Incident Interactions And Reporting practice questions

Modify the integration code to retroactively scrub historical database entries

Why it fails: Integration code execution does not retroactively modify past database records automatically without custom DB queries.

Lock the incident, which automatically sanitizes all War Room text matching regex patterns

Why it fails: Locking an incident prevents modifications; it does not sanitize historical text.

Run the '!clear-war-room-secrets' command with the entry ID

Why it fails: There is no built-in command named '!clear-war-room-secrets'.

Restart the entire XSOAR server container to reset playbook state machines

Why it fails: Restarting the server is disruptive and does not provide granular task-level override.

Type '!force-playbook-task' directly in the War Room CLI without parameters

Why it fails: No such generic command exists without specifying task IDs or arguments.

Edit the incident type schema to automatically convert all conditional tasks to automatic

Why it fails: Changing the incident type schema alters future instances, not the current running instance's state.

The Threat Intel tab

Why it fails: Threat Intel manages indicators and feeds globally.

Settings > About

Why it fails: Settings > About displays software version and license information.

Use the '!private-note' automation command

Why it fails: There is no built-in '!private-note' command by default.

Export the incident to an encrypted ZIP file

Why it fails: Exporting to ZIP is an administrative archival task, not a way to add notes.

Navigate to Settings > Security > War Room Encryption

Why it fails: No such menu path exists for posting individual notes.

status:closed and severity:high

Why it fails: This query filters by closure and severity, ignoring SLA breach status.

duedate > now

Why it fails: 'duedate > now' represents incidents whose SLA has not yet expired, not breached incidents.

sla:expired

Why it fails: 'sla' is not the correct field name; 'slastatus' is the standard XSOAR field.

The Incident War Room of the report creator

Why it fails: Scheduled reports run system-level tasks and do not log output to individual user War Rooms.

The browser developer tools console while viewing the dashboard

Why it fails: Browser console only shows client-side UI events, not backend scheduled report execution errors.

Settings > Integrations > Instances > Mail Sender status

Why it fails: While mail sender integration is relevant, the definitive execution error log resides in the core Server Logs.

Multi-select fields are not supported in custom incident types

Why it fails: MultiSelect fields are fully supported in custom incident types, so this cause is false. The real issue is usually a misconfigured field definition or missing option values. It tempts because custom incident types do restrict some field types, but MultiSelect is not among them.

All multi-select fields require an active threat intelligence feed license

Why it fails: MultiSelect fields are a standard incident field type and need no threat intelligence licence; licensing does not restrict how many options an analyst can tick. It is tempting because XSOAR integrations are licensed, and would apply where a field genuinely depends on an enrichment feed.

The database index for multi-select fields must be rebuilt via CLI using '!rebuild-index'

Why it fails: No such CLI command exists for multi-select fields, and index rebuilding does not govern option selection in the incident form. It is tempting because index commands do resolve some search and display faults, and would be relevant if incidents failed to appear in query results.

active:false and duration<1d

Why it fails: While filtering active:false works for closed, duration<1d is not the standard relative time syntax for closure.

status:closed and time:today

Why it fails: 'time:today' is not a valid XSOAR query filter operator.

closeddate:past-day

Why it fails: 'closeddate' with 'past-day' is not standard query syntax.

Turn off the REST API server for all non-admin users

Why it fails: Disabling the REST API blocks programmatic access for everyone, not just non-IncidentResponse users, and it leaves the web UI and GraphQL queries fully open. It is tempting because the API is a genuine access path, so disabling it would be correct for cutting off integrations or automation entirely during a lock-down.

Password-protect each individual incident via the War Room header

Why it fails: A War Room password gates the collaboration interface only; it does not stop users opening the incident, editing fields, or viewing data through other views and APIs. Password protection is tempting because it genuinely restricts War Room entry for ad-hoc sharing, which would suit limiting a specific investigation's chat to named participants.

Encrypt the incident database table using AES-256 keys

Why it fails: AES-256 encryption at the database layer protects data at rest but grants no per-incident access control; any authenticated user querying the table still sees every row. Encryption is tempting because it genuinely secures stored data against theft or disk compromise, which would be correct for protecting confidentiality of the underlying storage, not for restricting team visibility.

