ServiceNow Third-Party Risk Management Practice Test

These questions are part of the practice quiz. Start practicing

• To evaluate a vendor on a recurring basis, configure a record in which table?
• Which action helps define the boundary of an assessment?
• Baseline email notifications in vendor risk management are installed with which plugin?
• Which statement describes qualitative risk analysis?
• On the Contact record, the field for the Vendor name corresponds to which sys_user table field?
• Which geographic feature describes concentrated regional risk among third parties?
• Which of the following is a component of a Vendor Risk Management program?
• Which type of record stores information about a vendor risk issue?
• Assessments completion in the Vendor Portal is accomplished how?
• When defining catalog categories, which depth for subcategories is recommended?
• Which statement best describes the relationship for the Document Request Template’s metric mapping?
• The Question Bank stores what in the Template Designer's context?
• Which of the following is an example of a risk mitigation strategy?
• How many vendor risk areas can be designated per questionnaire template or assessment metric type?
• What is the definition of Risk Management?
• Which record type defines the metric’s scoring options?
• Which action can a vendor contact perform within the Vendor Portal?
• What happens to Vendor Risk Issues and their audit history when the associated vendor contact changes?
• Which is a baseline report included for Third-party Risk Management?
• Which of the following is NOT a type of vendor risk assessment in ServiceNow Vendor Risk Management?
• What is the first step in a Vendor Risk Management program?
• Which of the following is NOT a GRC record that can be related to an Entity?
• Which of the following is a benefit of implementing a Vendor Risk Management program?
• What is the purpose of a vendor risk management program?
• Baseline email notifications plugin is associated with which module?
• When an assessor creates an issue or task from the vendor record, it is grouped with other issues or tasks for what ServiceNow entity?
• Which Risk plugin provides the ability to set up a multi-level review and approval workflow?
• Which configuration option is described as the cloud-based solution in the material?
• When Third-party Risk is integrated with Policy and Compliance and Risk applications, the control status is automatically updated after the third-party risk assessment has moved to which state?
• Which action is NOT a function supported in the Vendor Portal for vendor users?
• From which release is the scoped vendor portal installed by default?
• What is the purpose of a risk register?
• What application provides you with capabilities to define multiple levels of approvals based on business rule definitions?
• Which of the following is best practice for vendor portal configuration?
• What is the primary distinction between vulnerability scanning and penetration testing?
• Which table stores Vendor Contact records?
• Which is a core component of risk management?
• In risk assessment, which step involves identifying the assets to be assessed?
• Which component can automatically assign a Vendor tier value?
• Which ServiceNow plugin is required for enabling Vendor Risk Management?
• Primary third-party and engagement contacts can support the following activities in the portal. Which option is not supported?
• Which process replaces the legacy tiering assessment in Third-party Risk Management?
• Which data cleansing option can modify data using scripts during import?
• The Template Designer is leveraged to create which of the following templates?
• Which record is used to document remediation or acceptance/non-compliance?
• What is the main objective of Vendor Risk Management?
• Which statement describes a key element of the Template Designer?
• Limitation of qualitative risk analysis?
• In risk assessment, which activity calculates the annualized loss expectancy (ALE)?
• Which action describes what happens when a vendor is assessed and responds affecting a control?
• Can a questionnaire be read by vendor contacts that are not assigned to it?
• From an Assessment record, the 'View Responses' function shows which category of responses?
• What is the no-code option to cleaning data before loading into the Vendor Risk application?
• Which option is NOT listed as part of the Template Designer’s elements alongside the Design Canvas?
• Which feature enables a multi-level review and approval workflow in risk management?
• Which action best describes the role of Contract Risk in the due diligence process?
• Which type of questionnaire is mentioned as part of a Vendor Risk Assessment?
• A Vendor Risk Assessment with a SIG Lite questionnaire and two document requests is displayed as how many total requests in the Vendor Portal?
• In an assessment workflow, which stage involves generating observations?
• Which practice should be emphasized when designing catalogs and categories?
• Which property overrides to the legacy vendor portal endpoint?
• Which field on the Vendor Contact form is commonly used to reach the vendor?
• The header bar in the Template Designer contains what?
• Which table holds core company data?
• Which practice aligns catalog categories with CMDB classes where possible?
• Which of the following template types is created with the Template Designer?
• What is the maximum number of levels that can be configured in the Vendor Risk Management hierarchy in ServiceNow?
• What is the overall purpose of the Vendor Portal in third-party risk management?
• Which assessment phase automatically triggers issue creation if conditions are met?
• What is the exact table name used for vendor risk assessments in reporting?
• Before making configuration changes, which role is required to select the correct update set and application scope?
