Exam CIS-SIR topic 1 question 41 discussion

The User Reported Phishing inbound actions available prior to the Security Incident Response 9.0 release are now disabled. Security incidents are no longer created through the disabled inbound actions. A new Create Phishing Email inbound action is now available. https://docs.servicenow.com/en-US/bundle/vancouver-security-management/page/product/security-incident-response/concept/urp-about.html

D is correct. The existing User Reported Phishing email inbound actions (Type = Forward and Type = New) have been disabled. A new Create Phishing Email inbound action is now available. ref: https://docs.servicenow.com/bundle/sandiego-security-management/page/product/security-incident-response/concept/urp-about.html

User Reported Phishing determines whether inbound email should be processed as Phishing email.

in the course provided SN instance, only the "Create Phishing Email" inbound action is active, both the "User Reported Phishing" (there are 2) have active set to false, additionally, it's calling a script include called "EmailUserReportedPhishing" under the description of that script include record, it states "Email User Reported Phishing V2 details methods to determine if this is a phishing." So correct answer should be D

D is correct

c is correct