Vehicle license plate number

Why it fails: Vehicle data is unrelated to XSOAR.

Frequent flyer miles balance

Why it fails: Frequent flyer data is unrelated to XSOAR.

Employee payroll identification number

Why it fails: Payroll numbers are HR data, not XSOAR incident fields.

In the Incident Types settings under the 'Mandatory Fields' tab.

Why it fails: Incident Types define matching rules and default playbooks, whereas Layouts control the form presentation and field behavior.

In the Server Configuration under the 'incident.readonly.phases' parameter.

Why it fails: Field-level read-only constraints per phase are managed inside Layouts, not global server configuration parameters.

In the Automation script parameters for the containment playbook task.

Why it fails: Playbook tasks execute logic but do not directly define form layout field properties like read-only states.

Enable 'War Room' permission and configure a custom incident type filter.

Why it fails: 'War Room' permission controls access to the War Room interface but does not restrict which incidents an analyst can see. Custom incident type filters are used for dashboard and widget filtering, not for RBAC. This configuration would not limit the analyst to their team's incidents, leaving all incidents visible.

Enable 'Incident' permission and set the role's incident access to 'All' scope.

Why it fails: Setting incident access to 'All' scope grants the analyst visibility into every incident in the tenant, not just their team's incidents. This violates the principle of least privilege and does not meet the manager's requirement. The 'Incident' permission alone does not restrict scope; the scope setting must be 'Team' to enforce the restriction.

Enable 'Playbook' permission and set the role's incident access to 'Owner' scope.

Why it fails: 'Playbook' permission governs the ability to run and edit playbooks, not incident visibility. Setting incident access to 'Owner' scope would restrict the analyst to only incidents they own, not their entire team's incidents. This is too restrictive and does not match the requirement to see team incidents.

Enable 'Anonymous Access' for the incident in the incident's settings.

Why it fails: Cortex XSOAR does not support 'Anonymous Access' for individual incidents. Access control is managed through roles and permissions, and there is no per-incident setting to allow anonymous viewing. This option is not a valid feature and would not achieve the desired sharing.

Use the 'Share' button in the incident's toolbar to create a shareable link.

Why it fails: The 'Share' button in the incident toolbar is used to share the incident with other Cortex XSOAR users, not to create a read-only link for external users. It does not generate a link that can be accessed without authentication. This option does not fulfill the requirement of sharing with a colleague who lacks access.

Generate a 'Public Link' from the incident's War Room menu.

Why it fails: Cortex XSOAR does not have a native 'Public Link' feature for sharing War Room entries with external users. While some integrations allow sharing via third-party services, there is no built-in button to create a read-only public link. The analyst would need to export the War Room or use a different sharing method.

Run the '!mark-evidence' command from the CLI to flag the last command result.

Why it fails: There is no built-in '!mark-evidence' command in Cortex XSOAR. Commands are provided by integrations and playbooks; tagging is a UI-level action, not a CLI command. The analyst must use the War Room interface to add and tag entries.

Use the 'Export to PDF' option in the War Room to save the entry with an evidence watermark.

Why it fails: Exporting to PDF creates a static report; it does not tag the entry in the War Room. The watermark feature does not exist for evidence marking. Tagging must be done directly on the entry to maintain a searchable, interactive audit trail.

Edit the incident's custom fields to add an 'Evidence' field and paste the command output there.

Why it fails: Custom fields are for structured incident data, not for annotating specific War Room entries. While you could create a field, it would not tag the entry itself and would not provide the same audit trail or filtering capability as a tagged War Room entry.

The 'Incident Details' tab, checking the 'Tasks' section.

Why it fails: The 'Incident Details' tab shows incident metadata such as severity, type, and custom fields. It does not list playbook tasks or their statuses. While some custom fields might track tasks, there is no native 'Tasks' section in Incident Details that shows pending manual tasks.

The 'Dashboard' tab, using the 'Pending Tasks' widget.

Why it fails: The 'Dashboard' tab provides high-level metrics and widgets, but it does not show a detailed list of pending tasks for a specific incident. While dashboards can be customized, there is no default 'Pending Tasks' widget that lists manual tasks for the current incident. This view is not designed for task-level management.

