XSOAR-Engineer Incident Interactions And Reporting — All Questions With Answers

Question 1hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Question 2hardmultiple choice

Read the full Ansible explanation →

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Question 3easymultiple choice

Read the full Incident Interactions And Reporting explanation →

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Question 4easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

Question 5mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to create a dashboard widget that counts only incidents where the SLA has been breached. Which query syntax should be used in the widget definition?

Question 6hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator is troubleshooting a scheduled report that fails to email its PDF output to stakeholders. Where should the administrator check first to diagnose the delivery failure?

Question 7hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

Question 8easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?

Question 9mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that specific sensitive incidents are restricted so that only members of the 'IncidentResponse' team can view or edit them. How should this be implemented?

Question 10mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO built-in fields are automatically populated when a new incident is created in Cortex XSOAR?

Question 11mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that specific incident fields are automatically populated and marked as read-only once an incident reaches the 'Containment' phase. Where should this behavior be configured?

Question 12mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager needs to grant an analyst the ability to see and edit only incidents assigned to the analyst's team, while still allowing the analyst to view the full War Room of those incidents. The manager creates a new role and assigns it to the analyst. Which Cortex XSOAR role configuration setting must be enabled to enforce this restriction?

Question 13hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is investigating a phishing incident in Cortex XSOAR and wants to share a summary of the investigation with a colleague who does not have access to the incident. The analyst decides to create a link to the incident that includes a read-only view of the War Room entries. Which Cortex XSOAR feature should the analyst use to generate this link?

Question 14mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing a high-severity phishing incident in Cortex XSOAR. The incident was ingested from an email integration instance. The analyst wants to add a tagged entry to the War Room that explicitly marks a specific command output as 'evidence' for later audit purposes. Which action should the analyst take?

Question 15easymultiple choice

Read the full Ansible explanation →

A security analyst is working on an incident in Cortex XSOAR and wants to quickly see all the playbook tasks that are currently waiting for manual input. Which view in the incident should the analyst use to identify these tasks?

Question 16mediummultiple choice

Read the full Ansible explanation →

An analyst is reviewing an incident in Cortex XSOAR and wants to see a chronological record of all playbook task executions, including which tasks ran, their status, and timestamps, without leaving the incident view. Which feature should the analyst use?

Question 17easymultiple choice

Read the full Ansible explanation →

A security analyst is working on an incident in Cortex XSOAR and wants to quickly see all entries in the War Room that were generated by a specific playbook task. Which War Room filter should the analyst apply?

Question 18mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing an incident in Cortex XSOAR and needs to document a critical finding that should be visible to all team members but not editable by them. The analyst wants to ensure the entry is prominently displayed and cannot be modified after posting. Which action should the analyst take?

Question 19hardmulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring a new dashboard in Cortex XSOAR to display incident metrics for the security operations team. The dashboard must include a widget that shows the number of incidents per severity over time, and another widget that lists the top 10 incident types by count. Which TWO widget types should the administrator use to meet these requirements? (Choose two.)

Question 20mediummulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is configuring an incident layout for a new 'Insider Threat' incident type. The layout should include a tab that displays a timeline of all War Room entries related to the incident. Which TWO built-in layout elements can be used to achieve this? (Choose two.)

Question 21hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is asked to create a new report that summarizes incidents by their close reason and includes a breakdown of the top five close reasons by count. The report should be generated weekly and sent to the security management team. Which built-in report type should the engineer use to meet these requirements?

Question 22easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Question 23mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Question 24easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Question 25mediummultiple choice

Read the full Ansible explanation →

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Question 26mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Question 27easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Question 28hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Question 29easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Question 30mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Question 31hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Question 32mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Question 33mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Question 34hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

Question 35easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Question 36hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Question 37mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Question 38hardmulti select

Read the full Incident Interactions And Reporting explanation →

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Question 39mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Question 40easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Question 41easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO pieces of information are displayed prominently in the incident header by default?

Question 42mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Question 43hardmulti select

Read the full Ansible explanation →

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Question 44hardmulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Question 45easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Question 46mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Question 47easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO actions can an analyst perform within the Incident War Room?

