Free CIS-VRM Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The ServiceNow Vendor Portal is designed to streamline the assessment process for vendors. When a Vendor Risk Assessment is initiated, all its components, such as questionnaires (e.g., SIG Lite) and document requests, are bundled together into a single, consolidated assessment record. The vendor's primary contact receives a notification and sees only one overarching assessment request in their portal. Upon opening this single request, they can then access and complete all the individual tasks contained within it, including the questionnaire and the two document requests. This approach simplifies the vendor's experience by presenting all related items for a specific assessment in one place.

A. 2: This is incorrect because it arbitrarily counts only the document requests and ignores the questionnaire, failing to recognize the consolidated nature of the assessment.

B. 3: This is incorrect because the portal does not display each component (one questionnaire and two document requests) as a separate, top-level request for the vendor.

C. 0: This is incorrect as the assessment must be presented to the vendor in the portal for them to take action and complete the required tasks.

1. ServiceNow Product Documentation - Vendor Assessment Portal: "When a vendor risk assessment is sent to a vendor, the primary contact for that vendor receives an email notification. The primary contact can then log in to the vendor portal to view and complete the assessment." This indicates a single "assessment" object is presented.

Source: ServiceNow Product Documentation, Washington DC Release, Vendor Risk Management, "Vendor assessment portal".

2. ServiceNow Product Documentation - Complete an assessment in the vendor portal: "When you open an assessment, you can see all the questionnaires and document requests that are part of the assessment." This explicitly states that questionnaires and document requests are viewed within the single assessment record, not as separate requests.

Source: ServiceNow Product Documentation, Washington DC Release, Vendor Risk Management, "Complete an assessment in the vendor portal", Step 3.

3. ServiceNow Now Learning - Vendor Risk Management (VRM) Fundamentals: The course material illustrates the end-to-end assessment process. It demonstrates that the vendor interacts with a single "Assessment" record in their portal, which acts as a container for all assigned questionnaires and document requests for that specific evaluation.

Source: ServiceNow Now Learning, "Vendor Risk Management (VRM) Fundamentals" On-Demand Course, Module: "The Vendor Assessment Process".

The ServiceNow Vendor Portal is a secure, external-facing interface designed for vendor contacts to interact with the assessing organization's Vendor Risk Management (VRM) program. Its primary functions enable vendors to:

Respond to and complete assigned risk assessments and questionnaires (F).

Update answers if an assessor returns a questionnaire for clarification (A).

Review and respond to issues or remediation tasks that the assessing organization has created based on assessment findings (D).

The primary vendor contact can also perform administrative duties, such as adding other contacts from their company and delegating specific tasks or questionnaires to them (E).

B. Communicate or share information with other vendors of the assessing organization: The portal is designed for confidential, one-to-one communication between a single vendor and the assessing organization, not for inter-vendor communication.

C. Create new issues and tasks for the vendor risk assessor team: The workflow dictates that assessors create issues for vendors to resolve. Vendors respond to these issues; they do not create new ones for the assessor team.

1. ServiceNow Product Documentation - Vendor portal for vendor contacts: This document explicitly lists the capabilities of a vendor contact. It states, "As a vendor contact, you can use the vendor portal to... Complete assigned questionnaires, document requests, and tasks... Respond to issues that were generated from your answers... Add and maintain your company's contacts... Delegate questionnaires and tasks to other contacts in your company." This directly supports options A, D, E, and F.

2. ServiceNow Product Documentation - Vendor risk assessment process: The documentation on the assessment lifecycle describes the states of an assessment, including "Returned," where the vendor must update their responses. This confirms option A. It also details the issue management process where assessors create issues and vendors respond, confirming option D and showing why C is incorrect.

In the ServiceNow Vendor Risk Management assessment lifecycle, the "Generating Observations" stage is specifically designed for the creation of issues. After the vendor submits their responses (Responses Received state), the vendor risk assessor reviews the answers. During this review, any non-compliant or unsatisfactory responses are flagged, leading to the manual or automatic creation of Vendor Risk Issues. These issues document the identified risks and serve as the basis for remediation tasks. This stage is the pivotal point where raw assessment data is translated into actionable risk items.

A. Responses Received: This state indicates that the vendor has completed and submitted the assessment. It is the prerequisite for generating issues, but not the stage where they are created.

