ServiceNow Certified Implementation Specialist – Security Incident Response — Question 49
This type of integration workflow helps retrieve a list of active network connections from a host or endpoint, so it can be used to enrich incidents during investigation.
Answer options
- A. Security Incident Response – Get Running Services
- B. Security Incident Response – Get Network Statistics
- C. Security Operations Integration – Sightings Search
- D. Security Operations Integration – Block Request
Correct answer: B
Explanation
The correct answer is B because it specifically focuses on retrieving network statistics, which includes active connections. Option A relates to running services, which does not provide network connection data, while options C and D pertain to sightings and blocking requests, respectively, neither of which deal with network connections.