SecOps-Pro Cortex XSOAR And Automation Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are valid methods for triggering a playbook in Cortex XSOAR?

Accepted Answer

Manual execution from the Incident War Room. Option A is correct because analysts can manually run a playbook directly from the Incident War Room using the 'Run Playbook' action, which is a standard way to trigger playbooks on demand. Option C is correct because Cortex XSOAR exposes a REST API that allows playbooks to be invoked programmatically, for example via an API call to run a playbook by name or ID. Option D is correct because playbooks can be configured to auto-trigger based on incident classification, such as the Incident Type field, so that matching incidents automatically start the associated playbook. Option B is not correct because Cortex XSOAR does not use PostgreSQL database triggers as a playbook trigger mechanism. Option E is not correct because indicator reputation changes alone are not a native playbook trigger; reputation changes occur as a result of playbook logic or integrations rather than initiating a playbook directly.

Answer

Database trigger in PostgreSQL

Answer

Indicator reputation change

Question 2

An engineer is building a Cortex XSOAR playbook that must call the '!ip' command against a list of indicators. The command executes quickly, but a downstream task that relies on enrichment data from the command sometimes runs before the integration finishes writing results to the context. The engineer wants the playbook engine to wait until the command's outputs are fully available before proceeding to the next task. Which task configuration should the engineer apply to the command task?

Accepted Answer

Enable 'Wait for the task to complete' in the task's Advanced settings so the engine defers the next task until the command returns.. The task-level Advanced settings contain a 'Wait for the task to complete' control that makes the playbook engine hold the workflow until the command has finished and its outputs are committed to context. Using it directly resolves the race condition where downstream tasks read enrichment before it is written. The other choices either misattribute the setting to integration instances, propose manual polling loops, or invent an API flag that does not exist.

Answer

Add a 'Conditional' task immediately after the command that checks whether the context path is populated, and loop back if it is not.

Answer

Set the task's execution mode to 'Sync' and enable 'Wait for completion' on the integration instance settings.

Answer

Convert the command task into a script task and call 'demisto.executeCommand' with a blocking flag set to true.

Question 3

A Cortex XSOAR engineer is configuring a new integration instance to fetch incidents from a third-party SIEM. The engineer must ensure that only incidents with a severity of 'High' or 'Critical' are ingested and that duplicate incidents are not created. Which two configurations should be applied? (Choose two.)

Accepted Answer

Use the 'Fetch Query' parameter in the integration instance to filter incidents by severity.. To ingest only high and critical incidents, use the fetch query parameter to filter by severity. To prevent duplicates, enable deduplication in the integration instance settings. These two configurations work together to ensure that only relevant, unique incidents are created in Cortex XSOAR.

Answer

Set the 'Incident Fetch Interval' to a high value to reduce the number of incidents fetched.

Answer

Set the 'Incident Type' in the integration instance to a custom incident type that only includes high and critical severities.

Answer

Configure a pre-processing rule to drop incidents with low severity.

Question 4

You are creating a custom integration that enriches IP addresses by querying an external threat intelligence API. The API returns a JSON object with a field 'reputation' that can be 'good', 'bad', or 'unknown'. You want to map this to the Cortex XSOAR DBotScore reputation field. Which DBotScore reputation value should you assign when the API returns 'bad'?

Accepted Answer

DBotScore.Reputation.Bad (value 3). The correct mapping is to the DBotScore reputation constant that represents a malicious indicator. Cortex XSOAR defines DBotScore.Reputation.Bad with an integer value of 3. When an external source reports an IP as bad, the integration should set the DBotScore to this value. This standardized reputation enables consistent handling across playbooks and dashboards. Using incorrect constants or values would break the enrichment logic and could result in improper automated responses.

Answer

DBotScore.Reputation.Bad

Answer

DBotScore.Reputation.Suspicious

Answer

DBotScore.Reputation.Good

Question 5

You are developing a custom automation script in Cortex XSOAR that will be used within a playbook. The script needs to access the incident's custom fields and also make an API call to an external service. Which two statements about script development in Cortex XSOAR are correct? (Choose two.)

Accepted Answer

External API calls should be made using the demisto.executeCommand method to run an existing integration command.. The correct statements are that scripts can use the demisto object to access incident fields via demisto.incidents(), and that external API calls should ideally be made by invoking existing integration commands using demisto.executeCommand. These practices ensure scripts are integrated with the platform's data model and leverage reusable components. Directly modifying incident fields without using setIncident does not persist, and scripts are not restricted to Python 2.7 or only inputs.

Answer

Scripts must be written in Python 2.7 because Cortex XSOAR does not support Python 3.

Answer

The script can directly modify incident fields by assigning values to demisto.incidents()[0]['customFields'].

Answer

Scripts cannot access the incident context; they can only operate on inputs provided as arguments.

Question 6

An automation engineer needs to extract the domain from an email address stored in the context variable 'email.from'. The email address is in the format 'user@example.com'. Which built-in Cortex XSOAR transformer should be used to extract the domain part?

