2.3 Demonstrate Understanding of Classifier and Mapper Configuration XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In Palo Alto Networks XSOAR, what is the primary role of a classifier when an incoming incident is received?

   • ATo store incident data in a custom database for long-term retention
   • BTo determine the incident type and associate the appropriate layout for the incident
   • CTo map incoming event fields to incident fields so the incident contains the correct data
   • DTo execute playbook tasks automatically when an incident is created
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations team is ingesting alerts from a third-party email gateway. The gateway sends alerts as JSON over a webhook, and each alert contains a field called 'event_type' with values like 'phishing', 'malware', and 'spam'. The team wants each alert to automatically appear as a distinct incident type in XSOAR so that different playbooks and layouts can be applied. What should the administrator configure?

   • ACreate a classifier that uses the 'event_type' field as the incident type selector.
   • BConfigure the webhook integration to hardcode the incident type for all alerts.
   • CCreate a separate integration instance for each event type.
   • DCreate a mapper that copies the 'event_type' field into the incident's type field.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A team is configuring a mapper for a new incident type 'Data Breach'. The source system sends a field 'breach_details' that contains a JSON string with 'date', 'records_affected', and 'vector'. The team wants to populate three custom incident fields: 'breachDate', 'recordsAffected', and 'attackVector'. The mapper is not populating any of these fields. What is the most likely cause?

   • AThe source system is not sending the 'breach_details' field.
   • BThe mapper is not using a transformation to parse the JSON string before extracting the nested values.
   • CThe classifier is not assigning the 'Data Breach' incident type.
   • DThe custom incident fields are not associated with the 'Data Breach' incident type.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team has configured a new classifier that assigns incidents to the 'Phishing' incident type. They also created a custom layout for phishing incidents. However, when a phishing alert arrives, the incident shows the default layout instead of the custom one. What is the most likely cause?

   • AThe layout is only applied to incidents created manually.
   • BThe mapper is overwriting the incident type after classification.
   • CThe custom layout is not associated with the 'Phishing' incident type.
   • DThe classifier is not being invoked because the integration is not configured.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization wants to use a single classifier for multiple integrations that all send similar alert data. The classifier should assign the incident type 'Security Alert' for all of them. What is the simplest way to configure this?

   • ACreate one classifier that always returns 'Security Alert' and assign it to each integration.
   • BUse a mapper to set the incident type to 'Security Alert' for all integrations.
   • CCreate a separate classifier for each integration, each returning 'Security Alert'.
   • DConfigure each integration to create incidents with a hardcoded type.
   Reveal Solution Discussion Select an answer first