SecOps-Pro Cortex XSOAR And Automation Practice Test 2 — 15 Questions

Question 1

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

Accepted Answer

Summary. The 'Summary' tab is designed to provide a high-level view of the case status and key artifacts.

Answer

Indicators

Answer

Work Plan

Answer

Evidence

Question 2

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 3

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 4

If an automation script is taking too long to run, how can you improve its performance?

Accepted Answer

Refactor the script to use batch processing instead of individual API calls. Using asynchronous execution (if supported) or refining the script logic to use batch processing instead of loops is the standard optimization method.

Answer

Add more logging to the script

Answer

Change the script language to Java

Answer

Increase the integration timeout limit

Question 5

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 6

What happens if a playbook task is configured to 'Continue on error' and the task fails?

Accepted Answer

The playbook proceeds to the next task. The playbook will continue to the next designated path instead of terminating the execution.

Answer

The incident is closed

Answer

The playbook stops immediately

Answer

The task is automatically retried

Question 7

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Accepted Answer

Playbook Debugger. The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.

Answer

System Health Monitor

Answer

Audit Logs

Answer

Integration Debugger

Question 8

You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?

Accepted Answer

Create an Incident Classifier rule to assign the playbook based on incident attributes. The 'Incident Auto-Classifier' or 'Automated Assignment' rules based on incident type or severity are the most efficient methods.

Answer

Manually open each incident and assign the playbook

Answer

Restart the server

Answer

Wait for the user to trigger it

Answer

Rename the incidents

Question 9

Which THREE of the following are valid components of a standard Content Pack?

Accepted Answer

Scripts. Content Packs contain various XSOAR objects like integrations, playbooks, and dashboards.

Answer

System Logs

Answer

Integration instances

Question 10

Which TWO settings are configurable within an Integration Instance?

Accepted Answer

Integration timeout. Integration instances require specific connection details and often allow for custom mapping or filtering logic.

Answer

Incident retention policy

Answer

Playbook triggering logic

Answer

Indicator expiration time

Question 11

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Accepted Answer

Incident Context. Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.

Answer

Hard-coding the context path

Answer

Database injection

Answer

Global variables

Question 12

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.

Answer

Incident display layout

Answer

User password length

Question 13

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. Playbooks support various task types including manual, automated, and condition tasks.

Answer

Database cleanup task

Answer

Encryption task

Question 14

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

Accepted Answer

Context is the primary way to pass data between playbook tasks. The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.

Answer

Context data is automatically cleared every 24 hours

Answer

Context only supports string data types

Answer

Context data is shared between different incidents

Question 15

Which THREE actions can be performed from the Incident 'Work Plan' tab?

Accepted Answer

Skip a task. The Work Plan tab allows users to view progress, manually trigger tasks, and re-run failed tasks.

Answer

Change the server OS

Answer

Add a new incident type