XSIAM-Engineer Integration And Automation Practice Test 2 — 15 Questions

Question 1

An automation engineer is building a playbook in Cortex XSIAM that must pause for up to 30 minutes while a malware sandbox analysis completes, then resume and branch on the verdict. The engineer needs the task to wait without consuming a playbook worker thread that would otherwise be idle. Which task type should be configured for the wait step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A timer task that suspends the playbook for the specified duration and resumes execution when it expires.. The requirement is an asynchronous pause that does not hold a worker thread while the sandbox analysis runs. A timer task suspends the playbook for a set duration and resumes automatically on expiry, which preserves worker capacity and then lets the flow branch on the verdict once the report is available.

Answer

A built-in task that polls the sandbox integration command on a schedule and continues when the report is ready.

Answer

A conditional task that waits for a field to change and continues once the condition evaluates true.

Answer

A manual task that assigns the pause to the analyst queue and resumes when an analyst marks it complete.

Question 2

An engineer needs to ensure that a Cortex XSIAM automation script can access an API key stored in the tenant's secrets store without exposing it in the script code or playbook. The script runs as part of a playbook and must retrieve the key at runtime. Which method should the engineer use?

Accepted Answer

Call the demisto.getSecret() function with the secret name to retrieve the API key at runtime.. The demisto.getSecret() function retrieves secrets from the encrypted secrets store at runtime, keeping them out of code and playbooks. This is the designated secure method for handling API keys and other credentials in Cortex XSIAM automations. The other options either store the secret in plaintext, use unencrypted context, or embed it in a Docker image, all of which fail to meet the security requirement.

Answer

Use the demisto.getIntegrationContext() function to retrieve the API key from the integration's context.

Answer

Define the API key as an environment variable in the script's Docker image and read it with os.environ.

Answer

Store the API key as a playbook input and reference it in the script via the 'inputs' parameter.

Question 3

A security team wants to automatically create a Jira ticket for every new high-severity alert in Cortex XSIAM. The Jira integration is already configured and working. The team wants to minimize manual effort and ensure that the ticket includes the alert's description and severity. Which XSIAM feature should be used to achieve this?

Accepted Answer

Create a correlation rule that triggers a playbook which calls the Jira integration.. Correlation rules in Cortex XSIAM are designed to detect events matching specific criteria and trigger automated playbooks. By defining a rule for high-severity alerts and linking it to a playbook that uses the Jira integration, the team can automatically create tickets with the required fields. This event-driven approach ensures immediate response and eliminates manual steps, fulfilling the automation goal.

Answer

Use the Jira integration's built-in 'create ticket' action directly in the alert view.

Answer

Schedule a recurring job that queries the XSIAM API for high-severity alerts and creates Jira tickets.

Answer

Configure a forwarding rule in XSIAM to send alerts to Jira's email gateway.

Question 4

An XSIAM engineer is designing a new automation that must conditionally branch based on the severity of an alert and then send a notification to a Slack channel only for high-severity alerts. Which two components are required to implement this logic in a playbook? (Choose two.)

Accepted Answer

A 'Conditional' task with a custom expression evaluating alert severity. To conditionally branch based on alert severity, a Conditional task with a custom expression is necessary. To send a Slack notification for high-severity alerts, a Slack integration command task is required. Together, these components enable the playbook to evaluate severity and then notify the appropriate channel, fulfilling the automation requirements.

Answer

A 'Transform' task to modify the alert severity field

Answer

A conditional task using the 'AreValuesEqual' built-in function

Answer

A 'Data Collection' task to gather additional information from the endpoint

Question 5

A Cortex XSIAM engineer is troubleshooting a custom automation script that runs inside a playbook and intermittently fails with timeout errors when calling an external enrichment API. The script also needs to read a value returned by an earlier playbook task. Which two approaches correctly address these needs? (Choose two.)

Accepted Answer

Reference the earlier task's output using the playbook context path that points to that task's result key.. The timeout failures point to an instance-level timeout that is too short for the external API, so raising that parameter gives the call a realistic window. The data-passing requirement is met by reading the earlier task's output through the playbook context, which is the supported mechanism for task-to-task data flow within a single execution.

Answer

Rewrite the external call to use a synchronous socket connection that ignores the integration timeout.

Answer

Store the earlier task's value in a global variable and read it back inside the custom script.

Answer

Disable the playbook's quiet mode so the failing command retries automatically until it succeeds.

