XSIAM-Analyst Automation And Playbooks Practice Test 4 — 15 Questions

Question 1

An analyst is building a Cortex XSIAM playbook that enriches indicators by calling an external REST API. The API enforces a rate limit of 10 requests per minute, and the playbook may process incidents containing hundreds of indicators. Which playbook task configuration should the analyst apply to avoid HTTP 429 responses while still processing every indicator?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a sleep task before the HTTP request inside a loop over the indicator list.. Respecting an external API's request quota requires controlling the pace of calls, not just their number. Adding a sleep task before each HTTP request inside the indicator loop throttles the playbook so it stays under the 10-requests-per-minute ceiling, allowing every indicator to be enriched without triggering HTTP 429 responses. Changing the HTTP verb or enabling continue-on-error does not alter request frequency.

Answer

Change the HTTP request method from GET to POST to reduce the request count.

Answer

Enable the 'continue on error' flag on the HTTP request task.

Answer

Wrap the HTTP request task inside a loop that iterates over the indicator list.

Question 2

An analyst is building a Cortex XSIAM playbook that enriches indicators by calling an external REST API. The API enforces a rate limit of 10 requests per minute, and the playbook may process incidents containing hundreds of indicators. Which playbook task configuration should the analyst apply to avoid HTTP 429 responses while still processing every indicator?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A conditional task that checks whether the 'Get Asset' output is not empty, with a default path leading to the notification task.. Conditional tasks in XSIAM inspect the output of a prior task and direct the playbook along different paths. When the 'Get Asset' task returns no record, the condition evaluates as false and the default path continues to notification, cleanly skipping enrichment. This keeps the playbook linear, automatic, and aligned with the requirement to enrich only when the asset exists.

Answer

A task that deletes the incident if the asset is not found, then recreates it with the enrichment data.

Answer

A manual task assigned to the asset owner to confirm whether the asset exists in the CMDB.

Answer

A data collection task that prompts the analyst to enter the asset owner manually.

Question 3

A Cortex XSIAM analyst needs a playbook to pause and wait for a human reviewer to approve blocking a suspicious domain before the block task executes. The reviewer may also need to provide a justification note. Which TWO configurations are required to implement this human-in-the-loop step? (Choose two.)

Accepted Answer

A conditional task that evaluates the reviewer's response before the block task runs. Human-in-the-loop approval requires two things: a way to ask the reviewer and capture the answer, and a way to act on that answer. A data collection task provides the prompt and stores the response in context, while a conditional task reads that response and routes execution so the block only happens on approval. Timer, file-write, and auto-close tasks do not collect or evaluate the decision.

Answer

A timer task that delays execution for a fixed number of minutes

Answer

A task that automatically closes the incident if no response is received within one hour

Answer

A script task that writes the domain to a blocklist file on the XSIAM server

Question 4

A security engineer wants to reuse the same set of containment steps across several different playbooks that handle malware, phishing, and unauthorized access incidents. The steps include isolating an endpoint, disabling a user account, and blocking a hash. The engineer wants to maintain these steps in one place so that updates propagate to all playbooks. What should the engineer do in Cortex XSIAM?

Accepted Answer

Create a sub-playbook containing the containment steps and call it from each parent playbook.. The engineer needs a reusable, centrally maintained set of containment steps. A sub-playbook is the XSIAM construct that packages tasks for invocation by multiple parent playbooks. Updating the sub-playbook propagates changes to all callers, ensuring consistency and reducing maintenance effort. Copying tasks, using a monolithic playbook, or duplicating scripts all fail to provide a single point of maintenance.

Answer

Copy the tasks into each playbook and update them individually when changes are needed.

Answer

Create a single playbook that contains all containment steps and assign it to every incident type.

Answer

Use a script task that performs all containment actions and paste the script into each playbook.

Question 5

A Cortex XSIAM analyst is building a playbook that must pause and wait for an analyst to review a quarantined file before deciding whether to restore or delete it. The playbook should resume automatically once the analyst completes the review task. Which task type should the analyst use to implement this pause and resume behavior?

Accepted Answer

Manual task. A manual task is the XSIAM construct that pauses a playbook, presents an action to an analyst, and resumes automatically when the action is completed. Conditional, data collection, and timer tasks do not provide an interactive review step that captures a restore-or-delete decision.

