SecOps-Pro Cortex XSOAR And Automation Practice Test 4 — 15 Questions

Question 1

You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?

Accepted Answer

Conditional Task. Conditional Task allows you to define branching conditions so that a task only executes if the previous task returned a specific status. This is a core feature in playbook design for controlling flow based on task outcomes. It enables conditional logic without writing custom scripts.

Answer

Data Pipeline

Answer

Task Locking

Answer

Task Transformation scripts

Question 2

An organization requires that sensitive PII data in incident notes is redacted before being sent to an external ticketing system. What is the most efficient way to perform this transformation in XSOAR?

Accepted Answer

Transformation script on the integration task output. The most efficient way to redact sensitive PII from incident notes before sending to an external ticketing system is to apply a transformation script on the integration task output. In XSOAR, transformation scripts can be attached to integration commands or tasks to automatically modify data before it is sent out. This ensures that redaction happens programmatically and consistently, without manual intervention, and is applied exactly where the data leaves the system. This approach is scalable and reduces the risk of human error.

Answer

Manually editing the incident notes

Answer

Creating a custom Incident Type

Answer

Global incident field settings

Question 3

An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?

Accepted Answer

Report Builder. Report Builder in Cortex XSIAM allows analysts to create customized reports with data from incidents, cases, and other sources. It supports scheduling recurring reports, making it ideal for providing regular trend summaries to management. This feature automates the generation and distribution of reports, saving time and ensuring consistency.

Answer

Incident Feed

Answer

Case Summary Widget

Answer

Playbook documentation

Question 4

Which THREE of the following represent core components of a Cortex XSOAR incident?

Accepted Answer

Indicators. In Cortex XSOAR, an incident is a container that holds the data and context needed to investigate and respond to a security event, and three of its core components are Indicators, the War Room, and Incident Fields. Option A (Indicators) is correct because indicators such as IP addresses, domains, file hashes, and URLs are attached to an incident and drive enrichment, reputation lookups, and indicator-based playbook logic. Option B (War Room) is correct because it is the collaborative investigation workspace where analysts, playbook tasks, commands, entries, and automated actions are logged and discussed for that specific incident. Option D (Incident Fields) is correct because fields (both system and custom, e.g., severity, type, and custom fields) store the structured metadata and context that define and drive the incident's lifecycle and playbooks. Option C (Network Topology Map) is not a core incident component; topology visualization is a separate capability and not part of the incident object itself. Option E (System Update History) is not part of an incident either, as it relates to platform/server maintenance and versioning rather than incident data.

Answer

Network Topology Map

Answer

System Update History

Question 5

A security team is using Cortex XSOAR to automate phishing investigations. An engineer needs to store the original sender's email address from the incident's custom fields into a playbook context key for later use in a conditional task. Which of the following is the correct way to reference and assign this value?

Accepted Answer

Use the ${incident.customFields.sender} syntax to read the value and assign it to a context key using a Set task.. In Cortex XSOAR, incident custom fields are stored under the incident.customFields object. To use a custom field value in a playbook, you reference it as ${incident.customFields.fieldName}. A Set task can then assign this to a context key. This is the standard and correct method for extracting and storing custom field data for later use.

Answer

Use a script task to call the getIncident function and extract the sender field.

Answer

Use the ${incident.details} syntax to access the sender's email address from the incident details.

Answer

Use the ${incident.sender} syntax to directly access the sender's email address from the incident.

Question 6

You are building a playbook that must handle incidents differently based on the severity of the alert. The severity is stored in the incident field 'severity' as an integer (0-4). You want to conditionally execute a task only when severity is 3 or higher. Which built-in playbook task type should you use to evaluate this condition and route the workflow accordingly?

Accepted Answer

Decision task. The correct answer is the task type that evaluates expressions and routes the playbook accordingly. In Cortex XSOAR, the Decision task is designed for conditional branching using incident fields and functions. It supports complex conditions like severity >= 3, enabling dynamic workflow paths. Other task types serve different purposes: manual tasks require human input, data collection tasks gather information, and conditional tasks branch on task outcomes, not field values.

Answer

Conditional task

Answer

Data collection task

Answer

Manual task

Question 7

A SecOps engineer is building a Cortex XSOAR playbook to process phishing incidents. They need a task that will execute a custom Python script to parse email headers and then pass the extracted sender domain to the next task. Which type of playbook task should they use to run the custom Python code?

Accepted Answer

A 'Script' task that runs a custom automation script.. The Script task is specifically designed to execute custom automation scripts within a playbook. It allows the engineer to run Python code that can parse email headers, extract the sender domain, and save it to the context for use by later tasks. Manual, Conditional, and Data Collection tasks do not support running custom code and are intended for human interaction or branching logic.

Answer

A 'Conditional' task that evaluates the email headers against a set of rules.

Answer

A 'Manual' task that requires an analyst to input the sender domain.

Answer

A 'Data Collection' task that prompts for the sender domain via a form.

Question 8

While designing a playbook, an automation engineer needs a task to execute only when the incident severity is exactly 'High'. Which of the following conditions should be used in the task's 'Run if' field?

Accepted Answer

severity == 'High'. In Cortex XSOAR playbook tasks, the 'Run if' field uses Python-like expressions to evaluate conditions. To check if the incident severity equals 'High', the equality operator '==' is required. This ensures the task runs only when the condition is true.

