Access Control Lists (ACLs) are the core, declarative security mechanism in ServiceNow. Configuring a field-level ACL for the ‘state’ field that is conditional on the ‘priority’ field is the most direct, performant, and maintainable way to enforce this business rule. It operates at the platform level, applies to all interfaces (UI, API), and is centrally managed.

The key advantage of a Security Incident task (a child task of the Security Incident table) is that it inherits crucial contextual fields from its parent incident. This automatic propagation of fields like sensitivity, classification, and affected business units ensures all related work adheres to the same security and handling protocols without manual re-entry.

The Security Incident Response (SIR) workspace uses a stage-based process. Configuring a field as required within a specific stage (like ‘Triage’) is the most user-centric and process-aware approach. It ensures the data is captured at the correct point in the workflow, provides clear guidance to the analyst, and keeps the main table form less cluttered with conditional logic.

The native Reporting module is designed for this type of ad-hoc, historical trend analysis. It allows you to easily create a chart (like a line or bar chart), group data by a field (‘Attack Vector’), apply date filters (‘closed in last quarter’), and calculate aggregate metrics like average age (which represents MTTR). Performance Analytics is better for ongoing, strategic KPIs with targets.

A Business Rule with an ‘After’ execution timing is the standard and most efficient method for this real-time, event-driven automation. It fires immediately upon record submission (insert or update), evaluates the condition (classification == Malware), and performs the action (setting the assignment group) within the same transaction, ensuring immediate and consistent execution.

The ${URI_REF} tag generates a URL link to the current record. To specify which table the link is for (especially important when the notification may be used in different contexts), you use the syntax ${URI_REF:}. The label for the Security Incident table is ‘Security Incident’. This creates a proper, clickable link directly to the incident in the email.

Response Playbooks (often called Runbooks) are a core feature of the CIS-SIR exam scope. They are specifically designed to encapsulate a predefined sequence of tasks, approvals, and automated actions for a specific type of security incident. Executing a playbook ensures a consistent, repeatable, and auditable process is followed for complex scenarios like data exfiltration.

While an advanced filter with OR conditions (option C) would work, it’s manual and doesn’t cover unstructured text like the ‘Description’. Configuring a text search index on the Security Incident table for the key fields (Source IP, Target IP, Description, etc.) and then using the global search is the most comprehensive and user-friendly approach. It allows analysts to perform fast, Google-like searches across multiple fields at once.

ServiceNow has a built-in, platform-level auditing system. The simplest and most correct way to audit changes to a specific field is to navigate to the field’s dictionary entry (in Table Configuration) and check the ‘Audit’ checkbox. This automatically records all changes to that field in the sys_audit table, which is used for standard audit reports.

Access Control Lists (ACLs) are the core, declarative security mechanism in ServiceNow. Configuring a field-level ACL for the ‘state’ field that is conditional on the ‘priority’ field is the most direct, performant, and maintainable way to enforce this business rule. It operates at the platform level, applies to all interfaces (UI, API), and is centrally managed.0