Question 6

A security engineer is designing a playbook in Cortex XSIAM that must execute a series of automated remediation actions on endpoints. The engineer wants to ensure that if any action fails, the playbook stops immediately and does not proceed to subsequent actions. Which playbook task configuration should be used to achieve this behavior?

Accepted Answer

Set the task's 'Continue on error' option to false and configure the task to use the 'Stop' error handling mode.. To ensure a playbook stops immediately when a task fails, the task must have 'Continue on error' set to false and the error handling mode set to 'Stop'. This configuration prevents any subsequent tasks from executing, which is critical for remediation playbooks where a failed action could leave the system in an inconsistent state. Other options either allow continuation or add unnecessary complexity.

Answer

Set the playbook's global 'Error Handling' to 'Stop' and ensure all tasks have 'Continue on error' set to false.

Answer

Set the task's 'Continue on error' option to true and add a conditional task after it that checks the status and stops the playbook if needed.

Answer

Use the 'Task Error Handling' section to set the task to 'Retry' with a maximum of zero retries and then a 'Stop' action.

Question 7

An XSIAM engineer is troubleshooting a playbook that intermittently fails when calling an external REST API integration. The integration instance test succeeds, but during playbook execution, some tasks receive HTTP 429 responses. The engineer wants to make the playbook more resilient without modifying the integration code. Which approach should the engineer take?

Accepted Answer

Enable the 'Retry on error' setting for the playbook task and configure a retry interval with exponential backoff.. To handle HTTP 429 rate limiting without changing integration code, the engineer should use the playbook task's 'Retry on error' setting with exponential backoff. This automatically retries failed calls with increasing delays, reducing the chance of hitting rate limits again. Other options either do not address the rate limit or are less effective than built-in retry logic.

Answer

Add a task in the playbook that pauses execution for a random interval before retrying the failed API call.

Answer

Increase the integration instance's timeout value to allow more time for the API to respond.

Answer

Configure the integration instance to use a different API endpoint that does not rate limit.

Question 8

An engineer is creating a new custom integration in Cortex XSIAM to interact with a proprietary REST API. The integration will include several commands that require authentication. The engineer wants to ensure that the integration can be configured with multiple instances, each with different credentials and server URLs. Which TWO parameters must be defined in the integration's YAML configuration to support this requirement? (Choose two.)

Accepted Answer

A 'display' field for each parameter to specify the label shown in the instance configuration UI.. To support multiple instances with different credentials and server URLs, the integration YAML must include a 'configuration' section with parameters for 'credentials' and 'url' marked as required. Additionally, each parameter should have a 'display' field for a user-friendly label. These two elements ensure that when an administrator adds an instance, they can specify unique values, and the UI clearly presents the fields.

Answer

A 'commands' section that lists all available commands with their arguments and outputs.

Answer

A 'script' section that includes a 'main' function to handle command execution.

Answer

A 'fromversion' field to indicate the minimum Cortex XSIAM version required.

Question 9

A security analyst is troubleshooting a Cortex XSIAM playbook that is not triggering as expected when a new high-severity incident is created. The playbook is configured with a trigger that uses a query to filter incidents. The analyst checks the playbook's trigger configuration and sees that the query is 'severity = high'. However, the playbook is not executing for any incidents. What is the most likely cause?

Accepted Answer

The playbook trigger query must include the 'incident.' prefix for incident fields, such as 'incident.severity = high'.. Playbook triggers in Cortex XSIAM use a query syntax where incident fields must be prefixed with 'incident.'. For example, to filter high-severity incidents, the query should be 'incident.severity = high'. Without the prefix, the query does not match any incidents, so the playbook never triggers. This is a frequent configuration oversight.

Answer

The playbook trigger query must be enclosed in double quotes to be parsed correctly.

Answer

The playbook trigger query must use the field name 'severity' with a numeric value, not a string.

Answer

The playbook trigger query must use the '==' operator instead of '=' for equality comparison.

Question 10

An engineer is designing a custom integration for Cortex XSIAM that will fetch indicators from an external threat intelligence platform. The integration must support incremental fetching to avoid re-processing old indicators. Which TWO configuration elements are required to implement incremental fetching correctly? (Choose two.)

Accepted Answer

Store the last fetch timestamp in the integration context using demisto.setIntegrationContext().. Incremental fetching requires persisting the last run state so the integration knows where to resume. Both demisto.setLastRun()/getLastRun() and demisto.setIntegrationContext()/getIntegrationContext() provide this capability. The other options are either insufficient alone or address different concerns like scheduling or post-fetch deduplication. The two correct elements are the mechanisms for storing and retrieving the last fetch position.

