サンプル問題 1： A security analyst is reviewing alerts and incidents associated with internal vulnerability scanning performed by the security operations team. Which built-in incident domain will be assigned to these alerts and incidents in Cortex XSIAM?
A: Security
B: Health
C: Hunting
D: IT
正解：D
Explanation: The correct answer is D C IT. Alerts and incidents related to internal vulnerability scanning and other non-security operational events are categorized under the IT domain in Cortex XSIAM. This allows teams to differentiate between security-related and IT operationsCrelated alerts for better incident management and prioritization. "Incidents generated from internal IT operations, such as vulnerability scanning, are assigned to the IT domain, separating them from security-focused domains." Document Reference: XSIAM Analyst ILT Lab Guide.pdf Page: Page 28 (Alerting and Detection Processes section)
サンプル問題 2： While investigating an incident on the Incident Overview page, an analyst notices that the playbook encountered an error. Upon playbook work plan review, it is determined that the error was caused by a timeout. However, the analyst does not have the necessary permissions to fix or create a new playbook. Given the critical nature of the incident, what can the analyst do to ensure the playbook continues executing the remaining steps?
A: Clone the playbook, remove the faulty step and run the new playbook to bypass the error
B: Contact TAC to resolve the task error, as the playbook cannot proceed without it
C: Navigate to the step where the error occurred and run the task again
D: Pause the step with the error, thus automatically triggering the execution of the remaining steps.
正解：D
Explanation: The correct answer is D C Pause the step with the error, thus automatically triggering the execution of the remaining steps. When a playbook encounters an error and the analyst does not have permissions to modify or recreate the playbook, the recommended action is to pause the step with the error. This will skip the problematic step and allow the remaining steps of the playbook to execute, ensuring the investigation or response continues. "Pausing a failed step in the playbook work plan allows the remaining steps to continue executing, useful when immediate playbook edits are not possible due to permission restrictions." Document Reference: XSIAM Analyst ILT Lab Guide.pdf Page: Page 39 (Automation section)
サンプル問題 3： Which statement applies to a low-severity alert when a playbook trigger has been configured?
A: The alert playbook will automatically run when grouped in an incident.
B: The alert playbook will run if the severity increases to medium or higher.
C: The alert playbook can be manually run by an analyst.
D: Only low-severity analytics alerts will automatically run playbooks.
正解：A
Explanation: The correct answer is A. When a playbook trigger is configured for an alert―regardless of severity―the playbook will automatically run when the alert is grouped into an incident, unless a severity condition is specifically configured in the playbook trigger. By default, the playbook will execute for any alert (including low severity) as soon as it is grouped within an incident. “A playbook that is configured as a trigger for an alert will automatically execute when that alert is grouped as part of an incident, independent of the alert's severity unless a specific severity threshold is set.” Document Reference: XSIAM Analyst ILT Lab Guide.pdf Page: Page 38 (Automation section)
