XSOAR-Engineer Incident Interactions And Reporting Practice Test 5 — 15 Questions

Question 1

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

Accepted Answer

Type @ followed by the teammate's username.. The War Room uses the @ symbol to mention users. When an analyst types @ and selects a username, Cortex XSOAR creates a mention that notifies the user and ties the entry to their account, which is the correct way to direct an incident update to a specific teammate.

Answer

Type # followed by the teammate's username.

Answer

Type the teammate's username preceded by a forward slash.

Answer

Type the teammate's email address enclosed in square brackets.

Question 2

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Accepted Answer

Incident closure layout with a required 'Close Notes' field for the relevant classification.. Closure layouts control the fields presented when closing an incident and can mark specific fields as required. Configuring the closure layout so Close Notes is mandatory for the False Positive classification ensures the rationale is captured before closure completes.

Answer

Incident field of type 'Long Text' with a validation regex that rejects empty values.

Answer

Playbook task that sends an email to the manager whenever an incident is closed.

Answer

Dashboard widget that counts incidents closed without notes and alerts the SOC manager.

Question 3

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

Accepted Answer

The 'Tasks' view in the War Room filter dropdown. The War Room filter dropdown includes a Tasks view that limits the timeline to playbook task-related entries. For a phishing incident with many automated commands, this view lets the responder review task inputs, outputs, and completion status without sifting through command results and notes, which is exactly what is required here.

Answer

The 'Notes' view in the War Room filter dropdown

Answer

The 'Evidence' view in the War Room filter dropdown

Answer

The 'Chat' view in the War Room filter dropdown

Question 4

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Accepted Answer

Assign the incident to the shift lead using the Owner field. Ownership transfer in Cortex XSOAR is performed through the Owner field on the incident. Setting the Owner to the shift lead makes that analyst the acknowledged owner, sends an in-app notification, and records the change in the incident audit trail, satisfying the handoff requirement for the malware containment incident.

Answer

Add the shift lead as a collaborator on the incident

Answer

Move the incident to a different investigation queue

Answer

Mention the shift lead with @ in a War Room note

Question 5

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Apply an incident filter that selects only incidents carrying the 'VIP' label within the previous week's date range. A scheduled report needs two things to satisfy this scenario: a weekly cadence set to Monday 07:00, and an incident filter that restricts content to VIP-labeled incidents from the prior week. Together these deliver the correct data at the correct time, meeting the SOC manager's recurring summary requirement.

Answer

Configure a War Room entry to trigger the report on demand from a playbook task

Answer

Set the report output format to CSV instead of PDF for easier metric parsing

Answer

Enable the 'include raw evidence' checkbox on the report template

Question 6

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Accepted Answer

Incident type playbook with an initial 'addWarRoomEntry' task. Because the link must appear automatically inside each new Phishing incident's War Room, the mechanism has to write a War Room entry during incident creation. Attaching a playbook to the incident type and including a task that calls addWarRoomEntry accomplishes exactly that, runs without analyst intervention, and keeps the runbook link consistent across every Phishing incident.

Answer

Incident field 'Details' populated by a classification mapping

Answer

Incident type layout with a War Room entry template

Answer

Custom dashboard widget filtered on incident type

Question 7

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

Accepted Answer

Use the War Room search box to filter entries by the command name or keyword. The War Room search box is the intended tool for locating specific entries in a long timeline. By entering the command name or a relevant keyword, the analyst can filter the closed ransomware incident's War Room to the exact execution entry, revealing the executing analyst and timestamp without manually scrolling hundreds of entries.

Answer

Rebuild the incident playbook to re-run the containment task and observe the output

Answer

Export the incident to PDF and search the document for the command name

Answer

Open the incident's Playbook tab and inspect each task's inputs and outputs

Question 8

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

Accepted Answer

Line chart. The correct widget types are line chart and bar chart. A line chart effectively shows trends in resolution times over time, while a bar chart displays analyst workload distribution. These visualizations directly address the administrator's goal of monitoring performance trends and workload. Other chart types are less suitable for these specific analytical needs.

