{"id":18894,"date":"2026-09-22T10:28:34","date_gmt":"2026-09-22T10:28:34","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=18894"},"modified":"2026-09-22T10:28:34","modified_gmt":"2026-09-22T10:28:34","slug":"servicenow-cis-rc-practice-test-questions-and-exam-dumps-part20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/servicenow-cis-rc-practice-test-questions-and-exam-dumps-part20-q381-400\/","title":{"rendered":"ServiceNow CIS-RC Practice Test Questions and Exam Dumps Part20 Q381-400"},"content":{"rendered":"

View Full <\/b>ServiceNow CIS-RC Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 381.<\/b><\/p>\n

An organization wants to define a measurable warning point for a key risk indicator. What should it configure conceptually?<\/b><\/p>\n

    \n
  1. <\/b> A threshold<\/span>
    \n<\/span>2.<\/b> A policy exception<\/span>
    \n<\/span>3.<\/b> A control objective<\/span>
    \n<\/span>4.<\/b> A remediation task<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1. A threshold<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    A threshold defines a level at which a risk indicator should trigger attention, investigation, escalation, or another governance response. Thresholds help translate indicator values into actionable monitoring. They are particularly useful when combined with trends because management can see both whether a limit has been crossed and whether conditions are moving toward that limit. A policy exception documents a deviation, while control objectives and remediation tasks serve different purposes.<\/span><\/p>\n

    Question 382.<\/b><\/p>\n

    A key risk indicator has not breached its threshold, but its value is worsening every month. What is the best response?<\/b><\/p>\n

      \n
    1. <\/b> Wait until the threshold is exceeded<\/span>
      \n<\/span>2.<\/b> Review the trend and investigate the underlying risk condition<\/span>
      \n<\/span>3.<\/b> Close the related risk<\/span>
      \n<\/span>4.<\/b> Retire the associated controls<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2. Review the trend and investigate the underlying risk condition<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      A deteriorating trend can provide early warning even before a formal threshold is crossed. Reviewing the trend allows management to investigate whether the risk environment, control performance, or business conditions are changing. This may lead to additional monitoring, treatment, or reassessment. Waiting until the limit is breached can delay action. The trend does not automatically prove that the risk has increased, but it provides meaningful information for proactive risk management.<\/span><\/p>\n

      Question 383.<\/b><\/p>\n

      A business unit exceeds a specific acceptable exposure limit that was derived from the organization\u2019s broader risk appetite. What has most directly been exceeded?<\/b><\/p>\n

        \n
      1. <\/b> Risk register<\/span>
        \n<\/span>2.<\/b> Control frequency<\/span>
        \n<\/span>3.<\/b> Risk tolerance<\/span>
        \n<\/span>4.<\/b> Policy lifecycle<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3. Risk tolerance<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        Risk tolerance expresses a more specific acceptable boundary or variation for a particular risk, metric, or activity. It is often derived from the organization\u2019s broader risk appetite. When actual exposure exceeds tolerance, the situation may require escalation, additional treatment, or formal approval. Risk appetite provides broader strategic guidance, while tolerance establishes more operationally specific limits that can be monitored and acted upon.<\/span><\/p>\n

        Question 384.<\/b><\/p>\n

        Which control type is designed primarily to identify an undesirable event after or while it occurs?<\/b><\/p>\n

          \n
        1. <\/b> Preventive control<\/span>
          \n<\/span>2.<\/b> Compensating control<\/span>
          \n<\/span>3.<\/b> Corrective control<\/span>
          \n<\/span>4.<\/b> Detective control**<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4. Detective control<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          Detective controls identify errors, exceptions, or undesirable events after or while they occur. Examples can include reconciliations, log reviews, exception reports, and transaction monitoring. Preventive controls attempt to stop events before they happen, while corrective controls help address consequences afterward. Compensating controls provide alternative protection when a preferred control cannot be implemented.<\/span><\/p>\n

          Question 385.<\/b><\/p>\n

          A required control cannot be implemented because of a legacy-system limitation. What should the organization consider?<\/b><\/p>\n

            \n
          1. <\/b> Implementing an appropriate compensating control<\/span>
            \n<\/span>2.<\/b> Deleting the requirement<\/span>
            \n<\/span>3.<\/b> Marking the control effective without evidence<\/span>
            \n<\/span>4.<\/b> Ignoring the related risk<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. Implementing an appropriate compensating control<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            A compensating control is an alternative safeguard used when the preferred control cannot be implemented. The organization should document why the original control is unavailable, how the alternative addresses the intended objective, and who approved the approach. The compensating control should be tested and monitored like other controls. Simply ignoring the requirement or marking the original control effective would produce inaccurate compliance and risk information.<\/span><\/p>\n

