2.4 Apply the Native Automation Response Action XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC team has created a playbook that automatically blocks malicious IP addresses on the firewall. The team wants to test the playbook in a staging environment that mirrors production. However, the staging environment does not have a firewall. What should the team do to validate the playbook?

   • ASkip testing and rely on the playbook's design
   • BUse a mock firewall integration to simulate the block action and verify the playbook's logic
   • CDeploy the playbook to production and monitor it closely
   • DTest the playbook in a sandbox with a simulated firewall
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An automation action fails during a playbook run. Where should an analyst look first to find the error details and understand why the action failed?

   • AThe endpoint's firewall rules
   • BThe incident's severity field
   • CThe user's browser history
   • DThe playbook execution log
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC team is configuring a playbook that uses the 'quarantine email' action. The team wants to ensure that the action only runs for emails that are confirmed malicious, not for emails that are merely suspicious. What should the team configure in the playbook?

   • ASet the automation rule to trigger only on high-severity incidents
   • BRun the quarantine action on all emails in the incident
   • CUse the 'delete email' action instead
   • DAdd a condition that checks the email's threat verdict before running the quarantine action
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During incident response, an analyst needs to prevent a compromised endpoint from communicating with the rest of the network while preserving the ability to run investigation commands. Which native automation action is most appropriate?

   • AQuarantine File
   • BBlock IP
   • CIsolate Endpoint
   • DRun Script
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is troubleshooting a playbook that is supposed to isolate an endpoint when a malware incident is detected. The playbook runs, but the endpoint is not isolated. The analyst checks the execution logs and sees that the 'isolate endpoint' action was skipped. What is the most likely reason for the action being skipped?

   • AThe endpoint is already isolated
   • BA condition in the playbook was not met
   • CThe endpoint is offline
   • DThe playbook did not trigger
   Reveal Solution Discussion Select an answer first