CIS-RC ServiceNow Certified Implementation Specialist – Risk and Compliance exam badge

ServiceNow

ServiceNow Certified Implementation Specialist – Risk and Compliance (CIS-RC) practice questions

★★★★★★ 4.2 171 reviews — aggregated from community votes by visitors who practiced this bank

Questions
160
Exam length
130 min
Updated
  • Instant feedback per question
  • Explanation for every option
  • Free, no signup
Start free practice exam

Exam overview CIS-RC

Built for risk and compliance managers, GRC leads, and IRM implementers, the ServiceNow Certified Implementation Specialist – Risk and Compliance (CIS-RC) credential certifies your ability to implement and operate the Integrated Risk Management (IRM) application on the Now Platform. Scheduled and delivered through ServiceNow University via Pearson VUE (registration executed inside Now Learning via SSO), the exam voucher costs $450 USD with no publicly disclosed passing score, 45 scored questions in 130 minutes, and no partial credit on multiple-select items.

Before purchasing the voucher, candidates must complete the GRC: Integrated Risk Management (IRM) Fundamentals course and the GRC: Integrated Risk Management (IRM) Implementation course on Now Learning — finishing the Implementation course explicitly unlocks the voucher acquisition field in your portal. ServiceNow also recommends holding the CSA credential, completing the baseline Welcome to ServiceNow and Platform Implementation courses, and having at least six months of hands-on GRC/IRM deployment experience across a minimum of two full implementation lifecycles.

The CIS-RC blueprint is organized into seven weighted domains, with the heaviest emphasis on Policy and Compliance (25%) and Risk and Advanced Risk (25%), which together account for half the exam score. The remaining weight splits across Entity Framework (20%), GRC Overview (12%), Common Elements and Extended Capabilities (8%), Implementation Planning (5%), and Audit and Advanced Audit (5%). Because the exam uses multiple-select items with no partial credit, scenario questions on the Compliance Hierarchy (Authority Documents → Citations → Policies → Control Objectives), Advanced Risk Assessment (ARA) with Risk Assessment Methodologies (RAM), and Inherent, Residual, and Calculated Risk computations are heavily tested.

For candidates preparing for the CIS-RC exam, our practice materials cover all seven weighted domains in the same proportions as the real test, with online practice questions, detailed answer explanations, and a downloadable PDF that mirrors the single-select and multiple-select format you will see on exam day.

Official Exam Domains & Weighting

To successfully pass the CIS-RC exam, candidates must master the following core domains:

  • Domain 1: GRC Overview (12%)

Covers GRC positioning, scope, architectural mapping, and business frameworks, plus the relationships between Scoped Applications (Profiles, Risk, Compliance) and the Global tier.

  • Domain 2: Implementation Planning (5%)

Tests use cases, architectural baseline scoping, implementation team sizing, and platform Personas, Groups, and granular Security Roles such as Admin, Manager, and User.

  • Domain 3: Entity Framework (20%)

Validates Entity Scoping Strategies including the difference between Entity Types and Entity Classes, Entity Generation Engines, Filter Conditions, and Entity structural lifecycles.

  • Domain 4: Policy and Compliance (25%)

Focuses on the Compliance Hierarchy with rigid linkages between Authority Documents, Citations, Policies, and Control Objectives, the Control Lifecycle States (Draft, Attest, Review, Monitor), Attestation configuration, and Compliance Supporting Workflows including Evidence Collection automation, Attestation templates, and Policy Acknowledgment tracking.

  • Domain 5: Risk and Advanced Risk (25%)

Covers Risk Statement mapping to active Operational Risks, Advanced Risk Assessment (ARA) with Risk Assessment Methodologies (RAM), Assessment Factors (Manual vs. Automated), and scoring matrices, Risk Calculation engines handling Inherent, Residual, and Calculated Risk, and Risk Response mechanisms such as Accept, Mitigate, Transfer, and Avoid.

  • Domain 6: Common Elements & Extended Capabilities (8%)

Tests continuous monitoring via GRC Indicators, the Issues Management Engine with Issue tracking, lifecycle statuses, Remediation Tasks, and Exception rules, plus Regulatory Change Management (RCM) workflows and native Content Packs.

  • Domain 7: Audit and Advanced Audit (5%)

Validates the Audit Lifecycle Management with Audit Plans, Audit Engagements, Audit Tasks, and Workpapers, plus Evidence Management frameworks for seamless control validation with auditors.

