Paloalto Networks Updated XSOAR-Engineer Exam Questions and Answers by riya

The XSOAR Incident State Model defines several system statuses: Pending, Active, In-Progress, Done, and Closed. When an incident is newly created and has not yet had a playbook assigned or started—and no analyst actions (such as commands or work plan steps) have been taken—it remains in the Pending state.

Pending indicates that the incident exists in the system but has not yet begun active investigation or automated processing. The Admin Guide clarifies that an incident becomes Active only when a playbook starts or an analyst interacts with it. In-Progress is a manually applied user state indicating active human processing. Waiting is used for blocked or paused tasks but does not apply at initial creation.

Because the War Room is available but unused, and no automation has begun, the incident fits the definition of Pending exactly. Once a playbook were attached or a command were executed, the state would transition to Active.

Therefore, the documented correct answer is B: Pending.