2.1 Demonstrate Understanding of Incident and Indicator Lifecycles XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations team wants to automate the initial triage of phishing incidents. They create a playbook that automatically extracts URLs and attachments from the email, enriches them as indicators, and then creates a task for an analyst to review. Which XSOAR capability is being used to manage the incident lifecycle?

   • AIncident closure
   • BCase management
   • CIndicator expiration
   • DAutomation and playbooks
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an incident investigation, the playbook extracts a file hash and adds it as an indicator. Later, the same hash is observed in a different alert, and XSOAR creates a new incident referencing the existing indicator. What does this scenario illustrate about the incident-indicator relationship?

   • AIncidents are always created before indicators.
   • BIndicators are only used for enrichment, not for triggering incidents.
   • CIndicators expire immediately after an incident is closed.
   • DIndicators can be shared across multiple incidents.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which stage of the incident lifecycle is primarily concerned with determining the scope of the incident and identifying affected systems?

   • AAnalysis
   • BDetection
   • CResolution
   • DTriage
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company wants to ensure that all incidents are resolved within 48 hours. They have a playbook that automatically escalates incidents that are about to breach this SLA. However, some incidents require manual investigation and cannot be fully automated. Which playbook design best accommodates this?

   • AUse a playbook that escalates to a manager if the incident is still open near the SLA limit
   • BSet the SLA to 72 hours to allow more time
   • CAutomatically close all incidents after 48 hours
   • DDisable automation for all incidents
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of playbooks in managing indicator lifecycles in XSOAR?

   • ATo manually update indicator status
   • BTo delete indicators that are no longer needed
   • CTo automate enrichment and expiration of indicators
   • DTo prevent any changes to indicator data
   Reveal Solution Discussion Select an answer first