Question 48hardmulti select

Read the full Incident Interactions And Reporting explanation →

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Question 49mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Question 50hardmulti select

Read the full Incident Interactions And Reporting explanation →

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Question 51mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Question 52hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

Question 53easymultiple choice

Read the full Ansible explanation →

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Question 54hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Question 55easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

Question 56mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

Question 57hardmulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

Question 58mediummulti select

Read the full Incident Interactions And Reporting explanation →

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Question 59hardmulti select

Read the full Incident Interactions And Reporting explanation →

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

Question 60mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

Question 61easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

Question 62mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Question 63mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

Question 64easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Question 65hardmulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

Question 66mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Question 67mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

Question 68mediummulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

Question 69easymultiple choice

Read the full Ansible explanation →

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

Question 70hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

Question 71hardmulti select

Read the full Ansible explanation →

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

Question 72easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Question 73mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

Question 74mediummulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

Question 75easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

Question 76hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is investigating a live incident and needs to share a set of indicators with an external partner without exposing internal notes or the full incident timeline. The analyst must produce a file that the partner can import into their own Cortex XSOAR instance. What should the analyst do?

Question 77mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that when an incident is closed in Cortex XSOAR, a summary report is automatically generated and attached to the incident as a text file. Which feature should the administrator configure to achieve this?

Question 78easymultiple choice

Read the full Incident Interactions And Reporting explanation →

During an active incident, an analyst wants to tag the incident with a custom label 'VIP-Customer' so that other team members can quickly filter and find it later. Where should the analyst add this label in Cortex XSOAR?

Question 79hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Question 80hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator is building a custom dashboard widget that must show the number of open incidents grouped by severity for the current week, updating automatically as incidents change. Which widget configuration should the administrator use?

Question 81mediummultiple choice

Read the full Ansible explanation →

An analyst is reviewing a closed phishing incident and wants to see, in the War Room, which playbook tasks executed and in what order, including the inputs and outputs of each task. Which War Room tab should the analyst use to review this structured, step-by-step record of the playbook run?

Question 82hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer needs a recurring report that delivers a PDF summarizing incident metrics to an external distribution list every Monday at 08:00. The engineer creates a scheduled report and must now ensure the recipient addresses, format, and recurrence are all honored. Which configuration element in the scheduled report definition controls the recurring schedule?

Question 83easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator wants to provide analysts with a quick way to view all open incidents that are assigned to them and have a severity of 'High' or 'Critical'. Which built-in feature should the administrator configure?

Question 1hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Question 2hardmultiple choice

Read the full Ansible explanation →

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Question 3easymultiple choice

Read the full Incident Interactions And Reporting explanation →

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Question 4easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

Question 5mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to create a dashboard widget that counts only incidents where the SLA has been breached. Which query syntax should be used in the widget definition?

Question 6hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator is troubleshooting a scheduled report that fails to email its PDF output to stakeholders. Where should the administrator check first to diagnose the delivery failure?

Question 7hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

Question 8easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?

Question 9mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that specific sensitive incidents are restricted so that only members of the 'IncidentResponse' team can view or edit them. How should this be implemented?

Question 10mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO built-in fields are automatically populated when a new incident is created in Cortex XSOAR?

Question 11mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that specific incident fields are automatically populated and marked as read-only once an incident reaches the 'Containment' phase. Where should this behavior be configured?

Question 12mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager needs to grant an analyst the ability to see and edit only incidents assigned to the analyst's team, while still allowing the analyst to view the full War Room of those incidents. The manager creates a new role and assigns it to the analyst. Which Cortex XSOAR role configuration setting must be enabled to enforce this restriction?

Question 13hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is investigating a phishing incident in Cortex XSOAR and wants to share a summary of the investigation with a colleague who does not have access to the incident. The analyst decides to create a link to the incident that includes a read-only view of the War Room entries. Which Cortex XSOAR feature should the analyst use to generate this link?

Question 14mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing a high-severity phishing incident in Cortex XSOAR. The incident was ingested from an email integration instance. The analyst wants to add a tagged entry to the War Room that explicitly marks a specific command output as 'evidence' for later audit purposes. Which action should the analyst take?

Question 15easymultiple choice

Read the full Ansible explanation →

A security analyst is working on an incident in Cortex XSOAR and wants to quickly see all the playbook tasks that are currently waiting for manual input. Which view in the incident should the analyst use to identify these tasks?

Question 16mediummultiple choice

Read the full Ansible explanation →

An analyst is reviewing an incident in Cortex XSOAR and wants to see a chronological record of all playbook task executions, including which tasks ran, their status, and timestamps, without leaving the incident view. Which feature should the analyst use?

Question 17easymultiple choice

Read the full Ansible explanation →

A security analyst is working on an incident in Cortex XSOAR and wants to quickly see all entries in the War Room that were generated by a specific playbook task. Which War Room filter should the analyst apply?

