XSIAM-Engineer Integration And Automation Practice Test 6 — 15 Questions

Question 1

A Cortex XSIAM engineer is designing a playbook that must handle a high volume of alerts. The playbook includes a task that calls an external enrichment integration which can be slow or unresponsive. The engineer wants to ensure that a failure in this enrichment task does not halt the entire playbook and that the playbook continues to the next task. Which task configuration should the engineer apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the task to 'Continue on error' and configure a timeout value for the integration command.. To prevent a slow or failing enrichment task from halting a playbook, the task should be configured to continue on error and have a timeout set. This allows the playbook to proceed even if the integration does not respond in time, preserving automation flow for high-volume alerts. Other options either pause, retry excessively, or skip the enrichment entirely, which do not satisfy the requirement.

Answer

Set the task to 'Manual review' so an analyst can decide whether to proceed after the enrichment.

Answer

Set the task to 'Retry on error' with a high number of retries to eventually succeed.

Answer

Set the task to 'Skip' so it is bypassed entirely and the playbook moves to the next task.

Question 2

An engineer is writing a custom Python integration for XSIAM that enriches indicators by querying an internal threat-intelligence API. The API returns a JSON body with a nested 'data.attributes' object, and the engineer wants each nested field exposed as a separate command output that analysts can reference in playbook context paths. Which approach should the engineer take in the integration code?

Accepted Answer

Use the CommandResults object with a readable output and a separate outputs dictionary keyed by context path. The idiomatic way to expose structured data from an XSIAM integration command is the CommandResults object, which carries a readable output plus an outputs dictionary. Each dictionary key maps to a context path, so nested API attributes become individually addressable in playbooks and layouts. Raw strings, container files, and log entries all fail to provide discrete, directly referenceable context keys.

Answer

Return the raw JSON string and instruct analysts to parse it with a transformer in each playbook

Answer

Emit each attribute as a separate log entry so analysts can search for it in the XSIAM query console

Answer

Write the nested attributes to a file in the integration's container and reference the file path in playbooks

Question 3

An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?

Accepted Answer

Use the return_outputs() function to return a human-readable table and a separate context entry containing the 'data' array extracted using Python's json module.. The correct approach is to use return_outputs() to provide a human-readable table and a context entry containing the extracted 'data' array. This allows playbook tasks to easily reference the list of indicators via context keys. Parsing the JSON within the integration ensures the command is self-contained and reusable, following Cortex XSIAM integration development best practices.

Answer

Use the demisto.executeCommand() function to call a built-in transformer that parses JSON and returns the 'data' array as a list of indicators.

Answer

Use the demisto.results() function to return the entire JSON response as a single entry, and then use a playbook task with a transformer to extract the 'data' array.

Answer

Use the demisto.createIndicators() function to directly create indicators from the API response, bypassing the need to return a list.

Question 4

A Cortex XSIAM engineer is troubleshooting a custom automation script that runs as part of an incident response playbook. The script intermittently fails with timeout errors when it calls an external enrichment API, and the engineer wants to make the playbook more resilient without changing the external service. Which TWO changes should the engineer make? (Choose two.)

Accepted Answer

Increase the task's timeout value in the playbook task configuration. Intermittent timeouts from an external API are best handled by making the caller tolerant of transient failures. Retrying with exponential backoff recovers from brief outages and throttling, while a longer task timeout accommodates legitimately slow responses. Together these changes harden the script without touching the external service. Suppressing errors, rescheduling the call, or swapping languages does not improve resilience.

Answer

Move the API call to a separate playbook that runs on a schedule instead of on demand

Answer

Convert the script from Python to PowerShell to change its network stack

Answer

Disable the playbook's error handling so failures are silently ignored

Question 5

A security engineer needs to create a custom automation script in Cortex XSIAM that will be used across multiple playbooks. The script must be able to call other integrations and process results. Which type of automation should the engineer create?

Accepted Answer

An automation script written in Python and added to the XSIAM automation library.. In XSIAM, reusable custom automation is created as Python scripts in the automation library. These scripts can be called from any playbook and can use demisto APIs to interact with integrations and process data. Playbook tasks, integration instances, and jobs are not standalone custom scripts, so they do not meet the requirement for cross-playbook reusable automation.

Answer

A playbook task that runs a built-in command.

Answer

A new integration instance configured with custom parameters.

Answer

A job that schedules the automation to run at intervals.

