Vulnerability Response Applications and Modules
About 20% of the CIS-VR exam — see all 5 domains.
Foundational orientation: what VR is, how it installs, and how it sits inside Security Operations (SecOps).
- Vulnerability Response is part of the Security Operations product family, alongside Security Incident Response (SIR), Configuration Compliance, and Threat Intelligence. VR shares SecOps-common components (CI lookup rules, calculators) with its siblings.
- VR is delivered as a Store application with dependent plugins/components, installed and then configured through the Setup Assistant, which walks an implementer through enabling features, assigning persona roles, and configuring integrations.
- Companion applications you should recognize:
- Configuration Compliance — tests CIs against policy (e.g., CIS/SCAP benchmarks); shares the SecOps-common plumbing with VR.
- Container Vulnerability Response (CVR) — extends VR to container images.
- Application Vulnerability Response (AVR) — for application-layer findings.
- Vulnerability Solution Management (VSM) — maps vulnerabilities to vendor solutions/patches (Microsoft MSRC, Red Hat, Rapid7 solutions) so remediation knows what fix to apply.
- CMDB is a hard dependency: VR cannot meaningfully match detections without configuration items. Performance Analytics powers the dashboards (Domain 5).
- Core navigation surfaces: the Vulnerability Response application menu, the Vulnerability Manager / Vulnerability Analyst Workspace, and homepages/dashboards. Records live in tables prefixed
sn_vul_*.
Sample questions from this domain
Three of the 60 in this domain, with the reasoning. The full set is in the question bank.
In ServiceNow Vulnerability Response, which record type represents a unique weakness as defined by a source such as the National Vulnerability Database (NVD) before it is associated with any affected asset?
- A. Remediation Task
- B. Vulnerable Item (VI)
- C. Vulnerability Group
- D. Third-Party Vulnerability Entry ✓
Why: A Third-Party Vulnerability Entry stores the definition of a unique weakness (for example a CVE) imported from a source such as the NVD or a scanner, independent of any asset. Vulnerable Items are created only when that entry is matched to a configuration item, so they represent an affected asset rather than the definition. A Vulnerability Group is a logical collection used for bulk remediation, and a Remediation Task is the work item assigned to fix items. Therefore the definition record is the Third-Party Vulnerability Entry.
A Vulnerable Item (VI) in Vulnerability Response is best described as which of the following?
- A. The mapping of a single vulnerability to a single affected configuration item ✓
- B. A scanner credential used to authenticate to assets
- C. A Performance Analytics indicator for open vulnerabilities
- D. A grouping of remediation tasks assigned to one team
Why: A Vulnerable Item represents the intersection of one vulnerability and one affected configuration item (CI), which is the unit of work that gets remediated. It is not a grouping of tasks (that is a Vulnerability Group), not a scanner credential, and not a Performance Analytics indicator. The VI is the foundational record that links the vulnerability definition to the impacted asset.
Which application is a prerequisite that Vulnerability Response depends on for its underlying issue and response framework?
- A. Security Incident Response (SIR)
- B. Governance, Risk, and Compliance (GRC) Policy
- C. Security Operations common foundation (Security Support Common) ✓
- D. IT Service Management (ITSM) Incident
Why: Vulnerability Response is built on the Security Operations foundation, commonly delivered through the Security Support Common (foundation) store application that provides shared tables and framework used across Security Operations products. Security Incident Response is a sibling Security Operations application, not a prerequisite for Vulnerability Response. ITSM Incident and GRC Policy are separate product lines and are not required for Vulnerability Response to function.