4.3 Explain Incident Relationships XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst is investigating a series of incidents that appear to be part of a coordinated attack. The analyst has identified a parent incident for the campaign and several child incidents for individual hosts. The analyst also finds a separate incident for a phishing email that is not directly related to the campaign but shares a similar subject line. The analyst wants to avoid confusing the investigation by linking unrelated incidents. What is the best practice for using incident relationships in this scenario?

   • ACreate a new parent incident for the phishing email and link it to the campaign
   • BLink the phishing incident to the campaign as a related incident to ensure all potential connections are visible
   • CDo not link the phishing incident to the campaign unless there is a confirmed shared indicator or root cause
   • DChange the incident type of the phishing incident to match the campaign
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A playbook creates a child incident for each user who reported a phishing email. The team wants to ensure that the parent incident's severity is automatically increased if a certain number of child incidents are created. What is the most effective way to implement this logic?

   • AManually update the parent's severity after reviewing the child incidents
   • BUse the 'CreateIncidentRelationship' automation to update the parent's severity
   • CSet the parent incident's severity to 'critical' when the first child is created
   • DAdd a script task in the playbook that counts the child incidents and updates the parent's severity if the count exceeds a threshold
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How do incident relationships aid in incident investigation?

   • ABy hiding unrelated incidents from the analyst
   • BBy automatically resolving all related incidents
   • CBy encrypting incident data for security
   • DBy providing a view of connected incidents, which helps analysts understand the scope of an attack
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is working on a parent incident and wants to quickly navigate to a specific child incident without scrolling through the entire 'Related Incidents' section. The analyst knows the child incident's ID. What is the most efficient way to open the child incident directly?

   • AUse the global search bar and enter the child incident's ID
   • BUse the 'Indicators' tab to find the child incident
   • CUse the 'War Room' to navigate to the child incident
   • DScroll through the 'Related Incidents' section and click the child incident
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key benefit of using incident relationships during response?

   • AThey allow analysts to see if an incident is part of a larger campaign
   • BThey ensure incidents are resolved in the correct order
   • CThey eliminate the need for manual investigation
   • DThey automatically block all malicious indicators
   Reveal Solution Discussion Select an answer first