4.1 Explain Incident States and Actions XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An XSOAR administrator is configuring a new incident type. The requirement is that when an analyst starts working on an incident, the state must change from 'New' to 'In Progress' automatically. Which action should be configured to achieve this?

   • AAssign the incident to an analyst.
   • BAdd a comment to the incident.
   • CChange the incident severity.
   • DSet the incident state to 'In Progress'.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An incident is currently in the 'Closed' state. A new piece of evidence emerges that is directly related to this incident. The analyst wants to incorporate this evidence into the original incident rather than creating a new one. What should the analyst do first?

   • AAdd a note to the closed incident.
   • BReopen the incident.
   • CChange the incident state to 'Resolved'.
   • DCreate a new incident and link it to the original.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which incident action in Cortex XSOAR is used to change a closed incident back to an active state so that work can continue?

   • ADelete
   • BReopen
   • CAssign
   • DClose
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In Cortex XSOAR, which action triggers the transition of an incident from the Closed state back to an active state?

   • AResolve
   • BReopen
   • CAssign
   • DComment
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is working on an incident that is in the 'In Progress' state. The analyst wants to pass the incident to a colleague for a second opinion, but the colleague should not be able to close the incident. The analyst also wants to ensure that the incident remains in the 'In Progress' state. What should the analyst do?

   • AAssign the incident to the colleague and keep the state as 'In Progress'.
   • BClose the incident and assign it to the colleague.
   • CChange the incident state to 'New' and assign it to the colleague.
   • DReopen the incident and assign it to the colleague.
   Reveal Solution Discussion Select an answer first