Exam CIS-SIR topic 1 question 98 discussion

eBook page 312 also states: In URP v2 a new inbound action is used in conjunction with ingestion rules and a flow to process the incoming phishing email. eBook page 64 explain the Email Parsers Working model, which begins with Inbound Email Actions. On page 53 on using the set up Assistance, reading under the headline Email settings: - Set up Email parsers to generate incidents - Set up inbound email actions on incoming emails. Based on this, I'd say its A

Sorry, the correct answer is B. according to the eBook page 312: Inbound actions & email matching rules identifies phishing email to create security incidents.

Security Incidents in ServiceNow are often created based on incoming email communications related to security events or incidents. Inbound Email Actions allow you to configure ServiceNow to create records or perform specific actions when emails with certain criteria are received. When an email matching the configured criteria is received, ServiceNow can trigger the creation of a Security Incident or take other predefined actions. Email matching rules and email rules are typically used for processing incoming emails, but they may not necessarily be specific to creating Security Incidents. Notifications, on the other hand, are typically used for sending alerts or notifications but are not directly related to the creation of Security Incidents. Therefore, the most appropriate platform functionality for creating Security Incidents based on incoming emails is Inbound Email Actions.

inbound email action triggers the entire process... so i am guessing A