Palo Alto Networks XSOAR Engineer — Question 1

Which two behaviors occur while an incident is closed? (Choose two.)

Answer options

• A. Playbook is marked as complete.
• B. Commands cannot be executed in the War Room.
• C. Timers can no longer run.
• D. Running timers are in a paused state.

Correct answer: A, B

Explanation

When an incident is closed, the playbook is finalized, hence option A is correct. Additionally, option B is accurate because once the incident is resolved, no further commands can be executed in the War Room. Options C and D are incorrect because timers may still be running or paused, depending on the incident's state.