4.3 Explain Incident Relationships XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A playbook is designed to create a parent incident for a phishing campaign and child incidents for each reported email. The team wants to ensure that if a child incident is closed, the parent incident is automatically notified or updated. What is the most reliable way to achieve this in XSOAR?

   • AUse the 'CreateIncidentRelationship' automation to link the parent and child, which will handle updates
   • BSet the parent incident's 'closeNotes' field to automatically update when a child is closed
   • CUse a playbook trigger that runs when a child incident is closed and updates the parent incident
   • DManually update the parent incident each time a child is closed
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A junior analyst asks why the incident layout shows a 'Related Incidents' section that is empty for a new incident. The senior analyst explains that incident relationships are important for the investigation process. Which statement best describes the primary value of establishing incident relationships in XSOAR?

   • AThey increase the severity of the incident automatically
   • BThey provide additional context by connecting incidents that share indicators, artifacts, or a common root cause
   • CThey are required for the incident to be assigned to a queue
   • DThey automatically resolve all linked incidents when one is closed
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst has a parent incident for a ransomware outbreak and several child incidents for affected servers. The analyst wants to see all the child incidents from the parent incident's layout without navigating away. Which XSOAR feature allows the analyst to view these relationships directly from the incident?

   • AThe 'Indicators' tab
   • BThe 'Work Plan' tab
   • CThe 'Related Incidents' section in the incident layout
   • DThe 'War Room' tab
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise has a playbook that automatically creates a child incident for each user who reported a phishing email. The team notices that the 'Related Incidents' section on the parent incident is becoming cluttered with hundreds of child incidents, making it difficult for analysts to find the most relevant ones. The team wants to reduce clutter while preserving the ability to see the full list of children when needed. What is the most effective approach?

   • AChange the relationship type to 'related' instead of 'parent-child'
   • BUse a layout that displays related incidents in a collapsible section or a separate tab
   • CDelete the child incidents after they are resolved
   • DRemove the parent-child relationships and use a custom field to store the parent ID
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In Palo Alto Networks XSOAR, what is the primary purpose of defining relationships between incidents?

   • ATo establish a link between incidents that provides additional context and aids in investigation and response
   • BTo permanently merge two incidents into a single record
   • CTo automatically close all related incidents when one is resolved
   • DTo enforce strict data isolation between different incidents
   Reveal Solution Discussion Select an answer first