Domain coverage 7 domains

  • GRC Overview (12%)
  • Implementation Planning (5%)
  • Entity Framework (20%)
  • Policy and Compliance (25%)
  • Risk and Advanced Risk (25%)
  • Common Elements & Extended Capabilities (8%)
  • Audit and Advanced Audit (5%)

Sample questions 16 of 160 shown

  1. Q1
    Which filter navigation syntax displays the table in list view within a separate browser tab?
    1. Tablename_LIST
    2. Tablename.list
    3. Tablename.LIST
    4. Tablename.List
    The correct answer is C. Tablename.LIST is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  2. Q2
    Which GRC tables serve as primary parent tables for the GRC applications? (Choose three.)
    1. Content
    2. Item
    3. Asset
    4. Task
    5. Document
    The correct answer is ABE. Content and Item and Document are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  3. Q3
    Annualized Loss Expectancy is a feature of which risk score method?
    1. Residual
    2. Quantitative
    3. Qualitative
    4. Inherent
    The correct answer is B. Quantitative is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  4. Q4
    What are some of the features of scoped applications for GRC? (Choose three.)
    1. Requires an entitlement for all environments
    2. All components have a namespace prefix for identification
    3. Provides access to all global data
    4. Ability to view all components from the sys_metadata table
    5. Ability to restrict access to available data
    The correct answer is ABE. these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  5. Q5
    Which of the following tables exist within the GRC: Profiles application scope? (Choose three.)
    1. sn_grc_profile_type
    2. sn_grc_indicator
    3. sn_grc_compliance_policy_statement
    4. sn_grc_risk_definition
    5. sn_grc_profile_class
    The correct answer is ABE. sn_grc_profile_type and sn_grc_indicator and sn_grc_profile_class are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  6. Q6
    An external audit team needs to view all of your published policies and controls? Which role can you give the team members?
    1. sn_audit_manager
    2. sn_compliance_user
    3. sn_audit.external_auditor
    4. sn_risk_user
    The correct answer is C. sn_audit.external_auditor is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  7. Q7
    Which feature of classic risk scoring is frequently configured by customers?
    1. Annualized Loss Expectancy
    2. Risk Criteria Matrix
    3. Control Failure Factor
    4. Indicator Failure Factor
    The correct answer is B. Risk Criteria Matrix is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  8. Q8
    Which of the following are scoped applications related to the Risk and Compliance applications? (Choose four.)
    1. GRC: GRC Profiles
    2. GRC: Attestation Design
    3. GRC: UCF Compliance
    4. GRC: Policy and Compliance
    5. GRC: Performance Analytics
    6. GRC: Risk Management
    The correct answer is ACDF. GRC: GRC Profiles and GRC: UCF Compliance and GRC: Policy and Compliance and GRC: Risk Management are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  9. Q9
    The Single Loss Expectancy is $1.000.000 and the Annual Rate of Occurrence is 20%. What is the Annualized Loss Expectancy?
    1. $1,000,000
    2. $200,000
    3. $2,000,000
    4. $10,000
    The correct answer is B. $200,000 is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  10. Q10
    What are key prerequisites for a control test task to be generated?
    1. Engagement is Scope
    2. Risks have associated assessments
    3. Entity being scoped has associated controls with test plans
    4. Controls have a set frequency
    5. Entity being scoped has associated risks
    The correct answer is C. Entity being scoped has associated controls with test plans is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  11. Q11
    Who should be directly involved in GRC implementations? (Choose three.)
    1. Board of directors
    2. Chief Executive
    3. ServiceNow platform experts
    4. HR analysts
    5. Risk and compliance experts
    6. CMDB process owner
    The correct answer is CEF. ServiceNow platform experts and Risk and compliance experts and CMDB process owner are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  12. Q12
    Which Script include can be modified to change how the compliance scores roll up?
    1. ScoreRollUp
    2. ComplianceUtils
    3. ComplianceScoreCalculator
    4. AssessmentStrategy
    The correct answer is C. ComplianceScoreCalculator is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  13. Q13
    What is the minimum role required to approve a Policy?
    1. sn_grc admin
    2. sn_compliance manager
    3. sn_compliance user
    4. sn_grc user
    The correct answer is C. sn_compliance user is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  14. Q14
    Which roles can move the control to the ‘Monitor’ state manually? (Choose two.)
    1. Compliance Reader
    2. Risk User
    3. Audit User
    4. System Administrator
    5. Compliance Manager
    The correct answer is DE. System Administrator and Compliance Manager are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  15. Q15
    All of the following are tables which exist within the GRC Profiles application scope EXCEPT:
    1. sn_grc_profile
    2. sn_grc_item
    3. sn_grc_profile_type
    4. sn_grc_risk
    The correct answer is D. sn_grc_risk is correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.
  16. Q16
    Which of the following tables are included in the GRC: Policy and Compliance Management scoped application? (Choose three.)
    1. sn_compliance_risk
    2. sn_compliance_policy
    3. sn_grc_item
    4. sn_compliance_policy_statement
    5. sn_grc_m2m_audience_user
    6. sn_grc_entity_type G. sn_compliance_citation
    The correct answer is BDG. sn_compliance_policy and sn_compliance_policy_statement are correct because these concepts relate to GRC positioning, terminology, and technical overview of the GRC framework.

