2.4 Identify and Describe Incident Creation Methods XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What authentication method is typically used when creating an incident via the XSOAR API?

   • AAPI key
   • BClient certificate
   • CUsername and password in the request body
   • DOAuth2 client credentials
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company uses a custom SIEM that can send HTTP POST requests to XSOAR. They want to create incidents from SIEM alerts, but they also need to ensure that the incidents are created with the correct severity and type based on the alert content. What should they do?

   • AConfigure a webhook that receives the POST request and uses mapping rules to set incident fields
   • BUse the XSOAR API to create incidents and manually set the fields
   • CUse an email listener and parse the SIEM's email alerts
   • DCreate a scheduled job that polls the SIEM's API
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which HTTP method is used to create a new incident via the XSOAR API?

   • AGET
   • BDELETE
   • CPUT
   • DPOST
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the role of classification rules in email ingestion for incident creation?

   • ATo forward emails to external systems
   • BTo determine which incident type to assign to an email
   • CTo encrypt email messages
   • DTo filter out spam emails
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to automatically create incidents from emails sent to a specific mailbox (e.g., security@company.com). The emails are in various formats and need to be classified into different incident types. Which feature should they configure?

   • AAn API endpoint that receives forwarded emails
   • BA scheduled job that checks the mailbox every minute and creates incidents
   • CA webhook that receives email notifications
   • DEmail listener with classification rules that parse the email and map it to the appropriate incident type
   Reveal Solution Discussion Select an answer first