2.3 Demonstrate Understanding of Classifier and Mapper Configuration XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In XSOAR, what is the purpose of mapping incoming data to custom incident fields?

   • ATo automatically trigger playbooks
   • BTo replace the need for a classifier
   • CTo change the incident type after creation
   • DTo store data that is specific to the organization's workflow in a structured way
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In XSOAR, what is the main purpose of a mapper?

   • ATo control which users have access to an incident
   • BTo transform raw event data into the fields of an incident
   • CTo decide which incident type an event should become
   • DTo define the order in which playbook tasks are executed
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When configuring a mapper in XSOAR, how can you map data from a nested JSON structure to an incident field?

   • ABy manually copying the data into the incident
   • BBy creating a new incident field for each nested element
   • CBy using a playbook task to copy the data
   • DBy using a JSON path expression to extract the value
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When configuring a classifier in XSOAR, what is the primary basis for determining the incident type?

   • AThe values of specific fields in the incoming event data
   • BThe number of times the event has been seen before
   • CThe name of the integration that sent the event
   • DThe time of day the event was received
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team is troubleshooting why an incident created from a webhook has no data in the 'source' field. The webhook sends a JSON payload with a top-level field 'origin'. The mapper is configured to map 'origin' to 'source'. What could be the issue?

   • AThe 'source' field is not a valid incident field.
   • BThe mapper is not associated with the incident type assigned by the classifier.
   • CThe classifier is overwriting the 'source' field after mapping.
   • DThe webhook integration does not support mappers.
   Reveal Solution Discussion Select an answer first