4.1 Explain Incident States and Actions XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An XSOAR administrator is configuring an incident type where an incident should automatically transition from 'New' to 'In Progress' when a specific playbook starts. However, the administrator notices that the playbook is not changing the state as expected. What is the most likely reason for this?

   • AThe playbook is not triggered automatically.
   • BThe playbook does not include a 'Set Incident' action to update the state.
   • CThe incident type does not allow the 'In Progress' state.
   • DThe analyst does not have permission to change the state.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is working on an incident that was closed prematurely by an automated playbook. After reviewing the evidence, the analyst determines the incident requires further investigation. Which action should the analyst take to continue working on the incident?

   • ACreate a new incident and copy the evidence.
   • BChange the incident type to a new type.
   • CAssign the incident to a new owner.
   • DReopen the incident.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which incident state in Cortex XSOAR is typically used to indicate that the underlying issue has been addressed but the incident record has not yet been formally closed?

   • AArchived
   • BResolved
   • CIn Progress
   • DNew
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst has completed the investigation of an incident and wants to ensure that the incident is no longer visible in the active incident list. The analyst also wants to preserve the incident data for future reference. Which action should the analyst take?

   • ADelete the incident.
   • BAssign the incident to another analyst.
   • CChange the incident type.
   • DClose the incident.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An XSOAR administrator is designing a workflow where an incident must go through a 'Pending Review' state before it can be closed. The administrator notices that the default incident states do not include 'Pending Review'. What is the most effective way to implement this requirement?

   • AUse a playbook to pause the incident and wait for approval before closing.
   • BCreate a new incident type with a custom state machine that includes 'Pending Review'.
   • CUse a custom field to track 'Pending Review' and keep the incident in 'In Progress' until the review is complete.
   • DClose the incident and reopen it after review.
   Reveal Solution Discussion Select an answer first