• Which statement best describes the scope of sn_vdr_risk prefixed roles?
• Which of the following is a metric definition?
• Which of the following is not a component of a Vendor Risk Management program?
• Which statement correctly describes a typical limit on top-level categories?
• What is the baseline risk assessment reminders schedule prior to an assessment deadline?
• Which object represents a Third-party Risk Issue in VRM?
• Who can create the Third-party Portfolio?
• What is a vendor portal configuration?
• What is the exact role identifier for the Vendor Risk Assessor?
• Which table represents a Vendor Risk Issue data?
• Which statement best describes the assessment workflow in the Vendor Portal?
• Which of the following is NOT a process in the Due Diligence workflow?
• In ServiceNow, which component is required to enable Vendor Risk Management?
• What is the most common type of vendor portal configuration?
• Who can read through third-party assessment questions in the portal?
• What is the minimum role required to create a new Vendor Risk Issue?
• Which type of record captures risks registered within an organization?
• In the Vendor Portal, who can reassign Assessments?
• Which practice focuses on detecting vulnerabilities without exploiting them?
• Which role must the primary vendor contact have for issue visibility in the vendor portal?
• Which of the following is NOT a baseline field when creating a new Vendor Contact?
• Not a step in the risk assessment process?
• Vendor Risk Tasks are saved to which table?
• What is the minimum role required to create or modify third-party records?
• Which option would you use to automatically normalize data during the import process?
• Not a type of assessment that can be conducted?
• Which object represents a Third-party Risk Assessment in VRM?
• Vendor Risk Issues are usually created in which stage of an Assessment?
• Third-party risk issues are considered inactive when they enter which state?
• In the ServiceNow VRM workflow, which artifact is typically created after the Vendor Risk Assessment?
• What is the primary objective of Vendor Risk Management?
• Which release introduced support for Third-party Risk Due Diligence in the Vendor Management workspace?
• Which statement correctly describes vendor risk task storage?
• What is one of the clickable metrics at the top of the Due Diligence management page?
• Risk registered within an organization are captured as which type of record in ServiceNow?
• Which two fields are included on the Third-party Contact form?
• Which statement correctly describes quantitative risk assessment?
• Which of the following is a common table used for Vendor Risk Management reporting?
• The Control Status is updated when the Vendor Risk Assessment state is which?
• Which statement about vulnerability scanning results is true?
• Vendor Risk Issues are considered inactive when they enter this state:
• Which state indicates that tiering work for a vendor is finished and applied?
• Which pair of fields constitutes the required fields on the Third-party Risk Assessment form?
• What is the difference between a risk appetite and risk tolerance?
• Which outcome is a direct result of implementing Vendor Risk Management?
• Which process is designed to evaluate inherent risk before other due diligence steps?
• Where can the score for each Assessment Metric or Metric Category be configured?
• Which of the following is a benefit of using a vendor portal?
• Which portal can be configured to modify the Third-party Assessment Portal?
• Which option best describes a vendor portal's primary purpose?
• Which action cannot be performed from the Third-party Portal?
• In the Paris release and beyond, the scoped vendor portal will be installed by default and can be overridden in which System Property record to use the legacy portal?
• In the assessment workflow, the 'View Responses' button reveals which category of responses?
• Which table stores Vendor Benchmark Scores?
• When does the tiering value appear on a Vendor record?
• Which of the following statements is true about Third-party Risk Issues?
• What is the purpose of the Third-party Risk Issues record?
• Which of the following is NOT an internal role in Vendor Risk Management?
• What is a commonly recommended limit for the number of top-level catalog categories?
• Vendor Contact extends which base table?
• Which sequence of steps most clearly reflects core assessment activities?
• Which fields are included on the Vendor Contact form?
• When designing dashboards for Third-party Risk Management, which is identified as a consideration for stakeholders?
• What is a typical feature of vendor portal configuration software?
• Which role is required to ensure the correct update set and application scope are selected before making configuration changes?
• Assessments sharing in the Vendor Portal is described as which of the following?
• Which option is used for data cleansing when importing vendor data?
• Which statement best describes the relationship between a dashboard and a report?
• Not a step in the assessment process?
• A Vendor Risk Task can be created from which of the following records?
• What ServiceNow feature helps companies manage third parties without emails and spreadsheets?
• Which table stores the mapping from M2M Trigger to Questionnaire?
• What is the primary purpose of aligning catalog categories with CMDB classes?
• Which instrument is used for basic due diligence in vendor assessments?
• What type of record is used to document missing or noncompliant third-party responses and remediation or to accept any non compliance?
• Which term describes accepting the risk without additional controls?
