2.6 Demonstrate Knowledge of Incident Type Playbooks, Layouts, and SLAs XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which XSOAR feature allows a playbook to interact with external systems such as ticketing or threat intelligence platforms?

   • AIncident Layouts
   • BSLA Timers
   • CIntegrations
   • DIncident Fields
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which XSOAR component is responsible for defining the automated response workflow that runs for a specific incident type?

   • AIncident Layout
   • BIncident Field
   • CSLA Timer
   • DIncident Type Playbook
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In XSOAR, what is the effect of applying a custom layout to an incident type?

   • AIt modifies the fields and sections displayed on the incident details page for that type.
   • BIt changes the automated response workflow for that incident type.
   • CIt alters the SLA breach thresholds for incidents of that type.
   • DIt changes the integration credentials used for that incident type.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to track two different SLAs for 'Malware' incidents: one for initial triage (15 minutes) and one for containment (2 hours). The SOC manager wants both to be visible on the incident layout. What is the correct way to configure this?

   • AUse the built-in 'SLA' field for triage and create a timer field for containment.
   • BCreate one SLA field with a threshold of 15 minutes and use a playbook to track the 2-hour containment SLA.
   • CCreate two custom SLA fields (e.g., 'Triage SLA' and 'Containment SLA') on the incident type and add both to the layout.
   • DCreate two incident types, one for triage and one for containment, each with its own SLA.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In an XSOAR playbook, what is the purpose of conditional tasks?

   • ATo branch the workflow based on the results of previous tasks or incident data.
   • BTo define the SLA timer for the incident.
   • CTo repeat a set of tasks until a certain condition is met.
   • DTo execute tasks in parallel to speed up the workflow.
   Reveal Solution Discussion Select an answer first