2.6 Demonstrate Knowledge of Incident Type Playbooks, Layouts, and SLAs XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which set of XSOAR components, when used together, provides a complete incident management solution for a specific incident type?

   • APlaybook, Layout, and SLA Timer
   • BSLA Timer, Role, and Incident Field
   • CLayout, Role, and Integration
   • DIntegration, Incident Field, and Role
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's security policy states that all 'High' severity incidents must be triaged within 30 minutes of creation. The SOC manager wants XSOAR to automatically track this and show a warning in the incident layout when the 30-minute threshold is approaching. What should the administrator configure?

   • ADefine an SLA field on the incident type with a threshold of 30 minutes and add the SLA field to the incident layout.
   • BCreate a playbook that waits 30 minutes and then sends a notification to the SOC manager.
   • CAdd a 'SLA' field to the layout and manually update it for each incident.
   • DSet a timer field on the incident type and add it to the layout, but do not configure a threshold.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What happens when a layout is assigned to an incident type in XSOAR?

   • AThe layout restricts which users can view the incident.
   • BThe layout sets the SLA timers for the incident type.
   • CThe layout automatically runs the incident type playbook.
   • DThe layout becomes the default view for all incidents of that type.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In XSOAR, what is the primary purpose of customizing an incident layout?

   • ATo set the SLA timers and breach thresholds for the incident.
   • BTo define the automated response tasks for an incident type.
   • CTo control which fields and indicators are displayed and how they are arranged for investigators.
   • DTo manage user permissions for viewing and editing incidents.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC has an SLA of 1 hour for 'Phishing' incidents. The playbook for 'Phishing' incidents includes a task that waits for 45 minutes (a 'wait' task) before proceeding to a manual review task. The SOC manager notices that the SLA is often breached even though the total playbook time is under 1 hour. The manual review task is the last task. What is the most likely reason for the SLA breach?

   • AThe SLA field is not configured on the incident type, so it defaults to a shorter threshold.
   • BThe SLA timer starts when the incident is created, not when the playbook starts, so the 45-minute wait plus the manual review time can exceed the 1-hour SLA.
   • CThe manual review task is not a 'scheduled' task, so it does not pause the SLA timer.
   • DThe 'wait' task is not counted in the SLA calculation, so the SLA is breached because the manual review takes too long.
   Reveal Solution Discussion Select an answer first