XSOAR Engineer 270-405 Practice Questions & Answers • ExamPrepare

Question 1

Based on the image below, which key from the context points to the string GOGL?

Whois.IP.asn_registry.entities
Whois.IP.[0].network.name
Whois.IP.network.name
Whois.IP.entities

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

An engineer receives reports that an integration is no longer creating incidents. While troubleshooting the integration, the engineer sees the data from the table below.

Which step in the incident lifecycle is preventing the incidents from appearing on the platform?

Pre-processing
Mapping
Run a playbook
Classification

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Which two features can be used together to automatically execute a search on a remote SIEM for extracted IP Indicators? (Choose two.)

Integration command
Enhancement script
Reputation script
Feed-triggered job

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Based on the image below, what will be the type of this new incident?

Cortex XDR Incident
Unclassified
Cortex XDR Incident - Quasar
Default

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Which Cortex XSOAR feature is used to link or drop an incoming incident?

Post-processing rule
Pre-processing rule
Integration
Classifier

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A SOC team must send a notification email to specific teams based on the severity of an incident.

Which feature will accomplish this task each time the severity escalates?

Field-change trigger script
SLA script
Post-processing rule
Server config

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.