Answer

Timer task

Answer

Data collection task

Answer

Conditional task

Question 6

An analyst is building a playbook that must conditionally route incidents based on the severity field returned by an external enrichment integration. Which TWO configuration elements are required for the conditional branching to evaluate that field correctly? (Choose two.)

Accepted Answer

A conditional task whose left operand references the enrichment task's output context path and whose operator and right operand define the match.. Conditional routing needs two things: a conditional task that references the enrichment output via its context path with a defined operator and comparison value, and correct task ordering so the enrichment completes before the condition evaluates. Together these guarantee the severity field is present and correctly compared. Schema changes, extraction rules, and global inputs do not substitute for referencing the actual task output in the right sequence.

Answer

A dedicated incident field schema update that registers the severity attribute as a first-class incident field before the playbook runs.

Answer

A pre-configured indicator extraction rule that automatically converts the severity value into a reputation score before the condition runs.

Answer

A global playbook input that maps the severity value into a list variable used by every downstream task automatically.

Question 7

A SOC team wants its Cortex XSIAM playbooks to enrich and respond to incidents automatically without analyst intervention, but only for incidents that meet strict criteria. Which TWO capabilities allow a playbook to be triggered and controlled automatically based on incident attributes? (Choose two.)

Accepted Answer

Using a conditional task at the start of the playbook that evaluates incident fields and routes execution down only the matching branch.. Automatic, criteria-scoped execution in Cortex XSIAM relies on a trigger that fires on incident creation and is constrained by a saved filter over incident fields, plus a conditional task inside the playbook that evaluates those fields at runtime and routes only matching incidents into the response path. Together they ensure automation runs unattended but exclusively for incidents that satisfy the SOC's strict conditions.

Answer

Increasing the playbook's maximum concurrent executions so it can process more incidents at once.

Answer

Enabling the playbook's 'run silently' option so it executes without generating any tasks in the War Room.

Answer

Assigning the playbook to a dedicated incident queue that analysts manually review before execution begins.

Question 8

A Cortex XSIAM playbook calls an external ticketing integration that returns HTTP 429 when the request rate exceeds the vendor's limit. The task currently fails and stops the playbook. The analyst wants the playbook to retry the call up to three times with increasing delay before marking the task as failed. Which configuration should the analyst apply to the task?

Accepted Answer

Configure the task's retry settings with a maximum of three retries, a delay, and a backoff multiplier.. XSIAM tasks support built-in retry parameters, including maximum retries, delay, and backoff multiplier. Configuring these values lets the playbook tolerate transient HTTP 429 responses by retrying with progressively longer waits, then failing cleanly after three attempts. This avoids duplicate task copies and keeps the retry behavior declarative and visible in the task settings.

Answer

Add a sleep task before the integration call and duplicate the integration task three times.

Answer

Set the task's polling interval to 30 seconds and enable the 'continue on error' flag.

Answer

Change the integration instance's proxy settings to route traffic through a different network path.

Question 9

A security team wants a Cortex XSIAM playbook to automatically isolate an endpoint whenever a malware alert with high confidence is ingested. They need the playbook to start without any analyst action. Which trigger type should be configured?

Accepted Answer

An alert-based trigger that fires when a matching alert is ingested. The team needs automatic response at the moment a qualifying alert is ingested. An alert-based trigger evaluates incoming alerts against defined criteria and launches the playbook without human involvement, enabling immediate endpoint isolation. Manual triggers need an analyst, scheduled triggers ignore alert context, and webhook triggers depend on an external caller, so none of them provide the required event-driven automation.

Answer

A webhook trigger that waits for an external system to call the XSIAM API

Answer

A scheduled trigger that runs the playbook every five minutes

Answer

A manual trigger initiated by an analyst from the incident war room

Question 10

A security team wants a playbook to automatically trigger whenever a new high-severity incident is created by the analytics engine, without any analyst manually starting it. Which XSIAM mechanism should be configured to achieve this?

Accepted Answer

An incident trigger configured on the playbook that fires when an incident matching the severity criteria is created.. Incident triggers are the native event-driven mechanism that starts playbooks automatically when matching incidents are created, which exactly matches the requirement for no analyst involvement. Polling, manual buttons, and custom tag-watching scripts all either add latency, require human action, or introduce unsupported complexity. Configuring the trigger with severity scoping delivers immediate automated response.

Answer

A scheduled job that polls the incident table every five minutes and starts the playbook for any matching records.

