2.2 Explain Field and Layout Configuration XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In XSOAR, which field type is most appropriate for storing a value that must be selected from a predefined list of options?

   • ANumber
   • BDropdown
   • CText
   • DDate
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC manager wants to add a visual representation of the number of open incidents by severity to the top of the incident layout. This should update dynamically as incidents change. What should be added to the layout?

   • AA chart widget configured to display incident counts by severity.
   • BA text field that displays the incident count.
   • CA markdown widget with a static table of incident counts.
   • DA notes widget that analysts manually update with counts.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has two incident types: 'Network Alert' and 'Endpoint Alert'. They want the 'Network Alert' layout to show a 'Source IP' field prominently, while the 'Endpoint Alert' layout should show a 'Hostname' field. They have created two custom layouts. What must be done to ensure each incident type displays the correct layout?

   • AAssign the 'Network Alert' layout to the 'Network Alert' incident type and the 'Endpoint Alert' layout to the 'Endpoint Alert' incident type.
   • BRename the layouts to match the incident type names and they will be applied automatically.
   • CAssign both layouts to both incident types and let users choose which to view.
   • DCreate a single layout that conditionally shows fields based on the incident type.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst has created a custom field 'Threat Actor' and added it to the 'Incident' layout. The field is visible but cannot be edited by anyone, including the 'Admin' role. The field was created with the 'Read Only' property enabled. What is the best way to make this field editable?

   • ADisable the 'Read Only' property on the field definition.
   • BChange the layout permissions to allow editing for the 'Admin' role.
   • CCreate a new field with the same name and add it to the layout.
   • DRemove the field from the layout and re-add it.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of a section in an XSOAR incident layout?

   • ATo store incident data in a database
   • BTo define user roles and permissions
   • CTo group related fields and widgets together for better organization
   • DTo automate incident triage
   Reveal Solution Discussion Select an answer first