2.4 Identify and Describe Incident Creation Methods XSOAR-ENGINEER Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A company uses Microsoft 365 for email and wants phishing reports from users to automatically become XSOAR incidents. The team already has the Microsoft 365 Defender integration configured and wants to minimize manual steps. Which incident creation method should they use?

   • ACreate a scheduled job that runs every 15 minutes to query the Microsoft 365 Defender API and create incidents via the 'createIncident' command
   • BInstruct users to manually create incidents in XSOAR and paste the email content
   • CConfigure the Microsoft 365 Defender integration to fetch incidents and map them to XSOAR incident types
   • DSet up an email listener that ingests forwarded phishing emails and creates incidents via classification rules
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of deduplication when converting alerts to incidents?

   • ATo merge multiple alerts into one incident
   • BTo remove sensitive data from alerts
   • CTo prevent duplicate incidents from the same alert
   • DTo reduce the size of incident data
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   Which of the following is an example of using a scheduled task to create incidents?

   • ARunning a job every hour to check for new indicators and creating an incident if any are found
   • BUpdating the XSOAR version
   • CSending a weekly report to the security team
   • DChanging the incident layout
   Reveal Solution Discussion Select an answer first