Answer

Configure the integration instance with a 'Fetch interval' parameter that specifies how often to run.

Answer

Define a 'fetch_indicators' command in the integration YAML that returns a list of indicators.

Answer

Implement a deduplication logic using the indicator's unique ID to filter out already ingested indicators.

Question 11

An XSIAM engineer is configuring a new integration that will be used by multiple playbooks. The integration requires several configuration parameters, including an API key and a base URL. The engineer wants to ensure that the API key is stored securely and is not visible in plain text to other users who can view the integration configuration. What should the engineer do?

Accepted Answer

Enable the 'Encrypted' checkbox for the API key parameter when adding it to the integration configuration.. The correct approach is to mark the API key parameter as encrypted when configuring the integration instance. This ensures the value is stored securely and masked from other users. The encryption is built into the integration configuration, and the value is only decrypted when the integration runs, providing a secure way to handle sensitive information.

Answer

Define the API key as a global variable in the Playbook settings and reference it in the integration configuration using ${global.apikey}.

Answer

Store the API key in a text file on the XSIAM server and reference it using the ${file:/path/to/key} syntax in the integration configuration.

Answer

Use the 'Secret' parameter type when adding the API key parameter to the integration configuration.

Question 12

An XSIAM engineer is creating a new playbook that will automate the response to phishing incidents. The playbook must extract indicators of compromise (IOCs) from the incident's email attachments and then check their reputation using an external threat intelligence service. The engineer wants to ensure that the playbook can handle multiple attachments and IOCs efficiently. Which two actions should the engineer take to achieve this? (Choose two.)

Accepted Answer

Use the 'Extract Indicators' task to parse the email attachments and extract IOCs.. Using the 'Extract Indicators' task to parse attachments and extract IOCs, combined with configuring the threat intelligence integration to accept a list of IOCs in a single call, provides an efficient and scalable solution. This approach minimizes custom code and leverages built-in capabilities for optimal performance.

Answer

Enable the 'Parallel Execution' option on the playbook to process attachments simultaneously.

Answer

Use the 'Parse Email' task to extract attachments and then manually extract IOCs using a Python script.

Answer

Use a 'For Each' loop to iterate over each attachment and call the threat intelligence service separately for each IOC.

Question 13

An XSIAM engineer is creating a new automation script that will be used in a playbook. The script needs to access the incident's custom fields to make decisions. Which method should the engineer use to retrieve the value of a custom field named 'business_unit' from the incident?

Accepted Answer

Use the 'demisto.incident()' function to get the incident object and then access the 'business_unit' key.. The correct method is to use 'demisto.incident()' to obtain the incident dictionary and then access the custom field by its name. This is the standard way to retrieve incident details, including custom fields, in XSIAM automation scripts. It is efficient and directly provides the needed data.

Answer

Use the 'demisto.context()' function to get the context data and then look for 'business_unit' under the 'incident' key.

Answer

Use the 'demisto.getCustomFields()' function to retrieve all custom fields and then extract the 'business_unit' value.

Answer

Use the 'demisto.executeCommand()' function to run the 'getIncident' command with the incident ID and parse the output for 'business_unit'.

Question 14

An XSIAM engineer is building a playbook that includes a task to run a custom Python script. The script needs to make an HTTP request to an external API that requires authentication using a token. The engineer wants to store the token securely and ensure it is not exposed in the playbook's task inputs or outputs. What is the best practice to achieve this?

Accepted Answer

Store the token as an encrypted parameter in the integration instance that the script uses, and reference it in the script via the integration's configuration.. The best practice is to store the token as an encrypted parameter in the integration instance. This ensures the token is securely stored and not exposed in playbook tasks. The script can retrieve it from the integration configuration at runtime, maintaining security and separation of secrets from code.

Answer

Hardcode the token in the Python script and restrict access to the script to authorized users only.

Answer

Define the token as a playbook input and mark it as 'sensitive' so it is masked in the playbook interface.

Answer

Store the token in a global variable and reference it in the script using 'demisto.getGlobalVariable()'.

Question 15

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

Accepted Answer

The demisto Python library. Custom Python scripts in XSIAM automation use the demisto class library to interact with the system context and execute commands.

Answer

The paloalto_xsiam SDK

Answer

The pan-os-python library

Answer

The requests module with direct tenant URL authentication