The 'War Room' tab, searching for 'manual' in the entries.

Why it fails: The 'War Room' tab contains all entries, including automated commands and manual notes. Searching for 'manual' might return unrelated entries and does not provide a structured view of pending tasks. It is inefficient and may miss tasks that do not contain the word 'manual' in their description.

War Room timeline

Why it fails: The War Room timeline displays entries such as notes, commands, and playbook task completions, but it interleaves them with analyst communications and does not provide a dedicated tabular view of playbook task executions with precise status and timestamps. To see only task-level execution details in a structured format, the analyst should use a different feature.

Playbook Editor debug mode

Why it fails: Debug mode in the Playbook Editor is used during playbook development to step through tasks manually and inspect inputs and outputs. It is not a reporting or monitoring feature for live incidents and requires opening the editor separately, so it does not provide the in-incident chronological execution record the analyst needs.

Incident Timeline

Why it fails: The Incident Timeline shows a chronological sequence of incident-level events such as creation, field changes, and status updates, but it does not break down individual playbook task executions. It is useful for auditing incident lifecycle events, not for inspecting the granular progress and status of each playbook task.

Open the playbook task from the incident's Playbook tab and click 'View War Room Entries'.

Why it fails: While the Playbook tab shows task status, it does not have a 'View War Room Entries' button that filters the War Room. The War Room filter is the intended mechanism. This option describes a non-existent feature, so it is incorrect.

Apply the 'Automation' filter and then sort by task name.

Why it fails: The 'Automation' filter shows entries from automated commands, but it does not group or filter by specific playbook task. Sorting by task name is not a standard option. This method would not reliably isolate entries from one task.

Use the search bar and type the task ID prefixed with 'task:'.

Why it fails: The War Room search bar does not support a 'task:' prefix for filtering by task ID. While you can search for text, there is no dedicated syntax for task IDs. The correct approach is to use the built-in filter dropdown for playbook tasks.

Add a note in the War Room and mark it as 'Pinned'.

Why it fails: Pinning a note in the War Room makes it easily accessible at the top of the War Room, but it does not prevent editing. Other users with appropriate permissions can still edit or delete the note. Pinning is for visibility, not for immutability.

Add a note in the War Room and mark it as 'Evidence'.

Why it fails: Marking a note as 'Evidence' categorizes it for evidentiary purposes, but it does not make it read-only. Evidence notes can still be edited or deleted by users with permissions. This option is about categorization, not immutability.

Add a note in the War Room and mark it as 'Internal'.

Why it fails: Marking a note as 'Internal' restricts visibility to users within the organization, but it does not make the note read-only. Users with edit permissions can still modify internal notes. This option addresses visibility scope, not immutability.

Number

Why it fails: A number widget displays a single aggregated value, such as total incident count. It cannot show trends over time or a ranked list of multiple incident types. It is useful for key performance indicators but does not meet either of the stated dashboard requirements.

Bar chart

Why it fails: A bar chart displays categorical data as bars but is not ideal for showing trends over time with multiple series. While it can show counts per severity, it does not natively support a continuous time axis with multiple lines, making it less suitable for the time-series requirement. It could be used for the top 10 list, but a different widget is better for ranking.

Pie chart

Why it fails: A pie chart shows proportions of a whole for a single point in time, not trends over time. It cannot display the number of incidents per severity over a time range with multiple data points. While it could show the distribution of incident types, it does not easily convey a ranked top 10 list with counts.

Custom Script Widget

Why it fails: A Custom Script Widget allows embedding custom scripts to display data, but it is not a built-in element specifically for showing War Room timelines. While technically possible to script, it is not a native layout element for this purpose and would require custom development, making it less appropriate than built-in options.

Playbook Tasks

Why it fails: The Playbook Tasks element shows the status and details of playbook tasks associated with the incident. It does not display War Room entries or a timeline of all activity. It is useful for tracking playbook progress but does not meet the requirement of showing a timeline of War Room entries.

Incident Details

Why it fails: The Incident Details element displays the incident's fields and metadata, such as severity, status, and custom fields. It does not show a timeline of War Room entries. While it is a common layout element, it does not fulfill the requirement of displaying a timeline of War Room activity.