            Question 386.<\/b><\/p>\n

            A monthly control has only evidence from nine months ago. What is the primary assessment concern?<\/b><\/p>\n

              \n
            1. <\/b> The policy has too many versions<\/span>
              \n<\/span>2.<\/b> The evidence may not demonstrate current operating effectiveness<\/span>
              \n<\/span>3.<\/b> The risk taxonomy is incorrect<\/span>
              \n<\/span>4.<\/b> The business entity should be retired<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2. The evidence may not demonstrate current operating effectiveness<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              Evidence should be relevant to the assessment period and sufficiently current to support conclusions about control performance. Nine-month-old evidence may show that a monthly control operated historically, but it does not establish that the activity continues to occur. Evidence freshness is therefore an important consideration when evaluating recurring controls. Additional current evidence may be needed before the assessor can conclude that the control remains effective.<\/span><\/p>\n

              Question 387.<\/b><\/p>\n

              A control failed, corrective action was completed, and the issue owner wants to close the deficiency. What should occur first?<\/b><\/p>\n

                \n
              1. <\/b> Delete the previous failed assessment<\/span>
                \n<\/span>2.<\/b> Automatically lower the related risk score<\/span>
                \n<\/span>3.<\/b> Re-test or reassess the remediated control<\/span>
                \n<\/span>4.<\/b> Remove the control owner<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3. Re-test or reassess the remediated control<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                Re-testing helps verify that remediation actually corrected the original deficiency. Without this verification, closing the issue could leave an ineffective control in place. The original assessment should usually remain available as part of the historical record. Successful re-testing, along with appropriate closure evidence, provides a stronger basis for determining that corrective actions were effective and the issue can be resolved.<\/span><\/p>\n

                Question 388.<\/b><\/p>\n

                Why is a consistent risk assessment methodology valuable across multiple subsidiaries?<\/b><\/p>\n

                  \n
                1. <\/b> It guarantees identical risk scores<\/span>
                  \n<\/span>2.<\/b> It removes the need for entity-specific context<\/span>
                  \n<\/span>3.<\/b> It eliminates risk ownership<\/span>
                  \n<\/span>4.<\/b> It improves comparability and aggregation of risk results**<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4. It improves comparability and aggregation of risk results<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  A consistent methodology applies common definitions, scales, and criteria across entities. This makes it easier to compare similar exposures, aggregate enterprise risk information, and prioritize treatment. Different subsidiaries may still receive different scores because their actual conditions and controls differ. Consistency improves interpretability without removing the need for local context, ownership, or professional judgment.<\/span><\/p>\n

                  Question 389.<\/b><\/p>\n

                  Which concept provides a structured classification of risks into categories and subcategories?<\/b><\/p>\n

                    \n
                  1. <\/b> Risk taxonomy<\/span>
                    \n<\/span>2.<\/b> Policy acknowledgment<\/span>
                    \n<\/span>3.<\/b> Control evidence<\/span>
                    \n<\/span>4.<\/b> Issue aging<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. Risk taxonomy<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    A risk taxonomy organizes risks into defined categories and subcategories such as strategic, operational, technology, compliance, or financial. Using a common taxonomy improves reporting, aggregation, communication, and consistency across the organization. It helps management understand concentrations of exposure and compare similar risks. A taxonomy does not determine the actual risk score; it provides structure for classification and analysis.<\/span><\/p>\n

                    Question 390.<\/b><\/p>\n

                    A company wants to prevent unauthorized transactions before they are processed. Which control type is most appropriate?<\/b><\/p>\n

                      \n
                    1. <\/b> Detective control<\/span>
                      \n<\/span>2.<\/b> Preventive control<\/span>
                      \n<\/span>3.<\/b> Corrective control<\/span>
                      \n<\/span>4.<\/b> Risk acceptance<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2. Preventive control<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      Preventive controls are designed to stop undesirable events before they occur. Examples include approval workflows, access restrictions, segregation of duties, and automated validation rules. Detective controls identify events after or while they occur, while corrective controls help address consequences afterward. Risk acceptance is not a control type; it is a decision to retain exposure.<\/span><\/p>\n

                      Question 391.<\/b><\/p>\n

                      A policy has reached the end of its review cycle. What should happen next?<\/b><\/p>\n