Answer

Pie chart

Answer

Table chart

Answer

Number chart

Question 9

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

Accepted Answer

The War Room with the 'Commands and Results' filter applied. The War Room conversation is the chronological record of everything happening in an incident, including automation command executions and their returned data. Filtering that conversation to Commands and Results isolates the technical entries, giving the analyst both the command that ran and the raw JSON response from the integration in one continuous timeline.

Answer

The Playbook task list, which enumerates every task and its status

Answer

The Notes tab, which lists analyst annotations in creation order

Answer

The incident's Context Data tab, which shows the unified context tree

Question 10

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

Accepted Answer

Place the custom field group in a section and mark the section as expanded by default. Incident layouts are composed of sections that can be rendered expanded or collapsed. Configuring the section containing the department, manager, and compliance tier fields to be expanded by default makes those values immediately visible when the Data Breach incident is opened, which is exactly the prominent display the engineer needs.

Answer

Add the fields to the incident's War Room as a formatted note on creation

Answer

Add the custom fields to the incident's Quick View and rely on hover tooltips

Answer

Create a new incident type for Data Breach and attach the fields to the type definition

Question 11

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

Accepted Answer

Configure a report template that selects incident fields, task summaries, and notes sections. A curated post-incident artifact requires both a report template that defines which sections appear and the act of generating that report from the incident itself. The template controls inclusion of incident fields, playbook task summaries, and analyst notes while excluding raw JSON, and report generation turns that template into a shareable document for stakeholders.

Answer

Use the War Room 'Download as PDF' option on the unfiltered conversation

Answer

Create a dashboard widget showing incident severity distribution for the month

Answer

Export the incident context to a JSON file and email it to stakeholders

Question 12

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Accepted Answer

Typing the remark into the War Room input box and pressing Enter to post a note. Posting free text in the War Room input box creates an analyst-attributed, timestamped note in the shared incident conversation, which is immediately visible to the whole team. It requires no command execution and preserves the analyst's rationale alongside the rest of the incident timeline, making it the appropriate action for this scenario.

Answer

Editing the incident's Details field from the incident summary panel

Answer

Adding a tag to the incident from the incident header

Answer

Running the '!setIncident' command with a custom field for the remark

Question 13

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

Accepted Answer

Add a War Room entry task to the Phishing playbook that uses the domain reputation command and posts formatted markdown.. Automatic, per-incident War Room content is produced by playbook tasks, not by incident fields or scheduled jobs. A War Room entry task in the Phishing playbook runs on trigger and can format command output into markdown for the analyst. Because the playbook is bound to the incident type, every new Phishing incident receives the entry without any manual step.

Answer

Configure a scheduled job that queries the Phishing incidents and posts a note via the API every hour.

Answer

Create a custom incident field with type 'HTML' and set its default value to the reputation data.

Answer

Enable the 'Auto-extract indicators' setting on the Phishing integration instance so indicators are enriched and shown in the War Room.

Question 14

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create the 'BusinessUnit' field in Settings > Advanced > Fields and assign it a type such as 'Short text'.. Making a custom field visible and editable for one incident type requires two actions: define the field in the Fields repository, then place it on that incident type's layout with editability enabled. Mapping rules and playbook inputs operate on values, not on layout presentation, so they cannot substitute for these two configuration steps.

Answer

Add the 'BusinessUnit' field to the default incident type layout and hide it via field-level permissions.

Answer

Enable the 'BusinessUnit' field in the Malware playbook as a task input so analysts can edit it during investigation.

Answer

Create a classification and mapping rule that maps the 'BusinessUnit' field from the integration to the incident.

Question 15

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

Accepted Answer

Right-click context menu on the field value. The right-click context menu on a field value in the incident details pane provides a quick way to search for other incidents sharing that value. This is an interactive feature that enables analysts to pivot from a specific incident to related ones without leaving the incident view or manually crafting a query.

Answer

Dashboard widget filtered by incident type

Answer

Incident search bar with a free-text query

Answer

Playbook task to query incidents