XSOAR-Engineer Incident Interactions And Reporting Practice Test 2 — 15 Questions

Question 1

An analyst is reviewing an incident in Cortex XSOAR and wants to see a chronological record of all playbook task executions, including which tasks ran, their status, and timestamps, without leaving the incident view. Which feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook Task Execution Log. The Playbook Task Execution Log is designed to show a detailed, chronological list of all playbook tasks executed for an incident, including status and timestamps. It is accessible directly from the incident view, making it the correct tool for auditing task-level execution without navigating away or relying on a mixed-event timeline.

Answer

War Room timeline

Answer

Playbook Editor debug mode

Answer

Incident Timeline

Question 2

A security analyst is working on an incident in Cortex XSOAR and wants to quickly see all entries in the War Room that were generated by a specific playbook task. Which War Room filter should the analyst apply?

Accepted Answer

Filter by 'Playbook Task' and select the task name from the dropdown.. The War Room provides a filter bar with a 'Playbook Task' option, allowing analysts to select a specific task and view only its entries. This is the most efficient way to review a task's output without manually scanning the entire War Room.

Answer

Open the playbook task from the incident's Playbook tab and click 'View War Room Entries'.

Answer

Apply the 'Automation' filter and then sort by task name.

Answer

Use the search bar and type the task ID prefixed with 'task:'.

Question 3

An analyst is reviewing an incident in Cortex XSOAR and wants to see a chronological record of all playbook task executions, including which tasks ran, their status, and timestamps, without leaving the incident view. Which feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a note in the War Room and mark it as 'Read-only'.. The correct action is to add a note and mark it as 'Read-only'. Cortex XSOAR allows analysts to designate notes as read-only, ensuring they cannot be altered after posting. This provides a permanent record visible to the team. Other options like pinning or marking as internal do not enforce immutability.

Answer

Add a note in the War Room and mark it as 'Pinned'.

Answer

Add a note in the War Room and mark it as 'Evidence'.

Answer

Add a note in the War Room and mark it as 'Internal'.

Question 4

An administrator is configuring a new dashboard in Cortex XSOAR to display incident metrics for the security operations team. The dashboard must include a widget that shows the number of incidents per severity over time, and another widget that lists the top 10 incident types by count. Which TWO widget types should the administrator use to meet these requirements? (Choose two.)

Accepted Answer

Line chart. To show incidents per severity over time, a line chart is needed because it supports time-series data with multiple series. To list the top 10 incident types by count, a table widget is appropriate because it can group by incident type, sort by count, and limit rows. Together, these widget types satisfy both dashboard requirements.

Answer

Number

Answer

Bar chart

Answer

Pie chart

Question 5

A Cortex XSOAR engineer is configuring an incident layout for a new 'Insider Threat' incident type. The layout should include a tab that displays a timeline of all War Room entries related to the incident. Which TWO built-in layout elements can be used to achieve this? (Choose two.)

Accepted Answer

War Room Timeline. The War Room Timeline and War Room Entries elements are both built-in layout components that can display War Room activity. The War Room Timeline provides a chronological view, while War Room Entries can list entries in order. Together, they satisfy the requirement for a timeline of War Room entries. Other elements like Incident Details, Playbook Tasks, and Custom Script Widget do not natively provide this functionality.

Answer

Custom Script Widget

Answer

Playbook Tasks

Answer

Incident Details

Question 6

A Cortex XSOAR engineer is asked to create a new report that summarizes incidents by their close reason and includes a breakdown of the top five close reasons by count. The report should be generated weekly and sent to the security management team. Which built-in report type should the engineer use to meet these requirements?

Accepted Answer

Custom Report. The Custom Report type in Cortex XSOAR enables the creation of tailored reports using queries and aggregations. It can group incidents by close reason and calculate counts, and it supports scheduling and distribution. Incident Reports are for single incidents, Summary Reports lack close reason breakdowns, and Dashboard Reports are static exports. Thus, Custom Report is the correct choice.

Answer

Summary Report

Answer

Dashboard Report

Answer

Incident Report

Question 7

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. In Cortex XSOAR, PDF reports containing aggregated metrics such as incident closure rates are generated from the Dashboards section, where the Reports tab lets analysts schedule or run on-demand reports based on widgets and saved queries. This is the built-in reporting surface designed for management-level summaries.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 8

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. In Cortex XSOAR, incident layouts are configured under Settings > Customization > Layouts, where administrators can define which fields appear in the Incident Info section, their order, and their visibility. This is the central location for customizing how incident details are displayed for different incident types, including phishing. Changes made here apply to all incidents of the associated type.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration

Question 9

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. In Cortex XSOAR, the widget creation wizard exposes a 'Widget Type' selector that includes Bar, Line, Pie, Number, Text, and others. A pie chart visualization is produced by selecting the Pie widget type, which renders incident counts grouped by a chosen field such as severity. This is the direct mapping between the desired visualization and the widget type option.

Answer

Bar

Answer

Number

Answer

Line

Question 10

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 11

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens

Question 12

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. The XSOAR Incident WorkArea includes a search bar that accepts Lucene-style queries against incident fields. The query 'owner:me and status:Investigation' filters incidents where the current user is the owner and the status is Investigation, returning exactly the desired set without leaving the WorkArea.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 13

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget performance in XSOAR dashboards is dominated by the underlying Elasticsearch query — its time range, filter specificity, and aggregation complexity. Narrowing the time range reduces the number of indices and documents scanned, and tightening filters lets Elasticsearch use indexed fields instead of full scans. This directly reduces query latency and dashboard render time without altering the widget's purpose.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 14

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Accepted Answer

The Owner dropdown field in the incident header. In Cortex XSOAR, the incident header displays an Owner field as a dropdown that lists available users and allows the current analyst to assign the incident to themselves or others. Selecting your own username from that dropdown assigns ownership directly from the incident view.

Answer

The Close Incident button

Answer

The Playbook graph zoom button

Answer

The War Room attachment paperclip icon

Question 15

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Accepted Answer

In the integration instance configuration under Incoming Mapper. Integration instance mapper configurations handle mapping incoming raw data fields to XSOAR incident fields.

Answer

In the global Layouts customization menu

Answer

Inside the server.properties configuration file

Answer

Within the War Room CLI using the '!set-field' command