3.4 Manage Incident and Alert Layout XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An administrator has made changes to the incident layout and saved them. Later, they notice that some analysts still see the old layout when opening incidents. What is the most likely cause?

   • AThe layout was not saved; the administrator needs to save again.
   • BThe incident type does not support layout changes.
   • CThe administrator edited the alert layout instead of the incident layout.
   • DThe analysts' browsers are caching the old layout; they need to refresh or clear cache.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC manager wants to ensure that when a high-severity incident is opened, analysts see a 'Critical Indicators' section at the top of the incident details. The team has already created a custom layout with this section. What is the most efficient way to make this layout appear for all high-severity incidents?

   • AAssign the custom layout to the incident type that high-severity incidents use.
   • BCreate a new alert type for high-severity incidents and assign the layout to it.
   • CModify the default layout to include the section and save it.
   • DManually apply the custom layout to each high-severity incident as it is created.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which action is part of customizing an incident layout in XSIAM?

   • ADeleting an incident from the system
   • BAdding a new field to the layout
   • CAssigning an incident to an analyst
   • DChanging the incident's severity value
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A layout administrator has made several changes to the incident layout over the past week. After a recent change, analysts report that critical fields are missing. The administrator wants to revert to the layout version from two days ago, which was known to be good. What should the administrator do?

   • AOpen the layout version history, select the version from two days ago, and restore it.
   • BCreate a new incident type and assign the old layout to it.
   • CManually re-add the missing fields to the current layout.
   • DDelete the current layout and recreate it from scratch.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In XSIAM, what does rolling back a layout version do?

   • ACreates a new incident type
   • BRestores the layout to a previously saved configuration
   • CDeletes all incidents that used the layout
   • DDisables the layout for future incidents
   Reveal Solution Discussion Select an answer first