C. Submitted to Vendor: At this point, the assessment has been sent to the vendor, but no responses have been provided yet. Therefore, there is no information from which to create issues.

D. Finalizing with Vendor: This is a later stage in the process that occurs after issues have already been identified, reviewed, and potentially remediated. It involves closing out the assessment.

1. ServiceNow Product Documentation - Process a vendor risk assessment: The official documentation outlines the assessment workflow states. It explicitly describes the "Generating Observations" state: "In the Generating Observations state, the vendor risk assessor reviews the vendor's responses and creates issues." This confirms that issue creation is the primary purpose of this stage. (ServiceNow Product Documentation, Vendor Risk Management, "Process a vendor risk assessment," Washington D.C. release).

2. ServiceNow Product Documentation - Create an issue from a vendor risk assessment: This document details the procedure for issue creation, which happens after the assessment is in the "Responses Received" state and moves to "Generating Observations" for the assessor's review and action. (ServiceNow Product Documentation, Vendor Risk Management, "Create an issue from a vendor risk assessment," Washington D.C. release).

Within the ServiceNow Vendor Portal, the designated Primary Contact for a vendor has the specific permission to manage assessments assigned to their company. This includes the ability to reassign or delegate a questionnaire or document request to another registered contact within their organization. This functionality ensures that the appropriate subject matter expert at the vendor company can complete the assessment, even if it was not initially sent to them.

A. Vendor Business Owner: This is an internal role responsible for the business relationship; they operate within the ServiceNow platform, not the external Vendor Portal.

B. Vendor: This term refers to the company as a whole, not a specific user with permissions to perform actions within the portal.

D. Vendor Manager: This is an internal user (snvdrriskasmt.vendormanager) who manages the risk assessment process from within the ServiceNow platform, not the Vendor Portal.

1. ServiceNow Product Documentation - Vendor Risk Management: On the "Delegate a questionnaire or document request" page, it explicitly states, "As a primary vendor contact, you can delegate a questionnaire or a document request to another contact in your company." This confirms the primary contact's unique capability within the portal. (ServiceNow Product Documentation, Vendor Risk Management, "Delegate a questionnaire or document request," Quebec release and later).

2. ServiceNow Product Documentation - Vendor Risk Management: The "Vendor portal for vendor contacts" section describes the user experience. It details how vendor contacts interact with assessments and highlights that primary contacts have additional management capabilities, such as delegation, which are not available to standard vendor contacts. (ServiceNow Product Documentation, Vendor Risk Management, "Vendor portal for vendor contacts," Rome release and later).

The Vendor Portal is the dedicated, secure, external-facing interface within the ServiceNow Vendor Risk Management application. It is specifically designed for vendors to interact with the organization. Through this portal, vendors can update their profiles, complete assessments, and directly manage and respond to issues, requests, and other assigned tasks. This centralizes communication and provides a structured workflow, replacing inefficient methods like email or spreadsheets. It allows vendors to perform their required actions without granting them access to the full ServiceNow backend platform.

A. Spreadsheets: This is an offline, manual method that the ServiceNow VRM application is designed to replace to ensure process efficiency, data integrity, and auditability.

C. ServiceNow Platform: This is too general. Vendors do not typically access the full backend platform UI; they use the specific, limited-access Vendor Portal built upon the platform.

D. Email: While email is used for notifications, it is not the system of record or the interface for managing and fulfilling tasks in a structured and auditable manner.

1. ServiceNow Product Documentation - Vendor Portal: "The vendor portal is the primary interface for your vendors. Your vendors use the portal to respond to assessments, and manage their company's information, including contacts, and issues."

Source: ServiceNow. (2024). Vendor Portal. ServiceNow Product Documentation. Retrieved from the official ServiceNow documentation site for the Washington DC release.

2. ServiceNow Product Documentation - Vendor Risk Management: "The Vendor Risk Management application provides a centralized process to manage your vendor portfolio, and complete the vendor risk assessment and remediation life cycle. [...] Vendors access the vendor assessment portal to complete assessments, and respond to issues."

Source: ServiceNow. (2024). Vendor Risk Management. ServiceNow Product Documentation. Retrieved from the official ServiceNow documentation site for the Washington DC release.

