Vulnerability Response Applications and Modules
About 20% of the CIS-VR exam — see all 5 domains.
Foundational orientation: what VR is, how it installs, and how it sits inside Security Operations (SecOps).
- Vulnerability Response is part of the Security Operations product family, alongside Security Incident Response (SIR), Configuration Compliance, and Threat Intelligence. VR shares SecOps-common components (CI lookup rules, calculators) with its siblings.
- VR is delivered as a Store application with dependent plugins/components, installed and then configured through the Setup Assistant, which walks an implementer through enabling features, assigning persona roles, and configuring integrations.
- Companion applications you should recognize:
- Configuration Compliance — tests CIs against policy (e.g., CIS/SCAP benchmarks); shares the SecOps-common plumbing with VR.
- Container Vulnerability Response (CVR) — extends VR to container images.
- Application Vulnerability Response (AVR) — for application-layer findings.
- Vulnerability Solution Management (VSM) — maps vulnerabilities to vendor solutions/patches (Microsoft MSRC, Red Hat, Rapid7 solutions) so remediation knows what fix to apply.
- CMDB is a hard dependency: VR cannot meaningfully match detections without configuration items. Performance Analytics powers the dashboards (Domain 5).
- Core navigation surfaces: the Vulnerability Response application menu, the Vulnerability Manager / Vulnerability Analyst Workspace, and homepages/dashboards. Records live in tables prefixed
sn_vul_*.
Sample questions from this domain
Three of the 60 in this domain, with the reasoning. The full set is in the question bank.
In ServiceNow Vulnerability Response, which record type represents a unique weakness as defined by a scanner vendor (for example a Qualys QID) before it is associated with any affected asset?
- A. NVD Entry (CVE definition)
- B. CWE Entry (weakness type)
- C. Vulnerable Item Detection record
- D. Third-Party Vulnerability Entry ✓
Why: A Third-Party Vulnerability Entry stores a scanner vendor's own definition of a weakness (for example a Qualys QID), lists the CVEs it references, and exists independently of any asset. An NVD entry is also asset independent, but it holds a CVE as published by the National Vulnerability Database in the NVD library, not the scanner vendor's definition, and a CWE entry is a reference weakness type rather than a scanner's vulnerability definition. A Vulnerable Item Detection is a single occurrence reported by a scanner on an asset, so it already belongs to an affected asset.
A Vulnerable Item (VI) in Vulnerability Response is best described as which of the following?
- A. The mapping of a single vulnerability to a single affected configuration item ✓
- B. The definition of a single weakness as published by a scanner vendor or by the NVD library
- C. One scanner detection record of a vulnerability on a host, with its own port and proof data
- D. A grouping of vulnerable items for one assignment group, created by a remediation task rule
Why: A Vulnerable Item is created when an imported vulnerability matches a configuration item, so it represents one vulnerability on one affected CI and is the unit of work that gets remediated. The asset independent weakness definition is a library entry (NVD or third-party), a single scanner occurrence with port and proof data is a Vulnerable Item Detection, and a grouping of vulnerable items built by a remediation task rule is a remediation task.
Which application is a prerequisite that Vulnerability Response depends on for its underlying issue and response framework?
- A. Security Incident Response (SIR) core incident application
- B. Governance, Risk, and Compliance (GRC) Policy and Compliance Management
- C. Security Operations common foundation (Security Support Common) ✓
- D. IT Service Management (ITSM) Incident and Problem Management
Why: Vulnerability Response is built on the Security Operations foundation, delivered through the Security Support Common store application that provides shared tables and framework used across Security Operations products. Security Incident Response is a sibling Security Operations application that also builds on that foundation, so it is not a prerequisite for Vulnerability Response. ITSM Incident and Problem Management and GRC Policy and Compliance Management are separate product lines and are not required for Vulnerability Response to function.