Accepted Answer

ExtractEmailDomain. The ExtractEmailDomain transformer is specifically designed to parse an email address and return its domain. It is a single-step operation that yields a string, making it ideal for this scenario. Other transformers like Split or Regex could achieve the result but require additional configuration and are not as straightforward.

Answer

ExtractDomain

Answer

Split

Answer

Regex

Question 7

A security engineer is building a playbook that must handle errors gracefully. The playbook should attempt to enrich an indicator using an integration, and if the enrichment fails, it should retry once after a short delay. If the retry also fails, the playbook should send a notification to a Slack channel. Which two configurations are required to implement this error handling logic? (Choose two.)

Accepted Answer

Configure the enrichment task with a 'Retry' loop that runs once on failure.. To implement retry on failure, the enrichment task must be configured with a retry setting (e.g., retry once). After the retry, if the task still fails, a Conditional task can detect the failure and route to a Slack notification. These two configurations together achieve the required error handling: automatic retry and notification on persistent failure.

Answer

Set the enrichment task's 'Continue on error' to true and add a conditional task to check the task's error output.

Answer

Add a 'Delay' task before the enrichment task to wait for the integration to be ready.

Answer

Set the playbook's 'Error Handling' to 'Retry' and specify a Slack channel for notifications.

Question 8

A Cortex XSOAR playbook includes a task that calls the '!ip' command to enrich an IP address. The engineer wants to store the enrichment result in the incident context under a custom key called 'SuspiciousIPDetails'. Which approach correctly achieves this?

Accepted Answer

In the task's 'Outputs' tab, add an output with context path 'SuspiciousIPDetails' and value '${IP.Address}'.. To store a specific piece of data from a task's output into a custom context key, you use the Outputs tab of the task. Setting the context path to the desired key and the value to the relevant output field (e.g., '${IP.Address}') correctly persists that data. This allows later tasks to reference 'SuspiciousIPDetails' directly.

Answer

In the task's 'Outputs' tab, add a new output with context path 'SuspiciousIPDetails' and value '${IP.Address}'.

Answer

In the task's 'Outputs' tab, add an output with context path 'SuspiciousIPDetails' and value '${IP(val.Address && val.Address == obj.Address)}'.

Answer

In the task's 'Inputs' tab, map the command output to 'SuspiciousIPDetails' by adding a key-value pair.

Question 9

You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?

Accepted Answer

${indicatorsList[0]}. In Google SecOps (Chronicle) playbooks, variables are referenced using the `${variableName}` syntax, and array elements are accessed with zero-based indexing using square brackets. Therefore, `${indicatorsList[0]}` correctly extracts the first item from the array. This is consistent with many programming languages and the specific syntax used in playbook task inputs.

Answer

$indicatorsList(0)

Answer

${indicatorsList.[0]}

Answer

indicatorsList{0}

Question 10

A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?

Accepted Answer

The task is assigned to a role that the user does not belong to. In Cortex XSOAR, a manual task appears in a user's Inbox only if the user matches the task's assignment criteria. If the Owner field is populated but the task isn't in the user's Inbox, the most likely cause is that the task is assigned to a role the user doesn't belong to, so the assignment doesn't resolve to that user.

Answer

The system clock is out of sync

Answer

The task has no inputs

Answer

The playbook is set to 'Silent' mode

Question 11

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 12

You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?

Accepted Answer

integration-NAME.yml. In Cortex XSOAR, a custom integration is defined by a YAML file (conventionally `integration-NAME.yml`) that specifies the integration's metadata, parameters, commands, and points to the Python script implementing the logic. This YAML is the required definition file for the integration.

Answer

script-NAME.py

Answer

integration-NAME.json

Answer

README.md

Question 13

You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?

Accepted Answer

Main Account. In a Cortex XSOAR multi-tenant deployment, playbooks intended for sharing across tenants must be placed in the Main Account, which acts as the parent tenant and distributes content to child tenants. Content in the Main Account is visible and usable by all child tenants, enabling centralized playbook management.

Answer

Private Content Folder

Answer

Child Tenant

Answer

Integration Settings

Question 14

You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?

Accepted Answer

Cortex XSOAR Settings > Integrations > Instances. Integration instances are managed under Settings > Integrations > Instances, where each configured instance shows its connection status (e.g., 'Connected', 'Disconnected', 'Error') and provides access to instance-specific logs. This is the canonical location to verify that a third-party threat intel feed is reachable and authenticated.

Answer

Cortex XSOAR Settings > Advanced > Server Configuration

Answer

Cortex XSOAR Settings > Playbooks > Automation

Answer

Cortex XSOAR Settings > Objects > Indicators

Question 15

Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?

Accepted Answer

Content Packs. Content Packs are the Cortex XSOAR mechanism for packaging playbooks, scripts, integrations, incident types, layouts, and classifiers into a single installable unit. They are versioned and can be installed across tenants or environments, which is exactly the 'bundle and deploy' behavior the question describes. This makes them the canonical answer for cross-environment deployment of content.

Answer

Export to PDF

Answer

Backup and Restore

Answer