                        \n
                      1. <\/b> It should automatically remain active forever<\/span>
                        \n<\/span>2.<\/b> All related controls should be deleted<\/span>
                        \n<\/span>3.<\/b> The policy should be reviewed and either reaffirmed, revised, or retired<\/span>
                        \n<\/span>4.<\/b> The policy should be converted into an issue<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3. The policy should be reviewed and either reaffirmed, revised, or retired<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        Periodic policy review helps ensure that policies remain aligned with current regulations, business processes, organizational responsibilities, and control expectations. At the end of a review cycle, the policy should be evaluated and then reaffirmed, updated, or retired as appropriate. This supports an effective policy lifecycle and reduces the risk that obsolete guidance remains in force.<\/span><\/p>\n

                        Question 392.<\/b><\/p>\n

                        A temporary policy exception has been approved. Which information is most important to record?<\/b><\/p>\n

                          \n
                        1. <\/b> Browser type<\/span>
                          \n<\/span>2.<\/b> Knowledge article count<\/span>
                          \n<\/span>3.<\/b> User-interface preferences<\/span>
                          \n<\/span>4.<\/b> Rationale, approver, scope, expiration date, and compensating safeguards**<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 4. Rationale, approver, scope, expiration date, and compensating safeguards<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          A well-governed policy exception should clearly document why the exception is needed, who approved it, what it covers, how long it remains valid, and what alternative safeguards are in place. This prevents temporary deviations from becoming uncontrolled permanent practices. The exception should also be reviewed before expiration and either closed, renewed, or replaced with a more permanent solution.<\/span><\/p>\n

                          Question 393.<\/b><\/p>\n

                          A major acquisition changes systems, processes, and business responsibilities. What should happen to affected risks?<\/b><\/p>\n

                            \n
                          1. <\/b> They should be reassessed because the exposure environment has materially changed<\/span>
                            \n<\/span>2.<\/b> They should automatically be accepted<\/span>
                            \n<\/span>3.<\/b> They should all be closed<\/span>
                            \n<\/span>4.<\/b> Their control relationships should be removed<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1. They should be reassessed because the exposure environment has materially changed<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            Material business changes can alter likelihood, impact, ownership, control effectiveness, and treatment assumptions. An acquisition may introduce new systems, processes, vendors, regulations, or organizational dependencies. Reassessing affected risks helps ensure that current ratings reflect actual conditions. Existing control mappings and treatment plans may also need review so the combined organization maintains an accurate risk profile.<\/span><\/p>\n

                            Question 394.<\/b><\/p>\n

                            An organization uses automated feeds to monitor key risk indicators every day. What is the main advantage?<\/b><\/p>\n

                              \n
                            1. <\/b> It eliminates human oversight<\/span>
                              \n<\/span>2.<\/b> It provides more timely visibility into changing risk conditions<\/span>
                              \n<\/span>3.<\/b> It guarantees risks remain within tolerance<\/span>
                              \n<\/span>4.<\/b> It permanently replaces formal assessments<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2. It provides more timely visibility into changing risk conditions<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Automated monitoring can detect threshold breaches, anomalies, or deteriorating trends more quickly than periodic manual reviews alone. This allows management to investigate and respond to changing conditions sooner. Human judgment remains important for interpreting results and deciding what action to take. Continuous monitoring improves timeliness, but it does not guarantee compliance, eliminate risk, or completely replace formal assessments.<\/span><\/p>\n

                              Question 395.<\/b><\/p>\n

                              An assessor cannot obtain required evidence for a control. What should happen?<\/b><\/p>\n

                                \n
                              1. <\/b> Assume the control is effective<\/span>
                                \n<\/span>2.<\/b> Close the assessment without comment<\/span>
                                \n<\/span>3.<\/b> Document the evidence gap and evaluate its effect on the conclusion<\/span>
                                \n<\/span>4.<\/b> Delete the control<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 3. Document the evidence gap and evaluate its effect on the conclusion<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                Missing evidence can limit the assessor\u2019s ability to support a conclusion about control effectiveness. The gap should be documented and evaluated according to the assessment methodology. Additional evidence may be requested, or the missing support may contribute to a deficiency or an unfavorable result. Assuming effectiveness without objective support would weaken assurance and could produce misleading compliance reporting.<\/span><\/p>\n

                                Question 396.<\/b><\/p>\n

                                Why should control owners and independent control testers be different when practical?<\/b><\/p>\n

