3.1 Use Playbooks for Automated Incident Response XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A playbook is designed to contain a compromised user account by disabling it and resetting its password. However, the playbook should only run these actions if the incident is confirmed as a true positive by an analyst. What is the best way to incorporate this requirement?

   • ASkip the containment actions and only add a note to the incident for the analyst to act manually.
   • BAutomatically disable the account and reset the password for every incident that triggers the playbook.
   • CUse a condition to check if the incident has a high severity, and then run the containment actions.
   • DAdd a manual approval step before the containment actions, so an analyst can approve or reject the actions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a XSIAM playbook, which action type is used to gather additional context about an indicator, such as querying a threat intelligence service?

   • AEnrichment action
   • BRemediation action
   • CContainment action
   • DNotification action
   Reveal Solution Discussion Select an answer first
3. 18foundation · easy

   An analyst wants to run a playbook immediately on a specific open incident without waiting for an alert. Which trigger type should they use?

   • AScheduled trigger
   • BManual invocation
   • CIncident trigger
   • DAlert trigger
   Reveal Solution Discussion Select an answer first