to-many relationship with the Control Objective and Policy tables. They serve as references but not in the many-to-many context described in the question.

• Risk Framework (D): The Risk Framework table defines the structure and categories of risk within an organization. It organizes risks into frameworks and categories, but it is not involved in a many-to-many relationship with the Control Objective and Policy tables. The Risk Framework table helps in categorizing and managing risks but does not directly link to control objectives and policies in the described relationship.

In summary, the Citation table plays a crucial role in linking policies and control objectives in a many-to-many relationship, and therefore, the correct answer is B.

Question 6:

Why would you create Entity classes?

A. To show relationships between tables or objects you are tracking that doesn’t otherwise exist anywhere in ServiceNow
B. To be assigned to risk statements, which generate risks for every Entity listed in the Entity Class
C. To be assigned to Control Objectives, which generate Controls for every Entity listed in the Entity class
D. To show relationships between Entities and Policies and map them directly to Citations

Answer: A – To show relationships between tables or objects you are tracking that doesn’t otherwise exist anywhere in ServiceNow

Explanation:

Entity classes in ServiceNow are designed to represent a specific group of objects, tables, or entities that share certain characteristics or behaviors. They help to organize and structure data in a way that can be used to track relationships, dependencies, or associations that may not be explicitly defined elsewhere in the platform.

Let’s analyze each option:

A. To show relationships between tables or objects you are tracking that doesn’t otherwise exist anywhere in ServiceNow

Correct. The primary purpose of Entity classes is to define and structure the relationships between different objects or tables in the system. In ServiceNow, there might be cases where relationships or associations between different entities (e.g., systems, users, or processes) are not natively defined, and Entity classes allow users to model these relationships. This organization helps with tracking and managing entities that are important for the business process but are not already part of the out-of-the-box ServiceNow data model.

B. To be assigned to risk statements, which generate risks for every Entity listed in the Entity Class

Incorrect. Entity classes themselves are not directly associated with risk statements to generate risks. While risk management is an important aspect of ServiceNow, and you can use entities in the context of managing risks, the primary role of entity classes is not to automatically generate risks based on their assignment. Risk-related tasks are typically handled using risk management modules where specific risk statements and entities can be linked, but this is not the primary function of entity classes.

C. To be assigned to Control Objectives, which generate Controls for every Entity listed in the Entity class

Incorrect. Entity classes are not directly assigned to Control Objectives to generate controls. While controls and objectives are important parts of the Governance, Risk, and Compliance (GRC) module, Entity classes do not directly drive the creation of controls. Controls and objectives are generally defined in the context of regulatory compliance, risk mitigation, and auditing. Entity classes can help to define the scope of these objects but are not specifically responsible for generating controls.

D. To show relationships between Entities and Policies and map them directly to Citations

Incorrect. While Entity classes can be used to model relationships between different types of objects (like policies, controls, or entities), their primary function is not specifically to map relationships between policies and citations. Policies and citations are typically part of compliance management and governance workflows in ServiceNow, but Entity classes are more focused on organizing and showing relationships between entities in the system, rather than directly managing policies and citations.

Entity classes are crucial in structuring and organizing data in ServiceNow, helping to define and track relationships between objects or entities that are not already mapped in the default data model. This functionality is useful for building out custom solutions, workflows, or governance models that require a clear relationship between data points. Therefore, the correct answer is A – To show relationships between tables or objects you are tracking that doesn’t otherwise exist anywhere in ServiceNow.

Question 7:

The Tablename.config:

A. Displays the configuration list view of the table in the browser tab
B. Displays the table in list view within the Content Frame
C. Displays the table in list view within a separate browser tab
D. Displays the configuration list view of the table in the Content Frame

Answer: D

Explanation:

In ServiceNow, the Tablename.config refers to the configuration for how the table data is displayed and managed within the system's user interface. When you access a table's configuration settings, particularly in the config view, you are essentially working with the settings related to how data is displayed and organized in that table.

Here’s why D is the correct answer:

• Displays the configuration list view of the table in the Content Frame (D): The Tablename.config typically shows the configuration list view within the Content Frame of the ServiceNow interface. This allows administrators and users to see and configure the structure and settings of the table (such as column settings, permissions, and form layout) within the current interface. The configuration settings are not opened in a separate browser tab, but within the Content Frame itself, which is part of the main ServiceNow window.

Let’s break down why the other options are incorrect:

• A. Displays the configuration list view of the table in the browser tab: This is incorrect because Tablename.config does not open a configuration list view in the browser tab. It is specifically meant to display within the Content Frame, not as a separate tab in the browser.

• B. Displays the table in list view within the Content Frame: While the list view of the table might be displayed in the Content Frame, this answer is too generic. Tablename.config specifically refers to the configuration view of the table, not just a simple list view of the table data.

• C. Displays the table in list view within a separate browser tab: This is incorrect because Tablename.config does not open in a separate browser tab. It stays within the Content Frame of the current interface, making it part of the current window rather than a separate tab.

In conclusion, Tablename.config is used to display the configuration list view of the table within the Content Frame of the ServiceNow interface, and therefore the correct answer is D.

Question 8:

Which of the following extends from items?

A. Citation
B. Controls
C. Issue
D. Policy

Answer: A

Explanation:

In ServiceNow, the concept of items plays a key role in structuring and managing various aspects of governance, risk, and compliance (GRC) workflows. The question asks which of the listed options extends from items, and it’s important to understand what items represent and how they interact with other elements in the GRC framework.

A. Citation

Correct. A Citation in ServiceNow typically refers to a reference or a documentation element that supports a particular requirement or control, often tied to compliance. Citations are often used in conjunction with controls, policies, or other compliance elements to show a reference or evidence supporting the entity or control being enforced. In this context, Citations extend from items, meaning a citation is typically tied to a specific item, such as a policy or control, to provide supporting documentation or reference.

