2.1 Demonstrate Understanding of Incident and Indicator Lifecycles XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is investigating an incident and notices that a specific IP address appears in the incident's indicator list. The analyst wants to see all other incidents that have referenced this same IP address. What does this action demonstrate about the incident-indicator relationship?

   • AIndicators are automatically expired after an incident is closed
   • BIndicators can be used to correlate incidents
   • CIndicators are only relevant to the incident that created them
   • DIncidents cannot be linked to indicators
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence platform feeds a malicious domain into XSOAR. The domain is stored as an indicator. Later, an alert fires because a user accessed that domain, and XSOAR creates an incident referencing the indicator. Which statement best describes the relationship between the indicator and the incident?

   • AThe indicator triggered the incident, and the incident provides context for the indicator.
   • BThe incident enriches the indicator, but the indicator cannot influence incident creation.
   • CIndicators and incidents are unrelated entities that never reference each other.
   • DThe incident is created first, and the indicator is derived from it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to automatically close low-severity incidents after 24 hours if no analyst has interacted with them. They also want to automatically escalate high-severity incidents that have been open for more than 2 hours. Which XSOAR feature should they use to implement these time-based actions?

   • AIndicator expiration
   • BIncident fields
   • CPlaybooks
   • DIncident layouts
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst receives an alert from the SIEM about a suspicious login from an unfamiliar IP address. After investigation, the analyst determines it was a successful brute-force attack and creates an incident in XSOAR. The playbook automatically enriches the IP address, contains the affected endpoint, and then the analyst closes the incident. Later, the team reviews the incident to identify lessons learned. Which stage of the incident lifecycle is the team performing when they review the incident after closure?

   • APost-incident activity
   • BEradication
   • CContainment
   • DDetection
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A team wants to ensure that every incident is automatically assigned a severity based on the number of affected assets and the presence of critical indicators. They also want to automatically notify the on-call analyst for high-severity incidents. Which XSOAR feature should they use to implement this?

   • ALayout
   • BPlaybook
   • CIndicator expiration
   • DIncident fields
   Reveal Solution Discussion Select an answer first