An administrator has created a custom layout for the 'Malware' incident type. After saving, the layout does not appear when a new 'Malware' incident is opened. The incident type is correctly selected in the layout assignment. What is the most likely cause?

The layout was assigned to the wrong incident type.

The layout was not published; only saved as a draft.

The layout was created as a 'Details' layout instead of a 'New' layout.

The layout is missing required fields, so XSOAR falls back to the default.

An organization has an SLA of 1 hour for 'Phishing' incidents. The SOC wants to automatically escalate to a senior analyst if the SLA is breached. The escalation should only happen once per incident. What is the most efficient way to implement this?

Add a task at the end of the playbook that always sends a notification to the senior analyst.

Set the SLA field to automatically send an email to the senior analyst when breached.

Create a separate playbook that is triggered by a 'SLA breached' incident field change and sends the notification.

Add a task in the incident type playbook that checks the SLA status field and, if breached, sends a notification to the senior analyst, with a 'run once' condition.

In XSOAR, how can a playbook trigger a notification when an SLA is breached?

By manually updating the SLA timer.

By using a task that checks the SLA status and sends a notification if breached.

By assigning a new layout to the incident.

Palo Alto NetworksCertified XSOAR Engineer

Domain 2Objective 6

2.6 Demonstrate Knowledge of Incident Type Playbooks, Layouts, and SLAs XSOAR-ENGINEER Practice Questions (Page 4)

Part of the Use Case Planning and Development domain, which accounts for 22% of the XSOAR-ENGINEER exam.

22questions here

5free pages

7concepts

22%of the exam

Questions 16–20

16application · medium
An administrator has created a custom layout for the 'Malware' incident type. After saving, the layout does not appear when a new 'Malware' incident is opened. The incident type is correctly selected in the layout assignment. What is the most likely cause?
Select an answer first
17application · medium
An organization has an SLA of 1 hour for 'Phishing' incidents. The SOC wants to automatically escalate to a senior analyst if the SLA is breached. The escalation should only happen once per incident. What is the most efficient way to implement this?
Select an answer first
18foundation · easy
In XSOAR, how can a playbook trigger a notification when an SLA is breached?
Select an answer first
19foundation · easy
Which XSOAR feature allows analysts to see the SLA status (e.g., running, breached) directly on the incident details page?
Select an answer first
20foundation · easy
Which XSOAR component is used to arrange incident fields, indicators, and custom sections on the incident details page?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.

2.6 Demonstrate Knowledge of Incident Type Playbooks, Layouts, and SLAs XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

An administrator has created a custom layout for the 'Malware' incident type. After saving, the layout does not appear when a new 'Malware' incident is opened. The incident type is correctly selected in the layout assignment. What is the most likely cause?

An organization has an SLA of 1 hour for 'Phishing' incidents. The SOC wants to automatically escalate to a senior analyst if the SLA is breached. The escalation should only happen once per incident. What is the most efficient way to implement this?

In XSOAR, how can a playbook trigger a notification when an SLA is breached?

Which XSOAR feature allows analysts to see the SLA status (e.g., running, breached) directly on the incident details page?

Which XSOAR component is used to arrange incident fields, indicators, and custom sections on the incident details page?

Keep studying — Use Case Planning and Development