Vulnerability Response Data Visualization
About 9% of the CIS-VR exam — see all 5 domains.
Smallest domain, but easy points if you know the surfaces.
- Performance Analytics (PA) for Vulnerability Response is a separately installed/configured content pack providing indicators (KPIs) and dashboards that trend remediation progress, open VI counts, overdue items, SLA attainment, and risk over time. PA enables historical/trend reporting, versus list/report views which show point-in-time data.
- Dashboards & homepages: out-of-box VR dashboards visualize the security posture — open vs. closed VIs, aging, top vulnerabilities, exposure by business service. You can add vulnerability significance charts to the homepage.
- Security posture / exposure views: reporting can be sliced by service classification and business service so leadership sees exposure where it matters.
- Roles gate who can see/build PA content (PA viewer/admin roles plus VR roles).
- Reports and dashboards are also used operationally to monitor integration run status and import health.
Sample questions from this domain
Three of the 23 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow capability is primarily used to deliver trended KPIs and scorecards for Vulnerability Response over time?
- A. The NVD feed
- B. The transform map
- C. Performance Analytics ✓
- D. The MID Server status page
Why: Performance Analytics delivers trended KPIs and scorecards over time, enabling Vulnerability Response leaders to track progress and identify trends. The MID Server status page reports connectivity, the transform map handles imports, and the NVD feed supplies data, none of which provide trended analytics. Performance Analytics is the standard analytics engine for VR metrics.
What is the primary purpose of the Vulnerability Response dashboards?
- A. To define CMDB identification rules
- B. To store scanner credentials
- C. To visualize the organization's vulnerability posture, trends, and remediation progress ✓
- D. To configure MID Server clusters
Why: Vulnerability Response dashboards visualize posture, trends, and remediation progress so stakeholders can monitor and make decisions. They do not store credentials, configure MID Server clusters, or define identification rules. Visualization for decision support is the core purpose of dashboards.
Which Performance Analytics component captures the value of a metric at a point in time so trends can be shown?
- A. An indicator with scheduled data collection (snapshots) ✓
- B. A MID Server heartbeat
- C. A UI Policy
- D. A transform map
Why: A Performance Analytics indicator with scheduled data collection captures metric values as snapshots over time, enabling trend visualization. A MID Server heartbeat, transform map, and UI Policy do not collect trended metric data. Indicators and their scheduled collection are the foundation of PA trending.