2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of data enrichment that could be applied to an alert in XSIAM?

   • AAdding the affected user's department and role
   • BChanging the alert's timestamp to the current time
   • CAssigning the alert to a random analyst
   • DRemoving the source IP address from the alert
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a valid source that can trigger the creation of an incident in XSIAM?

   • AA successful user login from a known IP
   • BA user manually reporting a suspicious email
   • CA scheduled report generated weekly
   • DA routine configuration backup
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to ensure that when a critical-severity incident is created, it is automatically assigned to the incident response team and a ticket is opened in their external ticketing system. What should be implemented in XSIAM?

   • AA report that lists critical incidents for the team to review.
   • BA manual procedure where the analyst assigns the incident and opens a ticket.
   • CA playbook triggered on incident creation that performs assignment and opens an external ticket.
   • DAn enrichment rule that adds the ticketing system's URL to the incident.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the role of a playbook in the incident creation process?

   • ATo define a set of automated actions that run when an incident is created
   • BTo store historical incident data for reporting
   • CTo provide a manual checklist for analysts
   • DTo replace the incident lifecycle stages
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident is created from an alert about a user accessing a sensitive database. The analyst wants to understand if this is part of a larger campaign. The incident currently contains only the single alert. What should the analyst do to gain a more comprehensive view?

   • ACreate a new incident for each related alert to keep them separate.
   • BUse enrichment to pull in the user's activity history and any related alerts from the same timeframe.
   • CManually add notes about the user's activity to the incident.
   • DClose the incident and open a new one with more details.
   Reveal Solution Discussion Select an answer first