4.2 Demonstrate Understanding of War Room Activities XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat hunter needs to check if a specific domain is malicious. They are already in the War Room for the incident and want to run the reputation command without leaving the incident view. What should the threat hunter do?

   • ANavigate to the integrations page and run the command from there.
   • BType the reputation command directly in the War Room command line at the bottom of the incident.
   • COpen the incident's context data and manually query the domain.
   • DCreate a new task and add the command as a task description.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst runs a reputation command on a suspicious IP address. The output shows the IP is associated with a known botnet. The analyst wants to highlight this finding for the rest of the team and make it easy to reference later. What should the analyst do?

   • AExport the War Room to a file and share it with the team.
   • BAdd a note in the War Room summarizing the finding and reference the command output.
   • CFilter the War Room to show only command outputs.
   • DRe-run the command with verbose output to get more details.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Within the War Room interface, which element provides the main chronological list of all entries for the incident?

   • AThe navigation sidebar
   • BThe task list
   • CThe entry feed
   • DThe incident details panel
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A team is managing a complex incident with multiple workstreams. The team lead wants to track the progress of each workstream separately, but also wants a single view of all pending tasks. The team lead is concerned that a single flat list of tasks will become unwieldy as more tasks are added. What is the most effective way to manage this in the War Room?

   • ACreate tasks with descriptive names that include the workstream, and use the task list to filter or group by name.
   • BUse notes to track the progress of each workstream and rely on the team to update them.
   • CCreate separate incidents for each workstream and manage tasks in each incident.
   • DCreate a single task for each workstream and add all steps as comments to that task.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of filtering War Room entries by type?

   • ATo sort entries alphabetically by their content.
   • BTo export only the filtered entries to a report.
   • CTo permanently remove entries of a certain type from the War Room.
   • DTo display only entries of a specific type, such as notes or command results.
   Reveal Solution Discussion Select an answer first