Answer

A manual playbook entry in the incident layout that analysts click to launch the workflow after reviewing the alert.

Answer

A correlation rule that writes a tag to the incident, which a background script watches to invoke the playbook.

Question 11

A Cortex XSIAM playbook is triggered by a correlation rule that fires multiple times for the same incident within a short window. The playbook's first task creates a ticket in an external ITSM system, and duplicate tickets are being created. The analyst confirms that the correlation rule is correctly firing for distinct events but the playbook is running more than once per incident. Which setting should the analyst verify first to prevent duplicate playbook executions for the same incident?

Accepted Answer

The playbook's trigger configuration to ensure it runs only once per incident.. Duplicate playbook executions for the same incident usually stem from a trigger that fires on every matching event rather than once per incident. The analyst should first verify the trigger configuration and ensure it is set to run the playbook only once per incident. Task timeout, concurrency limits, and ITSM deduplication are secondary or unrelated controls that do not prevent the playbook from being invoked multiple times.

Answer

The playbook's maximum concurrent executions setting.

Answer

The playbook's task timeout value.

Answer

The ITSM integration's deduplication settings.

Question 12

While building a playbook in Cortex XSIAM, you need a task that waits for an analyst to approve a high-risk containment action before the playbook continues. The analyst may take several hours to respond. Which task type should you add to the playbook to satisfy this requirement?

Accepted Answer

A manual task that pauses the playbook until an analyst marks it complete. The requirement is a human-in-the-loop approval gate that can remain open indefinitely. A manual task is the only Cortex XSIAM playbook task type that suspends execution and waits for an analyst to complete it, optionally capturing their input. Conditional, data collection, and automation tasks all execute automatically and continue the playbook without waiting for a person.

Answer

An automation task that runs a script to send an email notification to the SOC

Answer

A data collection task that gathers endpoint telemetry from the involved host

Answer

A conditional task that evaluates a decision tree against the incident severity

Question 13

During an incident investigation, an analyst needs the playbook to fetch the reputation of every IP address observed in the alert and then act on the results. The number of IPs varies per alert, and the same enrichment and decision steps must run once for each address. Which XSIAM playbook construct should the analyst use to iterate over the dynamic list of IP addresses?

Accepted Answer

A loop task that iterates the enrichment and decision sub-tasks over the list of IP addresses. The requirement is to repeat the same enrichment and decision logic for an unknown number of IP addresses, which is the defining use case for a loop task in Cortex XSIAM playbooks. A loop iterates its enclosed tasks over each element of a list, so every address is enriched and evaluated independently, and the playbook scales automatically with the alert's contents rather than requiring manually duplicated tasks.

Answer

A conditional task that evaluates each IP address against a reputation threshold

Answer

A data collection task that aggregates the IP addresses into a single indicator object

Answer

A manual task that prompts the analyst to enrich each IP address one at a time

Question 14

A Cortex XSIAM analyst needs a playbook to pause for a fixed period before checking whether an endpoint isolation command has completed, because the endpoint agent reports status asynchronously. Which playbook task should the analyst insert to introduce that fixed wait?

Accepted Answer

A sleep task configured with the desired wait duration.. Introducing a fixed wait in a Cortex XSIAM playbook is the job of the sleep task, which halts execution for a configured duration. Placing it before the isolation status check allows the asynchronous endpoint agent report to arrive. Conditional tasks only branch, and data collection or manual tasks introduce human dependencies rather than a deterministic timed pause.

Answer

A conditional task that evaluates the isolation status field.

Answer

A data collection task that prompts the analyst for the isolation result.

Answer

A manual task assigned to the endpoint administrator.

Question 15

An analyst is designing a Cortex XSIAM playbook that must pass data between tasks without relying on ad hoc string parsing. Which TWO methods allow a downstream task to consume the output of an upstream task? (Choose two.)

Accepted Answer

Mapping the upstream task's output fields into a context key that the downstream task references.. Downstream tasks consume upstream output either by referencing the task's context key directly or by mapping output fields into named context keys. Both approaches use the playbook context as the transport layer, keeping data structured and available to subsequent tasks. Direct log parsing, manual inputs, and incident-field round trips are not supported patterns for task-to-task data flow.

Answer

Copying the upstream task's output into the incident description field and reading it back with a search.

Answer

Using a playbook input that is manually populated by the analyst after each upstream task completes.

Answer

Reading the upstream task's raw log entry from the automation execution log file.