4.2 Demonstrate Understanding of War Room Activities XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After containing a security incident, the incident response manager needs to provide a complete record of the investigation to the company's legal department. The record must include all commands run, outputs, and notes from the War Room. What should the manager do?

   • ATake screenshots of each War Room entry and compile them into a document.
   • BRe-run all the investigation commands and save the new outputs.
   • CExport the War Room entries to a file format suitable for sharing, such as PDF or JSON.
   • DCopy the War Room text manually into an email and send it to legal.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of exporting War Room data?

   • ATo automatically close the incident after export.
   • BTo synchronize the incident with an external SIEM.
   • CTo create a permanent record of the investigation for documentation and sharing with stakeholders.
   • DTo free up storage space in the War Room.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an active incident, a senior analyst determines that the initial compromise vector was a malicious macro in a Word document. The team needs to record this conclusion in the War Room so that all members—including those who join later—can see the reasoning. The analyst also wants to notify the incident commander directly. What should the analyst do?

   • ASend an email to the team from the War Room and attach the incident report.
   • BCreate a task titled 'Document compromise vector' and assign it to the incident commander.
   • CAdd a War Room note describing the finding and use the @mention feature to notify the incident commander.
   • DRun a command to extract the macro and post the raw output as a note.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An incident responder is reviewing a long-running incident with hundreds of War Room entries. They need to find the output of a specific 'file hash reputation' command that was run several hours ago. The analyst remembers the command name but not the exact hash value. What is the most efficient way to locate this entry?

   • AScroll through the entire War Room timeline until the entry is found.
   • BUse the War Room search bar and filter by command name 'file hash reputation'.
   • COpen the incident's context data and look for the command's output in the JSON.
   • DRe-run the command with the same parameters and compare the new output.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a key feature of the XSOAR War Room?

   • AIt provides a direct connection to external threat intelligence feeds for real-time enrichment.
   • BIt maintains a complete audit trail of all actions taken during the investigation.
   • CIt automatically resolves incidents once all tasks are completed.
   • DIt provides a real-time chat interface for instant messaging with other analysts.
   Reveal Solution Discussion Select an answer first