2.3 Demonstrate Understanding of Classifier and Mapper Configuration XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization has multiple teams, each responsible for a different type of incident (e.g., phishing, malware, DDoS). Each team has its own layout and playbook. The team wants incidents to be automatically routed to the correct layout and playbook based on the source of the alert. What should the administrator configure?

   • AA classifier that assigns incident types based on the source, with each type linked to the appropriate layout and playbook.
   • BA mapper that assigns the layout and playbook directly to each incident.
   • CA single layout and playbook for all incidents, with conditions inside the playbook.
   • DA separate integration for each source, each with its own layout.
   Reveal Solution Discussion Select an answer first
2. 12application · hard

   A company uses a custom application that sends alerts with a field 'user' containing a JSON string like '{"id": 123, "name": "John Doe"}'. The team wants to extract the 'name' value into the XSOAR incident field 'assignedUser'. What should the mapper configuration use?

   • AA mapping of 'user.name' directly to 'assignedUser'.
   • BA classifier that extracts the name and sets it as the incident type.
   • CA transformation that parses the JSON string and extracts 'user.name'.
   • DA direct mapping of 'user' to 'assignedUser'.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is integrating a new endpoint detection and response (EDR) tool. The EDR sends alerts with a field 'threat_type' that can be 'ransomware', 'trojan', or 'phishing'. The company wants each threat type to have its own incident type and layout. What should the administrator configure?

   • AA classifier with three conditions, each mapping a 'threat_type' value to a corresponding incident type.
   • BA playbook that reassigns the incident type after creation.
   • CA mapper that sets the incident type based on the 'threat_type' field.
   • DA single incident type with a layout that changes based on the 'threat_type' field.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In XSOAR, how do classifiers and mappers work together to ensure consistent incident handling?

   • ABoth the classifier and mapper are optional and can be used interchangeably
   • BThe mapper determines the incident type, and the classifier populates the incident fields
   • CThe classifier determines the incident type, and the mapper populates the incident fields based on that type
   • DThe classifier and mapper are only used for custom integrations
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst notices that when a new incident is created from a ticketing system, the 'details' field is populated with the ticket description, but the 'owner' field is empty even though the ticket JSON contains an 'assignee' field. The mapper is configured to map 'assignee' to 'owner'. What is the most likely reason the field is not being populated?

   • AThe 'owner' field is not a valid incident field.
   • BThe mapper is only applied to incidents created manually.
   • CThe classifier is overriding the mapper's output.
   • DThe 'assignee' field is nested inside another object in the JSON.
   Reveal Solution Discussion Select an answer first