2.4 Identify and Describe Incident Creation Methods XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following integrations can automatically create incidents in XSOAR?

   • ADatabase integration
   • BScript engine
   • CSIEM integration
   • DThreat intelligence feed
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's custom security tool can send HTTP POST requests but does not support OAuth2. They want to create incidents in XSOAR from these requests. What should they use?

   • AAn email listener that receives the POST request as an email
   • BA webhook that accepts the POST request and creates an incident
   • CA scheduled job that polls the tool's API
   • DThe XSOAR API with an API key
   Reveal Solution Discussion Select an answer first
4. 13expert · hard · select all that apply

   A company uses multiple integrations to create incidents in XSOAR. They want to ensure that incidents are created consistently and without duplicates. Which of the following are valid methods to achieve this? (Select all that apply.)

   • AUse a playbook that checks for existing incidents before creating a new one
   • BManually review and merge duplicate incidents
   • CSet up a scheduled job to clean up duplicates
   • DConfigure deduplication settings in each integration that supports it
   Check answers Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of an email integration in XSOAR?

   • ATo provide a web interface for email
   • BTo send notification emails to users
   • CTo manage email server configuration
   • DTo automatically create incidents from incoming emails
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst needs to manually create an incident for a complex security event that involves multiple affected assets. They want to ensure that the incident is properly categorized and that all relevant fields are captured. What is the best practice for manual incident creation?

   • ACreate a sub-incident for each affected asset
   • BUse the API to create the incident with a script
   • CSelect the appropriate incident type and fill in all relevant fields, including custom fields, before saving
   • DCreate the incident with minimal fields and update it later
   Reveal Solution Discussion Select an answer first