Answer

severity equals 'High'

Answer

severity = 'High'

Answer

severity is 'High'

Question 9

A Cortex XSOAR administrator needs to ensure that a specific playbook only runs when an incident is created with a severity of 'High' and the incident type is 'Phishing'. Which configuration should they use to enforce this condition?

Accepted Answer

Set the playbook's trigger to filter incidents by severity and type.. Playbook triggers in Cortex XSOAR are designed to automatically start playbooks based on incident attributes. By configuring the trigger to filter on severity and incident type, the administrator ensures the playbook only runs for incidents that match both criteria. Other options either do not prevent the playbook from starting or are unrelated to execution control.

Answer

Create a custom incident field and use it in a playbook task condition.

Answer

Add a Conditional task at the beginning of the playbook to check severity and type.

Answer

Modify the incident type's layout to only show the playbook for high severity incidents.

Question 10

A security engineer is creating a custom integration that requires a secure API key to be stored and used across multiple playbooks. Where should the API key be configured to ensure it is securely stored and easily accessible?

Accepted Answer

In the integration instance configuration as a credential parameter. Integration instance credentials are the secure, centralized way to store sensitive information like API keys in Cortex XSOAR. They are encrypted, can be reused across playbooks, and are managed through the integration configuration, ensuring both security and accessibility.

Answer

In the incident context under a custom field

Answer

As a global variable in the playbook settings

Answer

In the script code as a hardcoded string

Question 11

A SOC analyst is building a playbook in Cortex XSOAR to automate the investigation of suspicious login alerts. The playbook needs to query an external threat intelligence platform for the reputation of the source IP address. Which type of task should the analyst use to perform this action?

Accepted Answer

A 'Command' task that executes an integration command to query the threat intelligence platform.. To query an external threat intelligence platform, the playbook should use a Command task that runs the appropriate integration command. This task type executes the command and automatically stores the results in the playbook context, enabling subsequent tasks to use the reputation data.

Answer

A 'Data Collection' task to prompt the analyst for the IP reputation.

Answer

A 'Conditional' task to evaluate the IP address against a list of known malicious IPs.

Answer

A 'Manual' task to instruct the analyst to look up the IP reputation manually.

Question 12

During playbook development, an engineer needs to store a list of suspicious IP addresses extracted from an incident into a context key that can be accessed by multiple tasks. Which context key should they use to ensure the data is available throughout the playbook?

Accepted Answer

Playbook context. Playbook context is the appropriate place to store data that needs to be shared across tasks within a playbook. It provides a temporary storage area that is scoped to the playbook run. Incident context is for incident-level data, global context persists across incidents, and integration context is for integration-specific data.

Answer

Integration context

Answer

Global context

Answer

Incident context

Question 13

A Cortex XSOAR administrator needs to ensure that a custom integration script can access an API key stored securely without hardcoding it in the script. Which method should be used to store and retrieve the API key?

Accepted Answer

Store the API key in the integration instance configuration as a credential parameter.. The secure and recommended method is to define a credential parameter in the integration instance configuration. This parameter is encrypted at rest and accessible in the integration script via demisto.params(). This approach centralizes secret management and allows administrators to update the key without modifying the script.

Answer

Store the API key in an environment variable on the Cortex XSOAR server.

Answer

Store the API key in the playbook context and pass it to the script as an argument.

Answer

Store the API key in a text file on the Cortex XSOAR server and read it from the script.

Question 14

An automation engineer is creating a playbook in Cortex XSOAR that must run a custom Python script to parse a raw email attachment. The script requires access to the incident's custom field 'attachment_hash' and must return a dictionary with keys 'verdict' and 'score'. Which task type should be used, and how are inputs and outputs configured for this task?

Accepted Answer

Use a 'Script' task; specify the script name in the task configuration, map the incident field to a script argument, and the script returns a dictionary that is accessible in later tasks via the task's context key.. The scenario requires executing a custom Python script that takes an incident field as input and returns structured data. A Script task is the correct choice because it allows running a custom script with mapped arguments and captures the returned dictionary under a context key for later use. Command tasks run integration commands, Manual tasks require human input, and Conditional tasks only evaluate logic.

Answer

Use a 'Manual' task; the analyst manually enters the required hash and the script's output must be manually copied into the incident context.

Answer

Use a 'Command' task; the script must be integrated as a command in an integration, and the output is automatically mapped to incident fields without additional configuration.

Answer

Use a 'Conditional' task; the script is embedded in the task's condition expression, and the output is stored in the incident's custom fields automatically.

Question 15

A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?

Accepted Answer

Use the 'Enrich Indicators' task with the indicator type set to 'IP'.. The 'Enrich Indicators' task in Cortex XSOAR is built to handle enrichment of multiple indicators of a given type. It automatically invokes the configured reputation commands for each indicator, aggregating the results. This is the most efficient and standardized way to perform reputation checks on a list of IPs.

Answer

Use a 'Run Command' task to execute the 'ip' command on each IP individually.

Answer

Use a 'Conditional' task to check each IP's reputation and then run a command.

Answer

Use a 'Data Collection' task to manually input the IPs and then run a command.