B. Controls

Incorrect. Controls are a part of the Governance, Risk, and Compliance (GRC) framework, used to manage and enforce specific security, operational, or compliance rules. While controls are essential in the GRC system, they don’t necessarily "extend" directly from items in the same way as citations. Rather, controls are typically associated with risks or policies, and while items may play a role in tracking or managing controls, controls themselves don’t extend from items in this context.

C. Issue

Incorrect. An Issue in the context of GRC typically refers to a problem or non-compliance event that needs to be addressed. While issues are related to risks, controls, and policies, they are not specifically extensions of items. An issue is generally created as part of a risk management or compliance process when something goes wrong, but it is not directly extended from an item in the same way as citations.

D. Policy

Incorrect. A Policy in ServiceNow is a set of rules or guidelines designed to manage and enforce compliance across the organization. While policies are critical elements in the GRC structure, they are not typically considered to extend from items. Policies can be related to items, but they don't "extend" from them in the same technical sense that citations do.

The correct answer is A, because Citations typically extend from items as they are used to reference or support various GRC-related elements, such as controls, policies, or risks.

Question 9:

What happens when you assign an Entity Type to a Risk Statement?

A. An assessment will be automatically generated to test each Entity listed in the Entity Type
B. A risk assessment is created automatically for every Entity listed in the Entity Type
C. A risk is automatically generated for every Entity listed in the Entity Type
D. The Entity is now going to present a risk score and controls are going to be tied to it

Answer: C

Explanation:

In ServiceNow GRC (Governance, Risk, and Compliance), Risk Statements are used to describe potential risks faced by the organization. These risk statements help define specific areas of concern that require mitigation, control, or attention. Entity Types refer to different classifications of entities, such as systems, applications, business units, or assets, that may be associated with the risks.

When you assign an Entity Type to a Risk Statement, it triggers a linkage between the risk and the entities that belong to that specific entity type. This assignment helps in associating risks with entities that are relevant for managing and mitigating that specific risk.

Here’s why C is the correct answer:

• A risk is automatically generated for every Entity listed in the Entity Type (C): When an Entity Type is assigned to a Risk Statement, a risk is automatically generated for each entity within that Entity Type. This is part of ServiceNow’s automated process that associates risks with the relevant entities, allowing you to monitor, evaluate, and mitigate those risks more effectively for each specific entity.

Now, let’s examine why the other options are incorrect:

• A. An assessment will be automatically generated to test each Entity listed in the Entity Type: This is not entirely correct because assigning an Entity Type to a Risk Statement does not automatically generate an assessment for each entity. While assessments may be associated with risks, this action itself is more about generating risks for the entities rather than assessments.

• B. A risk assessment is created automatically for every Entity listed in the Entity Type: This is similar to option A but inaccurate. Assigning an Entity Type to a Risk Statement does not automatically create risk assessments. It triggers the creation of risks for each entity, but an assessment typically needs to be separately configured or manually created to evaluate the risk.

• D. The Entity is now going to present a risk score and controls are going to be tied to it: This is incorrect because assigning an Entity Type to a Risk Statement does not automatically generate a risk score or tie controls. Risk scores and controls are typically associated with individual risks through assessments and other processes, not just by linking an Entity Type to a Risk Statement.

In conclusion, when you assign an Entity Type to a Risk Statement, it results in the automatic generation of a risk for every entity listed in that Entity Type, making C the correct answer.

Question 10:

There is a direct relationship between Entity Class and Entity Type when:

A. They have the same Entity Types
B. There is no direct relationship
C. They have the same Entities
D. They leverage the same reporting

Answer: A

Explanation:

In ServiceNow and other enterprise systems, Entity Classes and Entity Types are used to define and categorize various entities within the system. They serve as frameworks to help organize, track, and report on different objects within an organization’s data model. To understand when there is a direct relationship between Entity Class and Entity Type, let’s explore each option:

A. They have the same Entity Types

Correct. A direct relationship between Entity Class and Entity Type occurs when they share the same Entity Types. In other words, an Entity Class and an Entity Type are linked when they are designed to represent similar categories of entities. For instance, if both the Entity Class and Entity Type are focused on managing assets, they might have the same set of Entity Types (e.g., hardware, software, etc.), establishing a direct relationship between the class and type. This relationship is critical in ensuring that the classification and tracking of entities are aligned, making the system more efficient for reporting and management purposes.

B. There is no direct relationship

Incorrect. This option suggests that Entity Class and Entity Type have no connection, which is not the case. While there can be differences in how entities are categorized or used, there is typically a relationship between the Entity Class and Entity Type when they are part of the same data model or framework. They often interact directly, especially when it comes to defining and managing entities in the system. Therefore, the statement that there is no direct relationship does not apply here.

C. They have the same Entities

Incorrect. While Entity Class and Entity Type might involve the same entities, this is not the defining characteristic of their direct relationship. An Entity Class is a broader classification used to group related entities, while an Entity Type focuses more specifically on the type or category of an entity. It is possible for them to share entities, but the key element in their direct relationship is typically the Entity Type, not just the shared entities themselves.

D. They leverage the same reporting

Incorrect. While Entity Class and Entity Type may be used in the same reports or share common reporting features, the direct relationship between them is not necessarily about reporting. The relationship is more about how the entities are categorized and structured within the system, which influences reporting indirectly. Reporting can be a result of their relationship but is not the primary factor that defines a direct relationship between Entity Class and Entity Type.

The direct relationship between Entity Class and Entity Type exists when they have the same Entity Types, as this alignment ensures that both the class and type are used to categorize similar or related entities within the system. Therefore, the correct answer is A.