4.2 Demonstrate Understanding of War Room Activities XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How can an analyst mention another user in a War Room note to draw their attention?

   • ABy sending a direct message through the XSOAR chat feature.
   • BBy typing '@' followed by the user's name in the note.
   • CBy assigning the user to the incident.
   • DBy adding the user's email address in the note.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A malware analyst is working a ransomware incident. They need to manually track three follow-up actions: block the malicious IP, quarantine the affected host, and notify the legal team. The analyst wants these to appear as checkable items in the War Room so progress is visible to the whole team. What should the analyst do?

   • AAdd a single note listing all three actions and pin it to the top of the War Room.
   • BExport the War Room to a spreadsheet and share it with the team for manual tracking.
   • CCreate three separate War Room tasks and assign each to the appropriate team member.
   • DRun three separate commands to perform the actions and rely on the command outputs as evidence.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC team is managing a large incident with many parallel workstreams. The team lead wants to see a quick overview of all pending investigation steps and who is responsible for each. What should the team lead use in the War Room?

   • AFilter the War Room to show only command outputs.
   • BExport the War Room and manually compile a list of pending actions.
   • CScroll through the War Room timeline to see all the notes and commands.
   • DReview the list of War Room tasks, which shows each task, its assignee, and its status.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of creating a task in the War Room?

   • ATo store a note for future reference.
   • BTo assign a severity level to the incident.
   • CTo track a specific investigation step or action that needs to be completed.
   • DTo automatically run a command when the task is created.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of the War Room in Palo Alto Networks XSOAR?

   • ATo provide a separate environment for testing playbooks before they are deployed to production.
   • BTo store all indicators of compromise (IOCs) extracted from an incident for threat intelligence sharing.
   • CTo automate the entire incident response process without human intervention.
   • DTo provide a centralized, chronological record of all investigation activities and collaboration for an incident.
   Reveal Solution Discussion Select an answer first