Question 1

Why is it important that the Platform (System) Administrator and the Security Incident administrator role be

separated? (Choose three.)

Options :

A :

Access to security incident data may need to be restricted

B : Allow SIR Teams to control assignment of security roles

C : Clear separation of duty

D : Reduce the number of incidents assigned to the Platform Admin

E : Preserve the security image in the company

Answer: B,C,D

Question 2

To configure Security Incident Escalations, you need the following role(s): __________.

Options :

A : sn_si.admin

B : sn_si.admin or sn_si.manager

C :

sn_si.admin or sn_si.ciso

D : sn_si.manager or sn_si.analyst

Answer: A

Question 3

What parts of the Security Incident Response lifecycle is responsible for limiting the impact of a security

incident?

Options :

A : Post Incident Activity

B : Detection & Analysis

C : Preparation and Identification

D : Containment, Eradication, and Recovery

Answer: D

Question 4

Chief factors when configuring auto-assignment of Security Incidents are __________.

Options :

A : Agent group membership, Agent location and time zone

B : Security incident priority, CI Location and agent time zone

C : Agent skills, System Schedules and agent location

D : Agent location, Agent skills and agent time zone

Answer: D

Question 5

Runbook records utilize a link to what type record for content?

Options :

A : Knowledge article

B : Response Tasks

C : Managed Document

D : Instruction Details

Answer: C