The GRC: Vendor Risk Management plugin (technical name: com.snvdrriskasmt) is the core application that installs all foundational components for the Vendor Risk Management process. This includes the necessary data structures (tables), user roles, business rules, and baseline email notifications. These notifications are pre-configured to automate communications for key process steps, such as sending assessment reminders to vendors, notifying risk assessors of completed questionnaires, and alerting stakeholders about newly identified issues.

B. GRC: Audit Management: This plugin installs functionality for audit engagements and tracking audit-related tasks, which is separate from the vendor risk lifecycle.

C. GRC: Risk Management: This plugin is for managing enterprise-level risks and risk assessments, not the specific notifications related to third-party vendors.

D. GRC: Policy and Compliance Management: This plugin focuses on the lifecycle of internal policies, standards, and controls, and their compliance status.

1. ServiceNow Product Documentation (Washington DC): Components installed with Vendor Risk Management. This official document explicitly lists "Email notifications" as a component installed with the GRC: Vendor Risk Management application. It states, "Several types of components are installed with the activation of the GRC: Vendor Risk Management plugin." The list that follows includes "Email notifications."

2. ServiceNow Product Documentation (Washington DC): Install Vendor Risk Management. This page identifies the specific plugin required to activate the application: "The GRC: Vendor Risk Management (com.snvdrriskasmt) plugin is available as a separate subscription." This confirms that the functionality, including notifications, is contained within this specific plugin.

Data cleansing for vendor imports in ServiceNow involves standardizing, correcting, and transforming data to ensure quality and consistency.

Data Import or Data Source Transform (Transform Maps): This is the primary mechanism used during an import. Transform Scripts within a Transform Map allow for on-the-fly data manipulation, cleansing, and logic application as data moves from a staging table to the target vendor table.

Field Normalization Rules: This feature is specifically designed to standardize inconsistent data values. It automatically maps different variations of a term (e.g., "Dell Inc.", "Dell Computer") to a single, normalized value ("Dell"), which is a core data cleansing activity.

Fix Scripts: These are server-side scripts executed to make data corrections after an import or system change. They are ideal for bulk updates or complex data cleansing tasks that are not handled during the initial transformation.

A. Data Policies: Data Policies enforce data integrity (e.g., making fields mandatory) on the server side but do not transform or cleanse the actual data values during an import.

B. Access Control Lists: ACLs are a security mechanism that controls user access (read, write, create, delete) to data; they have no function in data cleansing.

F. UI Policies: UI Policies control the behavior of fields on a form within the user interface and do not apply to backend data imports.

1. Data Import or Data Source Transform (Transform Maps):

ServiceNow Product Documentation, "Transform maps". It states, "A transform map is a set of field maps that determine the relationships between fields in an import set and fields in an existing ServiceNow table... You can use scripts to control the transformation behavior."

2. Field Normalization Rules:

ServiceNow Product Documentation, "Field normalization". It explains, "Field normalization is a process of standardizing the values in a field... It works by defining a set of rules that are applied to the values in a field."

3. Fix Scripts:

ServiceNow Product Documentation, "Create a fix script". It describes their purpose: "Fix scripts are server-side JavaScript code that you run after an application is installed or upgraded... Use fix scripts to make changes that are necessary for the data integrity or stability of the application."

ServiceNow Vendor Risk Management (VRM) provides out-of-the-box (OOTB) integrations with leading third-party security rating services to automate the continuous monitoring of vendor security postures. Bitsight and Security Scorecard are two prominent solutions available directly from the ServiceNow Store for this purpose. These integrations pull security scores, ratings, and detailed findings into the vendor profile within ServiceNow. This data helps organizations to automatically trigger risk assessments, generate issues, and maintain an up-to-date view of their third-party risk landscape without manual intervention.

A. MyScoreMetrics: This is not a standard, out-of-the-box integration offered by ServiceNow for third-party security evaluation within the VRM application.

B. Vendor Insights: This is a generic term, not the name of a specific third-party security evaluation solution that integrates OOTB with ServiceNow VRM.

1. ServiceNow Product Documentation - Integrations with Vendor Risk Management: The official documentation lists available integrations for VRM. It explicitly mentions "Bitsight for VRM" and "SecurityScorecard for VRM" as key integrations for security scoring.

