4.1 Explain Incident States and Actions XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In Cortex XSOAR, which incident state indicates that an analyst is actively working on the incident and it is not yet closed?

   • AResolved
   • BIn Progress
   • CNew
   • DClosed
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An XSOAR administrator is setting up a new incident type for a specific business unit. The business unit requires that incidents can only be in one of three states: 'New', 'Under Investigation', and 'Closed'. The administrator wants to ensure that the 'Under Investigation' state is used instead of the default 'In Progress'. What is the most appropriate way to configure this?

   • ARename the default 'In Progress' state to 'Under Investigation'.
   • BCreate a custom incident type with a custom state machine that includes 'Under Investigation'.
   • CMap the 'In Progress' state to 'Under Investigation' in the UI.
   • DUse a custom field to indicate 'Under Investigation' and keep the default states.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An incident in XSOAR is in the 'Resolved' state. A manager wants to document that the incident was resolved but also wants to ensure that any new related activity will trigger a new incident rather than being attached to the old one. What should the manager do?

   • AChange the incident state to 'New'.
   • BReopen the incident and then close it again.
   • CDelete the incident.
   • DLeave the incident in the 'Resolved' state.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager wants to ensure that every incident is reviewed by a senior analyst before it is closed. The manager wants to enforce this by making it impossible for a junior analyst to close an incident without senior approval. Which approach should the manager take?

   • ARemove the close action from the junior analyst's role.
   • BSet the incident state to 'In Progress' and never close it.
   • CConfigure a playbook that requires senior analyst approval before closing.
   • DAssign all incidents to senior analysts only.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An incident is in the 'Resolved' state. An analyst accidentally closes the incident instead of leaving it resolved. The analyst wants to undo this action and return the incident to the 'Resolved' state. What should the analyst do?

   • ALeave the incident closed.
   • BChange the state directly from 'Closed' to 'Resolved'.
   • CCreate a new incident and mark it as resolved.
   • DReopen the incident and then set the state to 'Resolved'.
   Reveal Solution Discussion Select an answer first