Which two behaviors occur while an incident is closed? (Choose two.)

The correct answer is A. Playbook is marked as complete. B. Commands cannot be executed in the War Room. When an incident is closed, the associated playbook is finalized and marked as complete to signify that the automated workflow has ended. The War Room becomes read-only upon incident closure, so no new commands can be executed, ensuring data integrity for auditing and…

Incident Management

Question

Options

APlaybook is marked as complete.
BCommands cannot be executed in the War Room.
CTimers can no longer run.
DRunning timers are in a paused state.

How the community answered

(19 responses)

A
89% (17)
C
5% (1)
D
5% (1)

Explanation

When an incident is closed, the associated playbook is finalized and marked as complete to signify that the automated workflow has ended. The War Room becomes read-only upon incident closure, so no new commands can be executed, ensuring data integrity for auditing and post-incident review.

Topics

#incident lifecycle#War Room#timers#incident status

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice