3.1 Use Playbooks for Automated Incident Response XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does a playbook integrate with XSIAM's incident management feature?

   • AIt prevents any manual changes to the incident while running
   • BIt can update incident fields, add notes, and change status as part of the workflow
   • CIt automatically closes all incidents without analyst review
   • DIt creates a separate case file for every incident, duplicating data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst wants to run a playbook on an existing incident that was created before the playbook was configured. The playbook is designed to enrich the incident with threat intelligence. What is the most appropriate way to run this playbook on the existing incident?

   • AManually invoke the playbook from the incident's action menu.
   • BRecreate the incident so the playbook triggers automatically.
   • CWait for the playbook to trigger on the next alert update.
   • DChange the playbook trigger to 'Incident Updated' and wait for an update.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which playbook logic construct allows a set of actions to be repeated until a condition is met?

   • ALoop
   • BConditional statement
   • CSwitch case
   • DParallel execution
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following can initiate a playbook in XSIAM?

   • AOnly incidents that have been escalated by an analyst
   • BOnly when a new threat intelligence feed is updated
   • COnly scheduled tasks that run at specific times
   • DAlerts, incidents, or manual invocation by an analyst
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A playbook is triggered by an incident and needs to extract the file hashes from the incident's artifacts, query a sandbox for each hash, and then add the sandbox report as a new artifact to the same incident. Which sequence of actions best accomplishes this?

   • AUse a manual task to ask an analyst to run the sandbox queries and then attach the reports.
   • BUse a condition action to check if hashes exist, then query the sandbox once for the first hash only.
   • CUse an artifact-handling action to get the hashes, a loop to query the sandbox for each hash, and an artifact-creation action to add the reports.
   • DUse a single action that queries the sandbox for all hashes and then updates the incident description with the reports.
   Reveal Solution Discussion Select an answer first