2.6 Demonstrate Knowledge of Incident Type Playbooks, Layouts, and SLAs XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization uses XSOAR for incident management. The 'Network Alert' incident type currently shows the default layout, which displays all incident fields. Analysts have complained that the layout is cluttered and they cannot quickly find the source IP and destination IP fields. The team wants a custom layout for the 'Network Alert' incident type that prominently displays these two fields at the top. What should the administrator do?

   • AModify the default layout to add the source IP and destination IP fields to the top, which will apply to all incident types.
   • BUse field-level permissions to make the source IP and destination IP fields visible only on the 'Network Alert' incident type.
   • CCreate a new layout, add the source IP and destination IP fields to the top of the layout, and assign the layout to the 'Network Alert' incident type.
   • DCreate a new incident type and assign the 'Network Alert' incidents to it, then edit the default layout for that new type.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A playbook for 'Malware' incidents has a task that runs a script to check if an endpoint is online. If the endpoint is offline, the playbook should wait 10 minutes and check again, up to 5 times. After 5 failed attempts, the playbook should mark the incident as 'Pending' and stop. What is the most efficient way to implement this loop?

   • AUse a conditional task that checks the script result and a 'loop' option on the script task with a maximum of 5 iterations and a 10-minute wait between iterations.
   • BSet the script task to retry 5 times with a 10-minute interval in the task's 'Retry' settings.
   • CUse a 'while' loop in a single Python script that checks the endpoint, waits, and retries up to 5 times.
   • DCreate 5 separate script tasks in sequence, each with a 10-minute wait task before it, and a conditional after each to stop if the endpoint is online.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a 'Phishing' incident. The layout currently shows the 'Email Body' field, but the analyst wants to see the 'Email Subject' field as well. The administrator wants to add this field to the layout for all 'Phishing' incidents. What is the most efficient way to do this?

   • AAdd the 'Email Subject' field to the incident's fields directly in the current incident.
   • BEdit the layout assigned to the 'Phishing' incident type and add the 'Email Subject' field to the appropriate section.
   • CModify the playbook to add the 'Email Subject' field to the incident's context.
   • DCreate a new incident type and move the current incident to it, then add the field to the new type's layout.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In XSOAR, what is the primary purpose of associating a playbook with an incident type?

   • ATo automatically execute a predefined set of response tasks when an incident of that type is created.
   • BTo configure the SLA timers and breach thresholds for the incident type.
   • CTo restrict which users can view or modify incidents of that type based on roles.
   • DTo define the visual layout of fields and indicators displayed on the incident's details page.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In XSOAR, what is the purpose of an SLA timer?

   • ATo define the order of tasks in a playbook.
   • BTo control which layout is displayed.
   • CTo store the incident's severity level.
   • DTo track the time remaining until a response or resolution deadline is breached.
   Reveal Solution Discussion Select an answer first