2.1 Demonstrate Understanding of Incident and Indicator Lifecycles XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is it important to expire indicators in the indicator lifecycle?

   • ATo prevent the indicator from being used in playbooks
   • BTo comply with data retention regulations
   • CTo reduce the number of false positives in detection
   • DTo increase the storage capacity of the threat intelligence platform
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does XSOAR support the incident lifecycle through automation?

   • ABy automatically resolving all incidents without human intervention
   • BBy using playbooks to automate repetitive tasks at various stages
   • CBy requiring manual data entry for every incident
   • DBy only supporting the detection stage of the lifecycle
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A team wants to automate the entire incident lifecycle for phishing emails. The playbook should extract indicators, enrich them, and then, if the incident is confirmed as malicious, automatically block the indicators and close the incident. However, the team is concerned about false positives and wants a human review before blocking. Which playbook design best addresses this concern?

   • AClose the incident immediately after enrichment
   • BAutomatically block indicators and close the incident without human review
   • CPause the playbook for analyst approval before blocking indicators
   • DOnly enrich indicators and never block them
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is experiencing a ransomware outbreak. The incident response playbook automatically isolates affected endpoints, blocks the ransomware's command-and-control domains, and then restores systems from backups. After the incident is closed, the team wants to ensure that the indicators (domains and hashes) are not used in future detection after they are no longer relevant. However, they also want to keep the indicators for a period for forensic analysis. Which approach best balances these needs?

   • AKeep the indicators active indefinitely
   • BConvert the indicators to a different type
   • CSet a long expiration period for the indicators
   • DImmediately delete all indicators after the incident is closed
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How can an indicator trigger an incident in a security operations context?

   • ABy being enriched with threat intelligence
   • BBy being manually added to a blocklist
   • CBy matching a detection rule that creates an incident
   • DBy expiring after a certain period
   Reveal Solution Discussion Select an answer first