• Which action is supported for updating application configuration in the environment, according to the material?
• What is the minimum role required to complete a Third-party provider setup?
• Which action can be performed in the Vendor Portal to manage relationships?
• Which statement is true about the visibility of Vendor Risk Issues after a vendor contact changes?
• Which activity is NOT available from the Third-party Portal?
• What is the most common type of vendor portal configuration?
• During Generating Observations phase, which action might the Risk Assessor take?
• To display Critical Vendors, which data source table should you query?
• What is the advantage of using both VRM and GRC/IRM?
• Roles preceded by sn_vdr_risk are for which GRC scope?
• What is the main benefit of the Vendor Portal in Vendor Risk Management?
• The Vendor Risk Assessment consists of SIG Lite and two document requests. What is the total number of requests displayed?
• What is the benefit of using a dashboard with real-time data?
• Which of the following is NOT a baseline field when creating a new Vendor Contact? (alternate phrasing)
• To what type of assessment record can a vendor contact respond?
• In a third-party risk workflow, which state indicates the assessment is moving toward completion and final validation by a party?
• Which statement about the Inherent Risk Questionnaire is true?
• Which record stores vendor risk issues and their related interactions?
• What is the score range used for All Assessment Metrics within a Metric Category?
• Which action can occur in the Third-party Portal?
• Which role is required to read through third-party assessment questions in the portal?
• Which ServiceNow tool is used for generating security ratings for vendors?
• What Third-party Risk Management feature pinpoints the geographical locations of active third parties and engagements?
• Which Due Diligence workflow process allows the negotiator to access all the data from the preceding processes in the Due Diligence workflows to design and settle the contract?
• Which statement best describes vulnerability scanning limitations?
• What is the purpose of a penetration test?
• Which role is automatically granted to vendor contacts at creation? (alternate phrasing)
• Which activity follows risk assessment?
• Which type of questionnaire is used internally to determine the vendor relationship?
• What role is required for a third-party contact to be able to assign an issue?
• Where do vendors manage issues, respond to requests, and fulfill tasks assigned to them?
• In the Vendor Risk Management data model, the score for an individual Assessment Metric is configured in which type of record?
• The assessment page provides an area to import what kind of a completed questionnaire?
• Which statement describes a limitation of vulnerability scanning?
• If clean data is not provided, which baseline solution is available within the platform?
• Which action in an issue response generates an additional task?
• What new feature was added to the Vendor Management workspace for the Vancouver release?
• The Vendor records are stored in which table?
• Which of the following is a valid set of core assessment steps?
• Which statement accurately describes the visibility and audit history of actions in the Vendor Risk Management application?
• Which Service Portal can be configured to modify the Third-party Assessment Portal?
• What table stores the information to trigger a particular risk assessment to be sent to a third party based on a response to an IRQ question?
• Which statement about the Template Designer is true?
• Not a component of the risk management process?
• Which table is a common source for Third-party Risk Management reporting?
• Role automatically assigned to vendor contacts on creation?
• Which issue response generates an additional task?
• What is the recommended depth for catalog subcategories?
• Which of the following is NOT a component of a vulnerability management program?
• Which option represents the correct sequence of steps for creating a new vendor risk assessment in ServiceNow Vendor Risk Management?
• What are individual questions within a questionnaire referred to as?
• Which prefix is used for vendor risk-related roles in the GRC namespace?
• Which tab contains the questions and categories that were added to the Question Bank?
• Which table stores the Vendor Risk Assessment data?
• Which of the following is NOT a typical feature of vendor portal configuration software?
• What is a vendor portal?
• In the baseline, which component sends reminder notifications about assessments?
• Which table stores the mapping from a multi-to-many relationship between questions and questionnaires?
• Document Request Template is a record in which table?
• Which statement is not consistent with catalog category best practices?
• A single risk assessment in the Vendor Portal is assigned to how many vendor contacts?
• Which role is responsible for creating the Third-party Portfolio?
• What is the difference between quantitative and qualitative risk assessment?
• What is the difference between a dashboard and a report?
• How can vendor portal configuration help a company reduce costs?
• Who is responsible for providing the Vendor Risk Assessment?
• What is the primary purpose of the Vendor Portal in relation to assessments?
• Which table is the Vendor Risk Issue table?
• How are Vendor Risk questionnaires and document requests displayed on the Vendor Portal?
• Which statement best describes the SIG Lite?
• For a vendor risk issue to be visible in the Vendor Portal, which condition must be met?
• The VRM issue management process is frequently unique to an organization. How is this described?
• Which table stores Survey Scored data?
• Risks registered within an organization are captured as which type of record in ServiceNow?