ServiceNow Integrated Risk Management (IRM) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which statement best describes Annualized Loss Expectancy in relation to risk score methodologies?
• In addition to Audit Manager, which role should be assigned to allow management of the audit process?
• Which property name indicates migration to advanced risk assessments?
• Which module houses the Regulatory Change Management impact assessment methodologies?
• Where are 80% of new customers within the GRC maturity model?
• What does UCF stand for in this content?
• Which of the following is true about the content model's relationship to risk definitions?
• Which of the following should be directly involved in GRC implementations?
• Which option correctly identifies the RAM assessment type enabled by default for RAM configurations?
• By default, who is assigned to complete control attestations in the baseline?
• Which capability enables integration of Advanced Audit with PPM?
• Which table stores regulatory citations?
• Which statement best describes an organization’s approach to a GRC deployment?
• Which statement is true about RAM assessment context options?
• An Observation can also be commonly known as what during an audit?
• Which baseline criterion triggers notifications for audit tasks when they expire?
• What is the result of SLE × ARO in the risk scoring formula?
• The 'Add to Update Set' utility is available for download via:
• What GRC module would you access in order to update Entity Types?
• Common controls from UCF are imported into which ServiceNow table?
• Setting up entity classes is required when using which GRC feature?
• Which use-case for SLAs in this context is valid?
• Which role is directly involved in GRC implementations?
• Which state represents formal attestation of controls?
• Which table is a primary example from the GRC Advanced Risk scope?
• What is the primary purpose of Entity Classes in GRC?
• Which of the following is the correct syntax to display the default form view of the Risk table in the Content Frame?
• Which table stores the link from Entity Types to Policies?
• Which of the following statements is true about how Risk Statements relate to Entity Types?
• In policy workflow, which state indicates that a policy is awaiting approval before progress?
• What is the minimum role required to approve a Policy?
• Which action is necessary to implement a second layer of policy approvals?
• Which statement best describes the relationship between advanced planning and engagement records?
• Which of the following is a valid state for a control record?
• Which table stores the risk_definition profile type mapping?
• Which role is not part of ServiceNow GRC?
• Which option best lists the entities included when configuring an assessment scheduler for RAM?
• What is the minimum role required for creating a policy acknowledgement campaign?
• Which of the following is NOT part of the GRC Profiles scope according to the provided material?
• Which baseline criterion triggers notifications for audit tasks when the task is reassigned?
• In addition to Audit Manager, which role should be assigned to enable other GRC functions related to audit?
• Which table stores the links from Policy to Profiles?
• To accommodate a customer's unique policy approvals process, which method is recommended?
• Which collection of tables extend the Document table?
• Why would you create Entity classes?
• Which role reviews the risk response and moves the Risk record into the Monitor state at the appropriate time?
• Which of the following is NOT a parent table for GRC: Risk Management tables?
• Which table links Policy Profiles to Policy Types?
• What should you do when risk thresholds in the Risk Criteria Matrix do not align with company needs?
• If the engagement is rejected, it automatically moves back to the Fieldwork state.
• Which of the following extends from items?
• Which table stores policy statements?
• The Calculated Risk Score adjustments are driven by which factor besides the Inherent and Residual risk scores?
• Which role can move the control to the 'Monitor' state manually?
• In the context of risk scoring, which item is commonly configured by customers?
• Which destination serves as the repository for knowledge articles after approval?
• Which table stores the links from Policy to Control Objective?
• Which role is required to create a risk assessment methodology (RAM)?
• In this risk-management model, what must be true for a control objective and a risk statement to be automatically linked?
• Which role has the capability to create Policies?
• Which statement about the Risk Store characteristics is true?
• Which option correctly identifies a commonly used baseline data element for Entity filters?
• Which statement best describes the role of Finding in audit terminology as presented?
• Which state does an approved audit engagement with ongoing tasks transition to?
• What is the function of the sn_compliance_policy table?
• The overall goal of Entity Classes is to:
• The content table sn_grcs_content is a parent table of which of the following?
• Entity scoping is used for what?
• Creating Entities in ServiceNow is easier as customers can leverage existing data used in other applications. Which of the following is a baseline table commonly used to build an Entity Type?
• Which table extends the Content (sn_grc_content) table to store citations?
• Which of the following best describes obtaining added content packs for compliance?
• Which ServiceNow table is used to store the Control Objective derived from the Unified Compliance Framework (UCF)?
• Which of the following records is most likely to be an Entity in the GRC data model?
• What are key prerequisites for a control test task to be generated?
• GRC Options in Interactive Filters are available through which feature?
• Configuration Compliance is used to continuously monitor controls.
• Which option describes the correct mapping for Authority Documents in policy and compliance tracking?
• To complete the integration registry form for policy exceptions, what additional information must be provided beyond the registry entry name?
• Which regulation is listed as a possible healthcare entity scoping regulation?
• Which ServiceNow role can manually move a Control record into the Monitor state?
• During classic risk assessment, while a Risk is in the Assess state, which action is possible?
• Which data sources feed into the Calculated Risk Score along with inherent and residual risk scores?
• GRC Options in Interactive Filters are only available through which feature?
• There is a direct relationship between Entity Class and Entity Type when:
• Which data source is not used to source control data for a customer's control framework?
• Which role can you grant to external audit team members?
• Which of the following statements is true about the GRC Profiles application scope?
• What is a risk register?
• If a control objective has been related to a risk statement and scoped with the same entity type, what can we expect to occur?
• Which of the following best describes the relationship of Risk Statement within the GRC data model?
• Which RAM-related term is used to describe a method for risk assessment?
• Which of the following would be considered an example of an Entity Type in the described data model?
• Which term describes risk after actions are taken?
• Which of the following is true about the UCF-to-ServiceNow mapping for imports?
• Which table stored the links from Entity to Entity Types?
• The Tablename.config displays which content?
• Controls are put in place to ensure adherence to policies and regulations. When are they also helpful?
• Which two components are used to calculate the inherent risk score?
• Which of the following best describes the function of an Entity Type in relation to a Risk Statement?
• EMEA Data Centers are an example of which data model concept?
• If the audit engagement is approved and there are remaining open tasks or issues, it automatically moves into which state?
• Control Failure Factor represents the impact of Control Failures on which score?
• Which GRC application is used to determine the areas where the organization is most vulnerable or exposed?
• What does RAM stand for in this context?
• What table is populated if a regulatory change is determined to be applicable?
• On rejection, which state does the engagement revert to?
• Controls are moved to which state from the attestation phase?
• If you create a control manually and later decide to create them automatically, what will be the result?
• Which destination is used for approved policies?
• Which of the following is a typical first step when evaluating SOX content packs for ServiceNow?
• Which Script include can be modified to change how the compliance scores roll up?
• Which RAM assessment types can be enabled when configuring a RAM?
• What is the repository for all identified risks?
• The Acknowledgement Instance table extends from which table?
• Which table extends from the Content Table?
• Which table stores the imported UCF control objective in ServiceNow?
• Which related list name is used to display aggregated risk data after migration?
• Control Objectives are not active until the parent policy is in which state?
• Which syntax opens the risk form in the Content Frame?
• Which factor, when modified, directly affects the overall compliance score calculation?
• What happens when you assign an Entity Type to a Risk Statement?
• What does ALE stand for in risk management?
• Which table stores the links from Policy to Control Objective in a RAM context?
• Controls are generated from a Control Objective when what is applied to it?
• The SOX content pack includes a series of policies, control, risks. How are all of these components linked together?
• The Single Loss Expectancy is $1,000,000 and the Annual Rate of Occurrence is 20%. What is the Annualized Loss Expectancy?
• Entity scoping is dynamic; what happens as new records meet criteria?
• Annualized Loss Expectancy is a feature of which risk score method?
• Which statement is true of a Risk Response task?
• Who can move a Policy record from Review into the next state?
• Which of the following statements best describes the Document extension set?
• Runbooks connect Security Incident Response Task and Knowledge Article.
• How can you obtain the SOX content pack for ServiceNow?
• Which statement best describes Entity Class Rules?
• Why would a company need to comply with the General Data Protection Regulation?
• Which of the following statements is true about control identification options for RAM?
• Which audit module task is typically used to gather information by interviewing a person?
• Which of the following is a valid table name that stores risk definitions in ServiceNow's content model?
• Which statement correctly describes the risk management lifecycle process?
• Which role is primarily responsible for reviewing risk responses in risk management?
• What is the effect on risk scores when mitigating controls are in place?
• Which content types can be ingested into ServiceNow via UCF integration?
• Which statement describes the role of the Citation table?
• Which item is NOT an extra related list shown with advanced planning?
• Which mapping capability in the Classic UI relates specific Entities to each other within an Entity Class?
• Which table stores the many-to-many relationship between GRC profiles and their types?
• Entity Types use Entity Filters to generate entitlements based on which of the following?
• A relationship between a registered risk and a control will be automatically generated when the control objective and risk statement have the same what?
• Which table stores the link from Entity Types to Control Objectives?
• All of the following are PARENT tables which exist within the GRC Entities application scope EXCEPT.
• What is a key outcome of higher GRC maturity?
• Which equation correctly expresses the Risk Scoring formula?
• Which GRC application would you use to manage internal or external consultancy processes that aim to prove the effectiveness of controls?
• Policies can be automatically published after which of the following occurs?
• To use User Reported Phishing v2 in Flow Designer, what must occur?
• Which option accurately describes the owner notification when a duplicate control is created automatically after manual creation?
• In RAM, one valid method to identify controls is from the control library.
• What are the four values leveraged for the Inherent and Residual Risk Score Types?
• The compliance score calculation may be modified by changing which control factor?
• Which table stores the explicit mapping between statements and citations?
• The Citation table is a child table of which parent?
• Which of the following describes how the risk form URL is used in the Content Frame?
• Which filter navigation syntax displays the table in list view within a separate browser tab?
• Which item is displayed as an extra related list when advanced planning is used?
• What condition must exist to edit the factor guidance of a published RAM?
• Which of the following is NOT displayed as an extra related list on the engagement record when advanced planning is selected?
• In ServiceNow IRM, in which policy state can reviewers either send the policy back to draft or forward it by requesting approval?
• Which external component enables ServiceNow to ingest data from other systems?
• Which scheduled job is responsible for generating GRC profiles, thereby affecting the population of Entity records?
• Which feature of classic risk scoring is frequently configured by customers?
• What is a primary table for the GRC Advanced Risk application scope?
• Where does a policy get published to when it is approved?
• Which option best describes a typical initial stage for an organization adopting ServiceNow GRC?
• Which of the following is a risk record table in ServiceNow IRM?
• What does RAM stand for in ServiceNow IRM context?
• Which term describes risk before any actions are taken?
• Which of the following is true about creating a RAM in terms of role?
• Which option best describes the relationship between a facility and an entity in the GRC model?
• Which of the following records is not associated with a lifecycle focus in GRC models?
• Which policy lifecycle state is included in the ServiceNow baseline?
• Which of the following is NOT typically an Audit module task?
• What is the condition that must exist to edit the risk scoring logic of a published RAM?
• Which of the following is a valid use of Entity Types and Entities in risk management?
• Configuration Compliance is used to do what in ServiceNow IRM?
• All of the following are tables which exist within the GRC Profiles application scope EXCEPT:
• In RAM, which assessment type is a valid option to enable?
• Which option is a typical example of a record type that can be extended by risk-related tables in the GRC model?
• Which role should be given to external auditors to view published policies and controls?
• Which concept is illustrated by Santa Clara Facility in the GRC data model?
• Which statement is true about the new related list introduced after migration?
• Which audit module task is used to walk through the process to understand how it is implemented?
• Which property controls score calculation by weighting controls?