Reference: ServiceNow Product Documentation, Tokyo Release, "Integrations with Vendor Risk Management," Section: Security and risk intelligence integrations.

2. ServiceNow Product Documentation - SecurityScorecard for VRM integration: This document details the OOTB integration that "provides SecurityScorecard scores and data points for your vendors."

Reference: ServiceNow Product Documentation, Tokyo Release, "SecurityScorecard for VRM integration," Chapter 1: Overview.

3. ServiceNow Product Documentation - Bitsight for VRM integration: This document describes the OOTB integration that "provides Bitsight scores and data points for your vendors."

Reference: ServiceNow Product Documentation, Tokyo Release, "Bitsight for VRM integration," Chapter 1: Overview.

In the ServiceNow Vendor Risk Management (VRM) application, issues and tasks are generated based on findings during an assessment. When an assessor reviews a vendor's responses to a questionnaire or submitted documents, they can create an issue directly from a specific question or control that is deemed unsatisfactory. This action logically groups the issue with the parent Assessment record. The assessment provides the necessary context for the issue, linking it to the specific evaluation activity that identified the risk. While the issue is related to the vendor, its direct organizational and contextual grouping is the assessment itself.

A. Vendor: While the issue is for a specific vendor, it is contextually grouped under the assessment that identified it, not just the top-level vendor record.

B. All vendors: This is incorrect as issues are specific to a single vendor's assessment and are not aggregated across all vendors in a single group.

D. Remediation plan: A remediation plan is created to address existing issues. The issue precedes the plan and is an input to it, not grouped by it.

1. ServiceNow Product Documentation - Create a vendor risk issue from an assessment: "Vendor risk issues are typically created by vendor risk assessors during the assessment review and approval process. As an assessor, you can create issues for any questions that have been answered unsatisfactorily." This process is performed within the Vendor Risk Assessment record. (ServiceNow Documentation, Vendor Risk Management, "Assess vendor risk" section).

2. ServiceNow Product Documentation - Review and approve a vendor risk assessment: The documented workflow shows that from the "Vendor Risk Assessment" page, an assessor can "Create Issue" for a specific question. This confirms the issue is a child record of the assessment. (ServiceNow Documentation, Vendor Risk Management, "Review and approve a vendor risk assessment" procedure).

The primary objective of ServiceNow Vendor Risk Management (VRM) is to provide a systematic process to assess and manage the risks associated with vendors and third parties (B). This involves identifying potential risks, evaluating them through assessments, and implementing controls. A crucial part of this lifecycle is the remediation process, where identified issues are addressed. This collaborative process inherently helps vendors identify and correct weaknesses, thereby improving their overall security posture and preparedness (A), which in turn reduces the risk to the organization.

C. To help negotiate the best possible price for a product or service from the vendor: This is a function of procurement or strategic sourcing, not a primary objective of the risk management process.

D. To verify that vendors have adequate measures and processes in place to ensure profitability of vendor: VRM assesses a vendor's financial stability as a risk factor to the organization, but its purpose is not to ensure the vendor's profitability for the vendor's benefit.

1. ServiceNow Product Documentation - Vendor Risk Management overview: The official documentation states that the VRM application provides a "centralized process for managing your vendor portfolio, and for completing the vendor assessment and remediation life cycle." This directly supports assessing risk (B) and the remediation process that improves vendor posture (A).

2. ServiceNow Product Documentation - Vendor risk remediation: This section details the process of creating and managing issues for vendors to resolve. It states, "After a vendor risk assessment is completed and submitted, you can review the results, and generate issues for any risks that require remediation." This workflow is designed to help vendors improve their controls, aligning with option A.

3. ServiceNow eBook - The Definitive Guide to Third-Party Risk Management: This guide outlines the goals of a modern TPRM program, including the need to "Continuously monitor third parties for risk" and manage the entire lifecycle from onboarding to offboarding, which encompasses both assessment (B) and remediation (A). (Reference: Page 4, "Key Goals of a Modern TPRM Program").