Answer all 160 questions with instant feedback →

Reader reviews 171 ratings

4.2 ★★★★★★ Based on 171 ratings

  • Honestly, I wouldn’t have passed CIS-RC without these. The explanations actually teach you instead of just giving the answer.

    ★★★★★★ Jordan P.

  • Between the CIS-RC practice questions and some hands-on labs, I felt fully prepared walking into the exam center.

    ★★★★★★ Caleb B.

  • The question explanations for CIS-RC really dig into the AWS (or relevant) concepts. Helped me understand things at a deeper level.

    ★★★★★★ Hazel C.

  • I liked how the CIS-RC questions are tied to specific domains from the official exam guide. Made studying much more structured.

    ★★★★★★ Joseph L.

  • CIS-RC was harder than I expected but these questions prepared me well. The multi-select ones in particular were really close to the exam.

    ★★★★★★ Chloe D.

  • My colleague recommended this for CIS-RC and I’m glad I listened. Passed on my first go after two weeks of solid study.

    ★★★★★ Logan T.

Log in to rate this exam and leave a review.

Frequently asked questions

What happens if I pass the exam? Do I get a detailed scorecard?

No. If you Pass, your final terminal UI will simply read Pass with zero supplementary score strings or section breakdowns. ServiceNow treats a passing attempt as a binary verification of competence. However, if you Fail, you will receive a diagnostic breakdown displaying your exact percentage performance across all 7 blueprint domains to guide your remediation study plan.

What is the "Conditional Result" policy following the Pearson VUE transition?

All immediate results delivered on-screen at test submission are preliminary and flagged as conditional. ServiceNow's security and credentialing team subjects all testing logs to a background audit check, flagging biometric discrepancies, sudden disconnects, or anomalous progression times. Your formal credential and Credly badge sync to your account within 24 to 48 hours once verified.

How do I handle certification maintenance? Is there an annual fee?

You do not need to sit for the full 45-question proctored exam ever again, provided you complete your Delta Exam cycles. Every time ServiceNow releases a major platform update, a micro, non-proctored, open-book Delta test of 5-10 questions appears inside Now Learning. Failing to pass these within the designated multi-month window will cause your mainline certification to expire immediately.

How heavily does the exam test Advanced Risk Assessment (ARA) relative to Classic Risk?

Vastly. With modern releases, ServiceNow has made Advanced Risk Assessment (ARA) the cornerstone of the Risk domain. You must thoroughly study the laboratory configurations for RAMs (Risk Assessment Methodologies), assessment factors (Manual vs. Automated), and calculation equations for Inherent, Residual, and Calculated Risk. Shallow conceptual knowledge will result in failing this domain — the exam presents scenario questions that require you to trace the full scoring matrix from a RAM through to the risk response decision.

How do the practice ARA scenarios compare to real CIS-RC RAM scoring matrix questions?

The mock exam scenarios target the same ARA mechanics the real exam tests — RAM configuration, assessment factor selection (Manual vs. Automated), the Inherent/Residual/Calculated Risk computation chain, and the Accept/Mitigate/Transfer/Avoid response linkage. Each scenario presents a risk assessment setup, asks which calculation outcome applies, and walks through the full scoring matrix step by step in the answer explanation.

When should I use the PDF download to review the Compliance Hierarchy offline?

The PDF download is most useful when you want to trace the Compliance Hierarchy offline — Authority Documents linking to Citations, Citations to Policies, Policies to Control Objectives, through the Control Lifecycle States (Draft, Attest, Review, Monitor). The mock exam scenarios cover the same hierarchy linkages in interactive format for timed practice, while the PDF lets you study the rigid four-layer structure on paper during commutes or in environments without stable internet.

What prerequisites do I need to meet before registering for the CIS-RC exam?

You must complete the GRC: Integrated Risk Management (IRM) Fundamentals and the GRC: Integrated Risk Management (IRM) Implementation courses on Now Learning — the Implementation course is what unlocks the voucher acquisition field. ServiceNow also recommends holding the CSA credential, completing the baseline Welcome to ServiceNow, ServiceNow Platform Implementation, and Now Create Methodologies courses, and having at least six months of hands-on GRC/IRM deployment experience across a minimum of two full implementation lifecycles.