Palo Alto Networks XSOAR-Engineer Exam Dumps

XSOAR separates Context Data from Incident Layout fields. When an incident field is populated, its value is stored in Context, even if the incident type later changes. The Admin Guide clearly states that context is persistent and not dependent on whether a field belongs to the new incident type.

If an incident is reassigned to a different incident type, fields not included in the new type's layout are no longer visible in the UI, but the data is fully retained in Context. Analysts can still retrieve the values through playbooks, scripts, or JSON view. This ensures investigations are not disrupted and historical information is never lost due to schema changes.

The data is not deleted, nor is it hidden from context (ruling out options A and D). It also does not appear grayed out in the UI (C), because the fields no longer appear at all unless re-added to the layout.

Thus, per XSOAR's data retention model, the correct state is B: Visible within Context Data and fully accessible.

The XSOAR Incident State Model defines several system statuses: Pending, Active, In-Progress, Done, and Closed. When an incident is newly created and has not yet had a playbook assigned or started---and no analyst actions (such as commands or work plan steps) have been taken---it remains in the Pending state.

Pending indicates that the incident exists in the system but has not yet begun active investigation or automated processing. The Admin Guide clarifies that an incident becomes Active only when a playbook starts or an analyst interacts with it. In-Progress is a manually applied user state indicating active human processing. Waiting is used for blocked or paused tasks but does not apply at initial creation.

Because the War Room is available but unused, and no automation has begun, the incident fits the definition of Pending exactly. Once a playbook were attached or a command were executed, the state would transition to Active.

Therefore, the documented correct answer is B: Pending.