• Which table stores the links from the Entity Type to Risk Statement?
• Which term best describes the rule that automatically assigns the class when creating a new Entity?
• What is the minimum role required to bulk initiate risk assessments using the risk assessment scheduler?
• To have entities and controls created automatically after associating a control objective and configuration test, what must be true?
• When calculating compliance scores, what is true about the weighting of Controls?
• Which statement best describes the relationship Runbooks have with components?
• In classic risk assessment, indicator failure factor represents the impact on which score?
• When the property Migrate to Advanced Risk Assessments is true, which forms are impacted?
• Automatic policy publication is triggered by which condition?
• What does SLE stand for in risk management?
• In a GRC implementation, which role is appropriate to be directly involved?
• An Entity in the system can belong to one or more of which categories?
• Where does one go to configure the Regulatory Change Management impact assessment template?
• As GRC maturity increases, which of the following is NOT expected?
• Control indicators may be triggered or scheduled in which state?
• Which action moves a policy from Review state back to Draft?
• What happens when you assign an Entity Type to a Control Objective?
• If the audit engagement is approved and there are no remaining open tasks or issues, it automatically moves into which state?
• Which of the following is NOT a parent table for GRC: Risk Management tables?
• Which table extends from the Content Table?
• Which state does an approved audit engagement with no remaining open tasks move to?
• Which statement describes using a baseline template in consolidated attestations?
• What rule ensures that every time you create an Entity from a specific table, the Class of the Entity is set according to the rule?
• For Control records, who can modify the Control in the Draft state?
• Which GRC application would you use to prove the effectiveness of controls through consultancy processes?
• In the Classic UI, which feature is used to build relationships between Entity Classes?
• Which of the following is a plausible trigger for automatic creation of an issue in GRC workflows?
• What term describes the level of risk remaining after control measures are applied?
• Which of the following is NOT a primary parent table for GRC applications?
• Which table is explicitly mentioned as part of a many-to-many relationship with Policy and Control Objective in ServiceNow GRC?
• Which option best describes the relationship between Control Objective and Policy in ServiceNow GRC?
• Which audit module task focuses on testing controls to verify their effectiveness?
• Which of the following is NOT commonly leveraged in Entity filters?
• Which of the following is NOT a UCF term?
• In the quantitative risk method, what is the risk likelihood called?
• The Risk Scoring values are entered on the Risk Statement. What records inherits the values from the Risk Statement?
• In ServiceNow Integrated Risk Management, which feature is used to track the completion of specific tasks?
• What table, along with the Policy table, is linked to the Control Objective table by a many-to-many relationship?
• Santa Clara Facility and Boston Facility are examples of which concept in the GRC model?
• How does GRC: Policy and Compliance Management track compliance to Authority Documents?
• Which of the following is a valid mapping capability in Classic UI for relating Entities?
• Which of the following relationship sets is a valid example of a many-to-many relationship in the data model?
• Which record is not required when configuring an RSS feed integration with a provider?
• Which table stores a compliance policy?
• What would you leverage in order to provide users with an alternate user experience to view policies, create policy exceptions, and search for controls?
• In which state is the Policy once all approvals are received?
• After migrating to advanced risk assessment, which related list was added to risk statement and entity records?
• Which statement best describes the purpose of Entity Classes?
• Entity Types generate entitlements based on which scope?
• Which of the following records does not have a lifecycle?
• What table extends from Document Table?
• Which table extends the Content (sn_grc_content) table to store policy statements?
• Which of the following is not a trigger for issue creation?
• In the risk data model, which of the following could represent a risk statement?
• Which of the following is a commonly configured choice list on the Control Objective Table form?
• Which of the following is NOT a driver for customers to get the GRC suite of applications?
• Which of the following is a typical example of an entity in the GRC framework (facility-related)?
• Which scenario best describes an organization recently acquired with some bad audit findings using ServiceNow GRC to help restart their process?
• Which of the following records is NOT among those to which Entity Types are applied?
• Which table stores the links from Control Objective to Citation?