Vulnerability Response Data Visualization
About 9% of the CIS-VR exam — see all 5 domains.
Smallest domain, but easy points if you know the surfaces.
- Performance Analytics (PA) for Vulnerability Response is a separately installed/configured content pack providing indicators (KPIs) and dashboards that trend remediation progress, open VI counts, overdue items, SLA attainment, and risk over time. PA enables historical/trend reporting, versus list/report views which show point-in-time data.
- Dashboards & homepages: out-of-box VR dashboards visualize the security posture — open vs. closed VIs, aging, top vulnerabilities, exposure by business service. You can add vulnerability significance charts to the homepage.
- Security posture / exposure views: reporting can be sliced by service classification and business service so leadership sees exposure where it matters.
- Roles gate who can see/build PA content (PA viewer/admin roles plus VR roles).
- Reports and dashboards are also used operationally to monitor integration run status and import health.
Sample questions from this domain
Three of the 23 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow capability is primarily used to deliver trended KPIs (indicators and the Analytics Hub) for Vulnerability Response over time?
- A. Report Designer reports
- B. Scheduled reports
- C. Performance Analytics ✓
- D. Metric definitions
Why: Performance Analytics delivers trended KPIs over time through indicators and the Analytics Hub, enabling Vulnerability Response leaders to track progress and identify trends. Reports built in Report Designer and scheduled reports show data as it is at query or send time rather than collected indicator scores, and metric definitions record durations or values on individual records rather than producing KPI trends.
What is the primary purpose of the Vulnerability Response dashboards?
- A. To let remediation owners update the state of assigned Vulnerable Items in bulk
- B. To configure the indicators, breakdowns and scheduled data collection jobs behind the metrics
- C. To visualize the organization's vulnerability posture, trends, and remediation progress ✓
- D. To approve exception and false positive requests raised against Vulnerable Items
Why: Vulnerability Response dashboards visualize posture, trends, and remediation progress so stakeholders can monitor and make decisions. Bulk updates happen in the workspaces and lists, indicators and data collection jobs are configured in Performance Analytics administration, and exception and false positive requests are approved by their approvers through Exception Management.
Which Performance Analytics component captures the value of a metric at a point in time so trends can be shown?
- A. An indicator with scheduled data collection (snapshots) ✓
- B. A breakdown with an element filter on business unit
- C. A threshold that alerts when the metric crosses a limit
- D. A report with a trend chart on the current records
Why: A Performance Analytics indicator with scheduled data collection captures metric values as snapshots over time, enabling trend visualization. A breakdown slices those scores by a dimension, a threshold alerts when a score crosses a limit, and a trend report charts current records by a date field rather than storing point-in-time values.