CIS-VR Sample Questions & Answers

This is true. The 'Vulnerability Import since' property for the Tenable.io integration is set to 90 days by default. This is a configurable setting designed to prevent the import of a massive amount of historical, potentially irrelevant vulnerability data on the first run. Administrators can and often should adjust this value based on their specific requirements.

Vulnerability Calculator Groups contain one or more Vulnerability Calculators that define how the risk score is calculated. To add custom logic, such as increasing the score based on a CI's relationship to a business service, you would typically clone the default calculator and modify its script. This script can query related records (like the Business Service) and adjust the score accordingly. This modified calculator is then made active within the group.

Flow Designer is ServiceNow's modern, low-code solution for process automation. It is the ideal tool for this scenario. A flow can be configured with a trigger that runs whenever a Vulnerability Group record is updated and its 'State' field changes to 'Awaiting Change'. The flow can then use the 'Create Record' action to generate a new change request, populating its fields with data from the vulnerability group.

In Performance Analytics, a Breakdown is used to group or filter indicator scores for more detailed analysis. To see MTTR (the Indicator) by operating system, you would create a Breakdown based on the 'Operating System' field of the Configuration Item table. This allows users to view the overall MTTR score and then drill down to see the scores for Windows, Linux, etc., individually.

For Application Vulnerable Items (AVIs), ServiceNow needs to distinguish the same vulnerability (e.g., a specific CWE) across different codebases. The unique key is typically a combination of the specific vulnerability identifier (from the scanner), the application or repository being scanned, and the specific branch where the vulnerability was found. This allows for tracking the same SQL injection flaw in the 'main' branch and a 'feature' branch as two distinct AVIs.

CI Lookup Rules are processed in ascending order. By setting the 'Order' field of the most reliable rule (FQDN) to a lower number (e.g., 100) than the other rules (e.g., NetBIOS at 200, IP at 300), you ensure it runs first. The matching process stops as soon as a successful match is found. Therefore, if the FQDN rule succeeds, the subsequent, less reliable rules will not be executed for that Discovered Item.

Assignment rules are executed in order, from the lowest 'Order' number to the highest. A common issue is having a generic, catch-all rule (e.g., 'Assign all Windows vulnerabilities to IT Support') with a low order number. This rule matches the VITs before a more specific rule (e.g., 'Assign vulnerabilities on servers with Support Group X to Team Y') gets a chance to run. The solution is to ensure specific rules have a lower order number than generic ones.

The best practice for managing credentials for integrations in Flow Designer and IntegrationHub is to use Connection & Credential Aliases. The alias separates the flow logic from the specific endpoint and credentials. The administrator needs to navigate to the alias used by the EDR spoke, and verify or update the associated Credential record. This approach allows for secure storage of credentials and easy updates without modifying the flow itself.

This strategy directly addresses all three objectives with practical, immediate steps. 1) The default assignment rule ensures critical VITs don't remain unassigned, meeting the 4-hour goal by routing them for manual triage while CMDB issues are fixed. 2) The auto-close rule immediately reduces noise, allowing the team to focus on higher-risk items. 3) Activating the exception workflow provides the required process for application owners. This pragmatic approach provides immediate value while the longer-term CMDB cleanup occurs in parallel.