4.1 Explain Incident States and Actions XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In Cortex XSOAR, which incident action is used to transfer ownership of an incident to another user or role?

   • AReopen
   • BClose
   • CAssign
   • DComment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A playbook is designed to automatically close an incident when a certain condition is met. However, the playbook fails to close the incident because the incident is in a state that does not allow the close action. Which state is most likely preventing the close action?

   • AClosed
   • BIn Progress
   • CResolved
   • DNew
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In Cortex XSOAR, what is the immediate effect of performing the Assign action on an incident that is in the New state?

   • AThe incident state changes to Resolved.
   • BThe incident state remains New, but the owner is updated to the assigned user or role.
   • CThe incident state changes to Closed.
   • DThe incident state changes to In Progress.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC team is using XSOAR and has a requirement that when an incident is closed, a notification must be sent to the incident's owner. However, the team also wants to ensure that the notification is only sent once, even if the incident is reopened and closed again. How can this be achieved?

   • AUse a global variable to track if the notification has been sent.
   • BSend the notification every time the incident is closed.
   • CConfigure the notification to be sent only on the first close by using a timer.
   • DUse a playbook that sends the notification and then sets a custom field to indicate that it has been sent.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security operations team uses XSOAR to manage incidents. They have a requirement that an incident must not be closed if it has unresolved tasks. An analyst attempts to close an incident that has an open task. The system should prevent the close action. How can this be enforced?

   • AUse a custom field to track task completion and manually verify before closing.
   • BSet the incident state to 'In Progress' and never allow closing.
   • CConfigure a playbook that checks for open tasks before closing and aborts the close if any are found.
   • DRemove the close action from all roles.
   Reveal Solution Discussion Select an answer first