The vendor tiering process in ServiceNow Vendor Risk Management is designed to update the vendor's record only after the assessment is fully completed and finalized. The workflow dictates that when a tiering assessment record's state transitions to 'Closed', a business rule is triggered. This rule takes the calculated tiering value from the completed assessment and automatically populates it into the 'Tier' field on the corresponding vendor record. This ensures that the tier displayed on the vendor profile is always based on a finalized and approved assessment, not a draft or in-progress evaluation.

B. When the Tiering Assessment record state is Tiering Assessment: This state indicates the assessment is actively being worked on by the respondent. The final score and tier have not yet been determined, so the vendor record is not updated.

C. When all tiering assessments have been completed: The vendor tier is updated upon the closure of a single, specific tiering assessment. The system does not wait for multiple or "all" assessments to be completed.

1. ServiceNow Product Documentation - Vendor Risk Management: In the "Perform a vendor tiering assessment" section, the process is explicitly described. It states, "When the tiering assessment is in the Closed state, the Tier field on the vendor form is automatically populated with the tiering value from the assessment."

Source: ServiceNow Product Documentation, "Perform a vendor tiering assessment," Washington DC Release. (This behavior is consistent across recent releases like Utah and Vancouver).

The Template Designer in ServiceNow Vendor Risk Management is a graphical tool used to create and manage reusable templates. Its primary functions are to build Questionnaire Templates, which contain a series of questions for vendors, and Document Request Templates, which define the specific documents that must be collected from vendors. These templates standardize the data and evidence collection process during a vendor risk assessment, ensuring consistency and efficiency. They serve as the foundational building blocks for the assessment process.

B. Assessment Template: This is not a standard object created by the Template Designer. The designer creates the components (questionnaires, document requests) that are used within an assessment, not the assessment template itself.

C. Vendor Risk Assessment: A Vendor Risk Assessment is a specific, transactional record generated for a particular vendor. It is an instance of the assessment process, not a reusable template created in the designer.

1. ServiceNow Product Documentation - Create a VRM questionnaire template: "You can create questionnaire templates using the template designer. These templates can be used in vendor risk assessments to gather information from vendors." (ServiceNow Product Documentation for Vendor Risk Management, Vancouver release).

2. ServiceNow Product Documentation - Create a document request template: "You can create document request templates using the template designer. These templates can be used in vendor risk assessments to request specific documents from vendors." (ServiceNow Product Documentation for Vendor Risk Management, Vancouver release).

3. ServiceNow Now Learning - Vendor Risk Management (VRM) Fundamentals On Demand Course: Module: "Assessments," Section: "Questionnaires and Document Requests." This section details how the Template Designer is the tool for creating both Questionnaire Templates and Document Request Templates.

To evaluate a vendor on a recurring basis, a record must be configured in the Repeating Assessments table (asmtrepeatingassessment). This configuration defines the schedule (e.g., annually, quarterly), the assessment to be used (defined by an Assessment Metric Type), and the vendor(s) to be assessed. When the scheduled time arrives, the system automatically generates and assigns the assessment to the appropriate stakeholders. This process ensures consistent, automated, and periodic re-evaluation of vendor risk over time, which is a fundamental requirement for ongoing vendor management.

A. Repeating Surveys: While functionally similar, "Assessments" is the specific terminology and framework used within the ServiceNow GRC and Vendor Risk Management applications for formal evaluations.

B. Assessment Metric: This represents a single question or a specific item to be evaluated within an assessment, not the mechanism for scheduling the entire assessment to repeat.

D. Assessment Metric Type: This is a template that groups a set of related Assessment Metrics. It defines the "what" to assess, but not the "when" or the recurring schedule.

1. ServiceNow Product Documentation - Schedule a vendor risk assessment: "You can schedule vendor risk assessments to run automatically. For example, you can schedule an assessment to run on a quarterly or yearly basis... Navigate to All > Vendor Risk > Assessments > All Repeating Assessments and click New." This directly confirms that "Repeating Assessments" is the correct feature and table to configure for recurring evaluations.

2. ServiceNow Product Documentation - Assessment metric types: "Assessment metric types are templates that define a set of assessment metrics (questions)." This reference clarifies that a Metric Type is a template, not a schedule.

3. ServiceNow Product Documentation - Vendor risk assessments: "The Vendor Risk Assessment application enables you to create a set of questions in questionnaires to send to vendors to gather information and determine a risk score for that vendor." This provides the context that assessments, not surveys, are the primary tool in VRM.

