4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst is investigating a suspicious login alert. They have already run several commands in the War Room and gathered evidence. Now they want to document their findings and assign a task to a junior analyst to continue the investigation. Which feature should they use?

   • AAdd a note to the War Room and create a task in the incident's task list.
   • BExport the War Room to a PDF and attach it to a new incident.
   • CClose the incident and reopen it with the junior analyst as the owner.
   • DSend an email to the junior analyst with the War Room transcript.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary role of a playbook in Cortex XSOAR?

   • ATo store evidence and notes for an incident
   • BTo manage user access to the platform
   • CTo display dashboards and reports
   • DTo automate a sequence of actions and tasks during incident response
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations team wants to automate the initial triage of phishing emails. They have identified a content pack in the Cortex XSOAR Marketplace that includes both a phishing email parser and a playbook that uses that parser. The team needs to install the pack and then immediately run the playbook on a newly created incident. Which sequence of actions should they take?

   • ADownload the pack from the Marketplace, manually copy the playbook YAML into the Playbooks section, then create an incident.
   • BCreate the incident first, then browse the Marketplace and install the pack from within the incident's War Room.
   • CBrowse the Marketplace, install the pack, then create a new incident and manually attach the playbook to it before running it.
   • DInstall the pack, then use the 'Run' button on the pack's detail page to execute the playbook without creating an incident.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During an active incident investigation, a SOC analyst needs to collaborate with a malware analyst who is in a different time zone. The malware analyst needs to see the evidence gathered so far and add their own analysis notes. What feature of Cortex XSOAR is designed for this real-time, collaborative investigation?

   • AThe Marketplace, where analysts can share custom content packs.
   • BThe Playbook debugger, which allows multiple analysts to step through playbook tasks together.
   • CThe Indicator database, where analysts can share indicators and notes.
   • DThe War Room, where all investigation data, commands, and notes are logged and can be viewed by all participants.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has two separate Cortex XSOAR environments: one for production and one for development. They have developed a custom integration in the development environment and want to use it in production. What is the most efficient and reliable way to move the integration?

   • AUse the Marketplace to publish the integration and then install it in production.
   • BRecreate the integration manually in the production environment by copying the code.
   • CExport the integration as a custom content pack from the development environment and install it in the production environment.
   • DCopy the integration's configuration file from the development environment to the production environment.
   Reveal Solution Discussion Select an answer first