4.2 Demonstrate Understanding of War Room Activities XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a valid action when managing a task in the War Room?

   • AConverting the task into a note.
   • BAutomatically escalating the task to a higher severity.
   • CMarking the task as complete.
   • DDeleting the incident from the War Room.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why might an analyst add a manual note to the War Room?

   • ATo automatically update the incident's severity level.
   • BTo document the rationale behind a decision to close an incident.
   • CTo share an indicator with the threat intelligence team.
   • DTo execute a new investigation command.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A new junior analyst joins an ongoing incident investigation. They need to see the full history of what has been done so far, including commands, results, and notes, to get up to speed. Where should the junior analyst go within XSOAR to view this information?

   • AOpen the incident's attachments and review the uploaded files.
   • BNavigate to the playbook execution history to see the automated steps.
   • COpen the incident's context data view to see all the raw data collected.
   • DOpen the incident and navigate to the War Room tab to view the chronological entry timeline.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst is investigating a phishing incident in XSOAR. They need to determine whether the malicious attachment was detonated in the sandbox and what the verdict was. The analyst wants to run a command directly in the War Room and then quickly locate the output without scrolling through dozens of entries. What should the analyst do?

   • ARun the detonation command from the War Room command line, then use the search/filter bar to locate the entry by command name.
   • BOpen the incident's context data view and look for the attachment's verdict in the raw JSON.
   • CExport the War Room to a PDF and search the document for the sandbox verdict.
   • DCreate a new task in the War Room and assign it to the sandbox integration to trigger the detonation.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of tagging an entry in the War Room?

   • ATo share the entry with external stakeholders via email.
   • BTo change the entry's type from command to note.
   • CTo automatically delete the entry after a certain period.
   • DTo categorize or flag the entry for easier filtering and review.
   Reveal Solution Discussion Select an answer first