The Vendor Risk Assessor role (snvdrriskasmt.vendorassessor) is focused on the execution and review of vendor risk assessments. A primary function is to access and analyze the completed assessments submitted by vendors to evaluate their risk posture. If the assessor identifies any risks, control deficiencies, or non-compliant answers during their review, they are responsible for creating issues to track these findings through remediation. While a Vendor Manager typically manages the vendor profile, an assessor creating a new assessment may need to create a new vendor contact record if the appropriate individual to receive the questionnaire does not yet exist in the system.

A. Enable communications across vendors: This is not a function of a risk assessor. The VRM application manages relationships with individual vendors, not communication between them.

C. Update vendor contract deadlines: This is a contract management function, typically performed by a Vendor Manager or Contract Manager, not a risk assessor whose focus is on risk evaluation.

1. ServiceNow Product Documentation - Vendor Risk Management roles: The snvdrriskasmt.vendorassessor role is defined as having the capability to "create and update vendor risk assessments, issues, and tasks. Can view all vendor risk information." This directly supports the functions of accessing assessments (B) and creating issues (D).

Source: ServiceNow Product Documentation, "Vendor Risk Management roles," Rome release (and subsequent).

2. ServiceNow Product Documentation - Review and approve a vendor risk assessment: This document outlines the assessor's workflow, stating, "When the vendor submits the questionnaire... The vendor risk assessor can now review the vendor's responses... If the assessor finds a problem with an answer, they can create an issue, a task, or request more information." This confirms the assessor's responsibility to access completed assessments (B) and create issues (D).

Source: ServiceNow Product Documentation, "Review and approve a vendor risk assessment," Utah release (and subsequent).

3. ServiceNow Product Documentation - Create and send a vendor risk assessment: The procedure for creating an assessment requires selecting a "Vendor contact." For an assessor to fulfill their duty of creating an assessment, a contact must exist. If the necessary contact is missing, creating one (E) becomes a required supporting task to complete their primary function.

Source: ServiceNow Product Documentation, "Create and send a vendor risk assessment," Utah release (and subsequent).

Vendor risk reports in ServiceNow are primarily generated from the core tables that store the essential data of the Vendor Risk Management (VRM) lifecycle. The Company [corecompany] table stores the vendor profiles, which is the foundation for all risk activities. The Vendor Risk Assessment [snvdrriskasmtassessment] table contains the records for each assessment, including its status, responses, and calculated risk scores. The Vendor Risk Issue [snvdrriskasmtissue] table tracks all issues identified during the assessment process that require remediation. Reporting on these three tables provides a comprehensive view of the vendor risk posture, assessment progress, and outstanding issues.

D. Vendor Contact [vmvendorcontact]: This table stores administrative contact information. While useful for communication, it is not a primary source for creating reports on vendor risk status or assessment outcomes.

E. Vendor Activity [vmvendoractivity]: This is not a standard, primary table used for substantive vendor risk reporting. Activities are typically tracked in journals or audit logs, not a dedicated reporting table of this name.

1. ServiceNow Product Documentation - Components installed with Vendor Risk Management: This document lists the key tables installed with the VRM application. It explicitly mentions snvdrriskasmtassessment (Vendor Risk Assessment) and snvdrriskasmtissue (Vendor Risk Issue) as core components. The corecompany table is the base for defining vendors.

Reference: ServiceNow Product Documentation, "Components installed with Vendor Risk Management," section "Tables."

2. ServiceNow Product Documentation - Vendor Risk Management dashboards and reports: The pre-configured dashboards and reports for VRM are built using these core tables. For example, the "Vendor Risk Overview" dashboard pulls data from vendors (corecompany), assessments (snvdrriskasmtassessment), and issues (snvdrriskasmtissue) to provide a holistic view.

Reference: ServiceNow Product Documentation, "Vendor Risk Management dashboards and reports," section "Vendor Risk Overview dashboard."

3. ServiceNow Product Documentation - Create a vendor: This guide confirms that vendors are stored in the Company [corecompany] table and are distinguished by the "Vendor" flag being set to true. This establishes it as the foundational table for any vendor-related reporting.

Reference: ServiceNow Product Documentation, "Create a vendor in Vendor Risk Management."