Question 18mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing an incident in Cortex XSOAR and needs to document a critical finding that should be visible to all team members but not editable by them. The analyst wants to ensure the entry is prominently displayed and cannot be modified after posting. Which action should the analyst take?

Question 19hardmulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring a new dashboard in Cortex XSOAR to display incident metrics for the security operations team. The dashboard must include a widget that shows the number of incidents per severity over time, and another widget that lists the top 10 incident types by count. Which TWO widget types should the administrator use to meet these requirements? (Choose two.)

Question 20mediummulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is configuring an incident layout for a new 'Insider Threat' incident type. The layout should include a tab that displays a timeline of all War Room entries related to the incident. Which TWO built-in layout elements can be used to achieve this? (Choose two.)

Question 21hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is asked to create a new report that summarizes incidents by their close reason and includes a breakdown of the top five close reasons by count. The report should be generated weekly and sent to the security management team. Which built-in report type should the engineer use to meet these requirements?

Question 22easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Question 23mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Question 24easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Question 25mediummultiple choice

Read the full Ansible explanation →

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Question 26mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Question 27easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Question 28hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Question 29easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Question 30mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Question 31hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Question 32mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Question 33mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Question 34hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

Question 35easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Question 36hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Question 37mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Question 38hardmulti select

Read the full Incident Interactions And Reporting explanation →

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Question 39mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Question 40easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Question 41easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO pieces of information are displayed prominently in the incident header by default?

Question 42mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Question 43hardmulti select

Read the full Ansible explanation →

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Question 44hardmulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Question 45easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Question 46mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Question 47easymulti select

Read the full Incident Interactions And Reporting explanation →

Which TWO actions can an analyst perform within the Incident War Room?

Question 48hardmulti select

Read the full Incident Interactions And Reporting explanation →

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Question 49mediummulti select

Read the full Incident Interactions And Reporting explanation →

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Question 50hardmulti select

Read the full Incident Interactions And Reporting explanation →

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Question 51mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Question 52hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

Question 53easymultiple choice

Read the full Ansible explanation →

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Question 54hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Question 55easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

Question 56mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

Question 57hardmulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

Question 58mediummulti select

Read the full Incident Interactions And Reporting explanation →

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Question 59hardmulti select

Read the full Incident Interactions And Reporting explanation →

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

Question 60mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

Question 61easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

Question 62mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Question 63mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

Question 64easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Question 65hardmulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

Question 66mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Question 67mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

Question 68mediummulti select

Read the full Incident Interactions And Reporting explanation →

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

Question 69easymultiple choice

Read the full Ansible explanation →

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

Question 70hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

Question 71hardmulti select

Read the full Ansible explanation →

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

Question 72easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Question 73mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

Question 74mediummulti select

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

Question 75easymultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

Question 76hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is investigating a live incident and needs to share a set of indicators with an external partner without exposing internal notes or the full incident timeline. The analyst must produce a file that the partner can import into their own Cortex XSOAR instance. What should the analyst do?

Question 77mediummultiple choice

Read the full Incident Interactions And Reporting explanation →

An administrator wants to ensure that when an incident is closed in Cortex XSOAR, a summary report is automatically generated and attached to the incident as a text file. Which feature should the administrator configure to achieve this?

Question 78easymultiple choice

Read the full Incident Interactions And Reporting explanation →

During an active incident, an analyst wants to tag the incident with a custom label 'VIP-Customer' so that other team members can quickly filter and find it later. Where should the analyst add this label in Cortex XSOAR?

Question 79hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Question 80hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator is building a custom dashboard widget that must show the number of open incidents grouped by severity for the current week, updating automatically as incidents change. Which widget configuration should the administrator use?

Question 81mediummultiple choice

Read the full Ansible explanation →

An analyst is reviewing a closed phishing incident and wants to see, in the War Room, which playbook tasks executed and in what order, including the inputs and outputs of each task. Which War Room tab should the analyst use to review this structured, step-by-step record of the playbook run?

Question 82hardmultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR engineer needs a recurring report that delivers a PDF summarizing incident metrics to an external distribution list every Monday at 08:00. The engineer creates a scheduled report and must now ensure the recipient addresses, format, and recurrence are all honored. Which configuration element in the scheduled report definition controls the recurring schedule?

Question 83easymultiple choice

Read the full Incident Interactions And Reporting explanation →

A Cortex XSOAR administrator wants to provide analysts with a quick way to view all open incidents that are assigned to them and have a severity of 'High' or 'Critical'. Which built-in feature should the administrator configure?