Free ServiceNow Certified Implementation Specialist – Risk and Compliance Practice Questions

Sample Practice Questions

Try these 10 sample questions from the ServiceNow Certified Implementation Specialist – Risk and Compliance practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In the compliance chain, which record represents a specific clause extracted from an external authority document?

   1. A.CitationCorrect answer: A
   2. B.Control objective
   3. C.Control
   4. D.Entity type

   Explanation: ServiceNow states, "Citation: A specific clause extracted from the source, such as “Article 32: Encryption of personal data.”" This identifies the requested concept.

   Reference: Control Management: From Compliance Requirements to Entity-Level Controls & Scoring — The Compliance Chain

2. 2Which use case does Policy and Compliance Management support for organizational obligations?

   1. A.Connect external regulations to internal policies and monitor their controlsCorrect answer: A
   2. B.Replace external regulations with internally authored policies
   3. C.Exclude control objectives from regulatory traceability
   4. D.Store obligations without linking them to any controls

   Explanation: ServiceNow states, "Policy and Compliance Management connects external regulations to your internal policies, control objectives, and controls, and then lets you test and monitor those controls." This supports the selected answer.

   Reference: New Speed Learning! Implementing IRM Policy and Compliance Management — Introduction

3. 3A source record matches filters for two entity types. How does entity generation handle the overlap?

   1. A.It creates a separate entity for each type.
   2. B.It links one entity to matching types without duplication.Correct answer: B
   3. C.It removes the entity from both matching types.
   4. D.It creates an entity only for the first matching type.

   Explanation: ServiceNow states, "Yes. An entity links to all types whose filter it matches. No duplicates are created — the platform detects overlap." This supports the selected result.

   Reference: Control Management: From Compliance Requirements to Entity-Level Controls & Scoring — FAQ: Entity & Compliance Framework, Entity Modeling

4. 4Which policy lifecycle stage follows Draft and precedes Awaiting Approval?

   1. A.Draft
   2. B.ReviewCorrect answer: B
   3. C.Published
   4. D.Retired

   Explanation: ServiceNow states, "A policy moves through five states: Draft (created and defined), Review (reviewed and edited by assigned reviewers), Awaiting Approval (approval task routed to the approver), Published (active, with KB article auto-generated), and Retired (inactive, record preserved for audit)." This establishes the requested lifecycle behavior.

   Reference: New Speed Learning! Implementing IRM Policy and Compliance Management — Policy and Compliance Management FAQs, How does the policy lifecycle work?

5. 5In the Xanadu classic risk process, what is the initial state of a newly created risk in the register?

   1. A.DraftCorrect answer: A
   2. B.Assess
   3. C.Monitor
   4. D.Retired

   Explanation: The Xanadu process guide states, "When a risk is first created in the risk register, it is in a state of Draft." This supports the selected answer.

   Reference: GRC: Risk Management Process Guide — Risk Lifecycle (Classic), Process Flow: Draft, page 12

6. 6Before creating UCF shared lists for import, what does the ServiceNow process guide require?

   1. A.A UCF Common Controls Hub accountCorrect answer: A
   2. B.Only a ServiceNow audit engagement
   3. C.No UCF account when using a shared list
   4. D.Only an entity type and an entity class

   Explanation: ServiceNow states, "Users must have a UCF Common Controls Hub account to create shared lists and import them into the ServiceNow instance." This supports the selected answer.

   Reference: GRC Policy and Compliance Management Process Design Guide — Unified Compliance Framework, page 15

7. 7Which sequence reflects the broad Audit Management process described by ServiceNow?

   1. A.Plan engagements, execute them, and report findingsCorrect answer: A
   2. B.Execute engagements, report findings, and then plan
   3. C.Report findings, plan engagements, and then execute
   4. D.Plan engagements, report findings, and then execute

   Explanation: ServiceNow states, "A set of activities related to planning audit engagements, executing engagements, and reporting findings to the audit committee and executive board." This supports the selected answer.

   Reference: IRM Journey: Audit Management — Provide assurance to stakeholders, page 17

8. 8In the compliance chain, what does a control objective describe?

   1. A.A specific clause in an external document
   2. B.What the organization must achieveCorrect answer: B
   3. C.An individual entity being assessed
   4. D.A testable record generated for an in-scope entity

   Explanation: ServiceNow states, "Control Objective: What the organization must achieve." This identifies the requested concept.

   Reference: Control Management: From Compliance Requirements to Entity-Level Controls & Scoring — The Compliance Chain

9. 9Which sequence does ServiceNow recommend for an initial Risk Workspace rollout?

   1. A.Validate in production, then configure a test instance.
   2. B.Install and validate in sub-production before going live.Correct answer: B
   3. C.Go live first, then validate in sub-production.
   4. D.Load production data and defer validation until after go-live.

   Explanation: ServiceNow states, "Setup: Install and validate in sub-production first." This supports the selected answer.

   Reference: Risk Workspace in IRM Risk Management — Best practices for implementation

10. 10What happens when a source record changes and begins to meet an entity filter's conditions?

    1. A.The entity must be manually recreated before joining the type.
    2. B.The corresponding entity can join the matching type automatically.Correct answer: B
    3. C.The entity remains permanently outside all entity types.
    4. D.The entity joins the type only after its prior record is deleted.

    Explanation: ServiceNow states, "Self-maintaining scope: When filter conditions or source records change, linked entities update automatically." This supports the selected result.

    Reference: Control Management: From Compliance Requirements to Entity-Level Controls & Scoring — Scoping with Entity Filters