4.3 Explain Incident Relationships XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a valid type of incident relationship in XSOAR?

   • AHierarchical-peer
   • BParent-child
   • CDependency-chain
   • DCausal-effect
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a valid way to create an incident relationship in XSOAR?

   • ABy using the 'Merge Incidents' command in the CLI
   • BBy sending an email to the XSOAR server
   • CBy editing the incident's JSON directly in the database
   • DBy using the 'Link Incident' button in the incident details view
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC manager wants to improve the efficiency of the incident response process by ensuring that when an analyst investigates a phishing incident, they can quickly see other incidents that involved the same sender address. What is the most effective way to achieve this in XSOAR?

   • ACreate a relationship between incidents that share the same sender address using the 'CreateIncidentRelationship' automation
   • BChange the incident type to 'phishing' for all incidents with the same sender
   • CAdd a note to each incident with the sender address so analysts can search for it
   • DUse the 'Close' action on all incidents with the same sender to group them
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is working on a phishing incident and has linked it to a related malware incident. After further investigation, the analyst determines that the two incidents are not actually related and should not be associated. The analyst wants to remove the relationship so the incidents are no longer connected in the UI. What is the correct way to remove the relationship in XSOAR?

   • AEdit the incident and clear the 'relatedIncident' field
   • BRe-run the playbook that created the relationship to overwrite it
   • CChange the incident type of one incident to 'unrelated'
   • DDelete the malware incident to break the link
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A playbook creates a child incident for each malicious file found on a host. Later, the analyst wants to add a relationship between two child incidents that were created for the same file but on different hosts. The analyst wants to do this from the incident layout without writing a script. What is the correct manual action?

   • AUse the 'Link' button in the War Room
   • BEdit one child incident and add the other incident's ID to the 'relatedIncident' field
   • CCreate a new incident and add both child incidents as related
   • DChange the 'parent' field of both incidents to the same value
   Reveal Solution Discussion Select an answer first