2.1 Demonstrate Understanding of Incident and Indicator Lifecycles XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During an incident, XSOAR automatically creates an indicator for a malicious file hash observed in the environment. The playbook enriches the hash with threat intelligence, adds it to a blocklist, and sets an expiration date. After 30 days, the indicator is automatically removed from the active indicator list. Which indicator lifecycle stage is the expiration?

   • ACreation
   • BExpiration
   • CEnrichment
   • DResolution
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   During an incident, a playbook creates an indicator for a malicious file hash. Later, the same hash is found in a different incident, and the playbook automatically links the two incidents. What is the primary benefit of this automatic linking?

   • AIt reduces the number of indicators in the system
   • BIt prevents the indicator from being enriched again
   • CIt helps analysts identify related incidents and potential campaigns
   • DIt automatically closes both incidents
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the relationship between incidents and indicators in a security operations workflow?

   • AIncidents are always created from a single indicator
   • BIndicators are only used after an incident is resolved
   • CIncidents are independent of indicators and have no connection
   • DIndicators are used to provide context and evidence for incidents
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An incident is escalated to level 2 analysts after initial triage. The playbook has already contained the affected host and eradicated the malware. The team now needs to restore the system from a known-good backup and verify that the system is functioning normally. Which incident lifecycle stage does this represent?

   • APost-incident activity
   • BRecovery
   • CContainment
   • DDetection
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is responding to a widespread malware infection. The playbook has contained the affected hosts and is now eradicating the malware. However, the team is concerned that some hosts may have been missed. They want to ensure that all hosts are clean before declaring the incident resolved. Which action should the playbook take to support the eradication stage?

   • ARun a scan across all hosts to verify no malware remains
   • BRestore all hosts from backups immediately
   • CImmediately close the incident after containing the hosts
   • DExpire all indicators related to the malware
   Reveal Solution Discussion Select an answer first