A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?
A Python script is failing with an 'Integration not found' error during execution. You have confirmed the integration is enabled. What is the likely issue?
A security analyst wants to ensure that specific indicators extracted from email alerts are automatically enriched upon ingestion. Which component should the analyst configure to achieve this?
You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?
Which mechanism in Cortex XSOAR ensures that concurrent tasks do not attempt to update the same incident field simultaneously, causing a race condition?
An engineer is building a Cortex XSOAR playbook that must call the '!ip' command against a list of indicators. The command executes quickly, but a downstream task that relies on enrichment data from the command sometimes runs before the integration finishes writing results to the context. The engineer wants the playbook engine to wait until the command's outputs are fully available before proceeding to the next task. Which task configuration should the engineer apply to the command task?
A Cortex XSOAR engineer is configuring a new integration instance to fetch incidents from a third-party SIEM. The engineer must ensure that only incidents with a severity of 'High' or 'Critical' are ingested and that duplicate incidents are not created. Which two configurations should be applied? (Choose two.)
You are creating a custom integration that enriches IP addresses by querying an external threat intelligence API. The API returns a JSON object with a field 'reputation' that can be 'good', 'bad', or 'unknown'. You want to map this to the Cortex XSOAR DBotScore reputation field. Which DBotScore reputation value should you assign when the API returns 'bad'?
You are developing a custom automation script in Cortex XSOAR that will be used within a playbook. The script needs to access the incident's custom fields and also make an API call to an external service. Which two statements about script development in Cortex XSOAR are correct? (Choose two.)
An automation engineer needs to extract the domain from an email address stored in the context variable 'email.from'. The email address is in the format 'user@example.com'. Which built-in Cortex XSOAR transformer should be used to extract the domain part?
A security engineer is building a playbook that must handle errors gracefully. The playbook should attempt to enrich an indicator using an integration, and if the enrichment fails, it should retry once after a short delay. If the retry also fails, the playbook should send a notification to a Slack channel. Which two configurations are required to implement this error handling logic? (Choose two.)
A Cortex XSOAR playbook includes a task that calls the '!ip' command to enrich an IP address. The engineer wants to store the enrichment result in the incident context under a custom key called 'SuspiciousIPDetails'. Which approach correctly achieves this?
You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?
A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?
You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?
You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?
An organization requires that sensitive PII data in incident notes is redacted before being sent to an external ticketing system. What is the most efficient way to perform this transformation in XSOAR?
An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?
A security team is using Cortex XSOAR to automate phishing investigations. An engineer needs to store the original sender's email address from the incident's custom fields into a playbook context key for later use in a conditional task. Which of the following is the correct way to reference and assign this value?
You are building a playbook that must handle incidents differently based on the severity of the alert. The severity is stored in the incident field 'severity' as an integer (0-4). You want to conditionally execute a task only when severity is 3 or higher. Which built-in playbook task type should you use to evaluate this condition and route the workflow accordingly?
A SecOps engineer is building a Cortex XSOAR playbook to process phishing incidents. They need a task that will execute a custom Python script to parse email headers and then pass the extracted sender domain to the next task. Which type of playbook task should they use to run the custom Python code?
While designing a playbook, an automation engineer needs a task to execute only when the incident severity is exactly 'High'. Which of the following conditions should be used in the task's 'Run if' field?
A Cortex XSOAR administrator needs to ensure that a specific playbook only runs when an incident is created with a severity of 'High' and the incident type is 'Phishing'. Which configuration should they use to enforce this condition?
A security engineer is creating a custom integration that requires a secure API key to be stored and used across multiple playbooks. Where should the API key be configured to ensure it is securely stored and easily accessible?
A SOC analyst is building a playbook in Cortex XSOAR to automate the investigation of suspicious login alerts. The playbook needs to query an external threat intelligence platform for the reputation of the source IP address. Which type of task should the analyst use to perform this action?
During playbook development, an engineer needs to store a list of suspicious IP addresses extracted from an incident into a context key that can be accessed by multiple tasks. Which context key should they use to ensure the data is available throughout the playbook?
A Cortex XSOAR administrator needs to ensure that a custom integration script can access an API key stored securely without hardcoding it in the script. Which method should be used to store and retrieve the API key?
An automation engineer is creating a playbook in Cortex XSOAR that must run a custom Python script to parse a raw email attachment. The script requires access to the incident's custom field 'attachment_hash' and must return a dictionary with keys 'verdict' and 'score'. Which task type should be used, and how are inputs and outputs configured for this task?
A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?
A security analyst needs to ensure that a playbook only proceeds to the containment phase if the severity of the incident is 'High' or 'Critical'. The severity is stored in the incident field 'severity'. Which task type should be used to implement this branching logic?
A Cortex XSOAR engineer is designing a playbook to automate the response to a phishing incident. They need to ensure that the playbook can handle cases where the email contains attachments. Which two tasks should they include to extract and analyze attachments? (Choose two.)
You are creating a new playbook and need to add a task that will send an email to the security team with the details of the incident. Which task type should you use to accomplish this?
A playbook task that runs a reputation command on an IP address is taking a long time to complete. The analyst wants to limit the task's execution time to 5 minutes and automatically mark it as failed if it exceeds that limit. Which configuration should be applied to the task?
You are designing a playbook that must extract indicators from an incident's attachments. The attachments can be of various file types, including PDF and text. You want to use a built-in script to extract indicators such as IPs, URLs, and hashes from these files. Which Cortex XSOAR script should you use for this purpose?
A Cortex XSOAR engineer is building a playbook that must run a specific enrichment task only when a prior task completes with a status of 'Failed'. Where in the playbook task configuration should the engineer define this conditional behavior?
A security analyst is creating a new Cortex XSOAR playbook and wants to add a task that sends an email notification to the incident owner. Which task type should the analyst select to achieve this?
A Cortex XSOAR engineer is designing a playbook that requires user interaction to approve a remediation action. The engineer needs to configure a task that pauses the playbook until an analyst responds. Which two task types can be used to achieve this? (Choose two.)