                                  \n
                                1. <\/b> To eliminate the need for controls<\/span>
                                  \n<\/span>2.<\/b> To ensure every assessment passes<\/span>
                                  \n<\/span>3.<\/b> To avoid collecting evidence<\/span>
                                  \n<\/span>4.<\/b> To improve objectivity in evaluating control effectiveness**<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 4. To improve objectivity in evaluating control effectiveness<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  Separating control operation from independent testing can reduce conflicts of interest and strengthen assurance. The control owner remains accountable for operating and maintaining the control, while the tester evaluates its design, operation, and supporting evidence. Independence does not guarantee a passing result, but it can improve confidence that the assessment reflects actual control performance rather than the owner\u2019s unsupported judgment.<\/span><\/p>\n

                                  Question 397.<\/b><\/p>\n

                                  A risk treatment plan includes several actions. Why should each action have a clear owner and due date?<\/b><\/p>\n

                                    \n
                                  1. <\/b> To make treatment execution measurable and accountable<\/span>
                                    \n<\/span>2.<\/b> To automatically remove the risk from the register<\/span>
                                    \n<\/span>3.<\/b> To eliminate the need for residual risk assessment<\/span>
                                    \n<\/span>4.<\/b> To replace all controls<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. To make treatment execution measurable and accountable<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    Owners and due dates convert treatment decisions into trackable work. Ownership establishes responsibility, while deadlines make progress measurable and support escalation when actions become overdue. Treatment actions may involve implementing controls, modifying processes, transferring exposure, or completing other mitigation work. The related risk should remain monitored until treatment is complete and the resulting residual exposure is understood.<\/span><\/p>\n

                                    Question 398.<\/b><\/p>\n

                                    An organization wants to apply the same compliance requirement across several subsidiaries while preserving local differences. What approach is most useful?<\/b><\/p>\n

                                      \n
                                    1. <\/b> Remove all entity information<\/span>
                                      \n<\/span>2.<\/b> Use entity-based scoping for assessments and controls<\/span>
                                      \n<\/span>3.<\/b> Create unrelated frameworks for every subsidiary<\/span>
                                      \n<\/span>4.<\/b> Eliminate all shared controls<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2. Use entity-based scoping for assessments and controls<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      Entity-based scoping allows common requirements to be evaluated in the context of each subsidiary, application, process, or business area. This makes it possible to identify localized control weaknesses while still maintaining enterprise consistency. Shared controls can be reused where appropriate, and entity-specific evidence can show how performance differs across the organization. Removing entity context would make reporting less meaningful.<\/span><\/p>\n

                                      Question 399.<\/b><\/p>\n

                                      A risk register contains several risks whose owners have left the organization. What should management do?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Leave the ownership fields unchanged for historical consistency<\/span>
                                        \n<\/span>2.<\/b> Delete the affected risks<\/span>
                                        \n<\/span>3.<\/b> Assign appropriate current owners and review the risks for accuracy<\/span>
                                        \n<\/span>4.<\/b> Automatically accept the risks<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3. Assign appropriate current owners and review the risks for accuracy<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        Risk ownership should reflect current accountability. When owners leave or change roles, affected risks should be reassigned to appropriate stakeholders and reviewed to ensure ratings, controls, treatments, and status remain accurate. Leaving obsolete ownership in place can weaken governance and delay action. Reassignment does not require deleting or accepting the risk; it ensures that someone remains accountable for monitoring and managing it.<\/span><\/p>\n

                                        Question 400.<\/b><\/p>\n

                                        What is the strongest foundation for a scalable ServiceNow Risk and Compliance implementation?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Extensive customization before defining requirements<\/span>
                                          \n<\/span>2.<\/b> Separate spreadsheets for each business unit<\/span>
                                          \n<\/span>3.<\/b> Automatic closure of all overdue items<\/span>
                                          \n<\/span>4.<\/b> Clear governance, consistent methodologies, defined ownership, reliable data, and connected records**<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 4. Clear governance, consistent methodologies, defined ownership, reliable data, and connected records<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          A scalable Risk and Compliance implementation depends on more than technology. Organizations need clear governance, consistent risk and control methodologies, defined accountability, strong data standards, and reliable relationships among entities, risks, controls, policies, requirements, assessments, evidence, and issues. Automation and reporting become much more effective when these foundations are established first. Excessive customization or fragmented spreadsheets usually make long-term governance and scalability more difficult.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full ServiceNow CIS-RC Exam Dumps and Practice Test Dumps   Question 381. An organization wants to define a measurable warning point for a key risk indicator. What should it configure conceptually? A threshold 2. A policy exception 3. A control objective 4. A remediation task Correct Answer: 1. A threshold Explanation: A threshold defines […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18894"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=18894"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18894\/revisions"}],"predecessor-version":[{"id":18895,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/18894\/revisions\/18895"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=18894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=18894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=18894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}