2.4 Identify and Describe Incident Creation Methods XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is typically included in a webhook request to create an incident in XSOAR?

   • AA request to delete an incident
   • BA payload containing incident data
   • CA request to list all incidents
   • DA request to update a playbook
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst receives a phone call about a security issue and needs to create an incident immediately. They are not sure of all the details yet. What is the minimum they must do to create the incident?

   • AAttach a file or evidence to the incident
   • BProvide a detailed description and assign an owner
   • CSet a severity level and due date
   • DSelect an incident type and provide a name; other fields can be filled later
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the XSOAR interface, which option is available when manually creating a new incident?

   • ADefining a new playbook from scratch
   • BSelecting an incident type
   • CModifying the global reputation settings
   • DConfiguring the SMTP server
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization uses multiple security tools that send alerts to XSOAR. They want to ensure that alerts from different sources are mapped to the correct incident types and that the incident fields are populated correctly. What should they configure?

   • AA playbook that runs after incident creation to fix field values
   • BMapping rules in the integration settings that define how alert fields map to incident fields
   • CA scheduled job that updates incident fields periodically
   • DManual adjustment of incident fields after creation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to automatically create a daily incident that summarizes the previous day's firewall logs. The summary should be generated by a playbook. Which method should they use to create this incident?

   • AConfigure an email listener to receive a daily report and create an incident
   • BUse the API to create the incident at a specific time each day
   • CCreate a scheduled job that runs daily and triggers a playbook to generate the summary and create an incident
   • DManually create the incident each day and run the playbook
   Reveal Solution Discussion Select an answer first