XSOAR-Engineer practice questions 1–10

1. Question 1 · 13 in bank

   Select 2

   Which two behaviors occur while an incident is closed? (Choose two.)

   • APlaybook is marked as complete.
   • BCommands cannot be executed in the War Room.
   • CTimers can no longer run.
   • DRunning timers are in a paused state.

   Show answer

   Answer: AB

   Next question

2. Question 2 · 13 in bank

   Based on the image below, how is the Domain Admin name selected when the country is "US"?

   

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: C

   Next question

3. Question 3 · 13 in bank

   An engineer adds a new "Forensics" tab that includes several sections for detailed artifact analysis to the "Malware Incident" layout. However, junior analysts report they cannot see this tab, while senior analysts can. Which configuration setting is the most likely reason for this discrepancy?

   • AThe underlying fields within the tab sections was incorrectly mapped.
   • BThe tab was not added to the junior analyst role group.
   • CThe tab was marked as read-only in the layout configuration for the junior analyst roles.
   • DA display filter was applied to the tab in the layout editor.

   Show answer

   Answer: D

   Next question

4. Question 4 · 13 in bank

   An organization defines Mean Time To Resolve (MTTR) as the mean time duration that an incident was open. Which widget options will generate a line graph widget showing the MTTR by incident severity like the image below?

   

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: D

   Next question

5. Question 5 · 13 in bank

   In a Dev/Prod deployment model, what is available only in the development tenant?

   • AMarketplace
   • BContent Repository page
   • CCustom integration instances
   • D"Export all custom content" feature

   Show answer

   Answer: B

   Next question

6. Question 6 · 13 in bank

   When re-assigning an existing incident to a new incident type, an engineer is concerned about the preservation of critical data currently stored in fields that are only associated to the original incident type. Upon making the change, in which state will the critical data be in the now unassociated fields?

   • AHidden from the Context Data but accessible
   • BVisible within Context Data and fully accessible
   • CVisible with Context Data, grayed out, and fully accessible
   • DHidden from Context Data and no longer accessible

   Show answer

   Answer: B

   Next question

7. Question 7 · 13 in bank

   Based on the image below, what will be the type of this new incident?

   

   • ACortex XDR Incident - Quasar
   • BCortex XDR Incident
   • CUnclassified
   • DDefault

   Show answer

   Answer: A

   Next question

8. Question 8 · 13 in bank

   Within the playbook editor, which function allows a user to associate a task output to an incident field?

   • AClassification
   • BInputs
   • CExtend context
   • DMapping

   Show answer

   Answer: C

   Next question

9. Question 9 · 13 in bank

   Two feed integrations with the same source reliability (B - Usually reliable) fetch the same indicator with the following verdicts: Integration A - Malicious - Integration B - Benign - Indicator data from Integration B was fetched after Integration A. What will be the values of the fields associated with the indicator?

   • AVerdict: Malicious - Other Fields: Values from Integration A
   • BVerdict: Malicious - Other Fields: Values from Integration B
   • CVerdict: Benign - Other Fields: Values from Integration A
   • DVerdict: Benign - Other Fields: Values from Integration B

   Show answer

   Answer: D

   Next question

10. Question 10 · 13 in bank

    Based on the image below, which key from the context points to the string GOGL?

    

    • AWhois.IP.asn_registry.entities
    • BWhois.IP.[0].network.name
    • CWhois.IP.network.name
    • DWhois.IP.entities

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSOAR-Engineer practice, question 1. 13 questions available.