Question 6

An XSIAM engineer is configuring an integration instance for a third-party threat intelligence platform. The integration requires authentication and the engineer wants to ensure that the credentials are handled securely and that the instance can be used by playbooks. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Set the integration instance to 'Active' and test the connection to verify credentials.. To securely configure an integration instance, the engineer should store the API key as a password-type parameter and then activate and test the instance. These actions ensure the credential is encrypted and that the instance is functional for playbooks. Hardcoding, plain text files, and embedding keys in tasks are insecure and do not leverage XSIAM's credential management.

Answer

Store the API key in a plain text file on the XSIAM server for easy access.

Answer

Hardcode the API key in the integration's Python code to simplify distribution.

Answer

Embed the API key in each playbook task that calls the integration.

Question 7

A security team wants a Cortex XSIAM playbook to automatically assign every newly created high-severity incident to the on-call analyst based on the current shift schedule maintained in an external system. Which capability should the engineer use to fetch the on-call user at runtime?

Accepted Answer

A built-in integration command that queries the external scheduling system's API. Dynamic assignment based on a rotating shift schedule requires querying the authoritative external system at playbook runtime. An integration command against the scheduling API returns the current on-call user, whose identifier is then passed to the assignment task. Hardcoded lists, group rules, and emailed rosters all fail to provide accurate, real-time on-call information to the automation.

Answer

A role-based assignment rule that maps high severity to a fixed analyst group

Answer

A hardcoded list of analysts stored in the playbook's task inputs

Answer

A scheduled report that emails the shift roster to the SOC mailbox each morning

Question 8

An XSIAM administrator needs to ensure that a newly created automation script can be executed by playbooks. The script is written in Python and uses the XSIAM automation libraries. What must be done to make the script available for use in playbooks?

Accepted Answer

Add the script to the Scripts library in the XSIAM Automation section.. To make a custom Python script available for playbooks in Cortex XSIAM, the administrator must add it to the Scripts library via the Automation section. This registers the script with the automation engine, allowing it to be selected as a task in playbooks. The script can then be executed with defined inputs and outputs, leveraging XSIAM's built-in Docker infrastructure.

Answer

Upload the script as an integration.

Answer

Place the script file in the /var/lib/xsiam/scripts directory on the server.

Answer

Compile the script into a Docker image and upload it to the XSIAM container registry.

Question 9

An XSIAM engineer needs to store a sensitive API key that will be used by multiple playbooks. The key must be encrypted and accessible only to specific playbooks. Which XSIAM feature should be used?

Accepted Answer

Cortex XSIAM 'Credentials' store with restricted access. The Credentials store is specifically designed for securely storing and managing secrets like API keys. It provides encryption, access control, and the ability to reference credentials in playbooks without hardcoding them. This meets the requirement of a centralized, encrypted store accessible to multiple playbooks with restricted access.

Answer

Playbook inputs with 'encrypted' flag

Answer

Incident fields with 'sensitive' attribute

Answer

Integration instance parameters marked as 'credential'

Question 10

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

Accepted Answer

An alert-based automation rule that fires the playbook when a new alert matches defined conditions.. The scenario calls for automatic, condition-driven execution at alert creation with no human involvement. An alert-based automation rule evaluates each new alert against defined conditions and launches the playbook immediately, delivering enrichment and severity scoring before an analyst begins review.

Answer

A webhook receiver that the external alert source calls after pushing the alert into XSIAM.

Answer

A manual trigger that an analyst selects from the alert's action menu when they begin triage.

Answer

A scheduled job that runs the enrichment playbook every five minutes against all open alerts.

Question 11

An engineer is designing an XSIAM playbook that must delete a malicious file from an endpoint and then verify the deletion succeeded before closing the incident. The vendor's endpoint integration exposes separate 'isolate', 'delete file', and 'list files' commands. Which design approach best ensures the verification step reflects the true post-deletion state?

Accepted Answer

Run the delete command, then call the list files command and branch on whether the target path still appears. Verification of a remediation action must come from reading the system state after the action, not from the action's own acknowledgement. Deleting the file and then listing files to confirm the path is gone implements a read-after-write check. Immediate closure, isolation-based assumptions, and duplicate deletes all fail to provide evidence that the malicious file was actually removed.

Answer

Run the isolate command first, then assume deletion succeeded because the endpoint is contained

Answer

Run the delete command and immediately close the incident if the command returns success

Answer

Run the delete command twice in parallel to increase the probability of success

Question 12

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

Accepted Answer

Automation Engine scheduled task. The Automation Engine scheduled task is designed to run scripts or playbooks on a recurring schedule using cron expressions. It provides a centralized way to manage and monitor scheduled executions, making it the correct choice for running a script every hour. Other features like playbook triggers or incident timers are not intended for standalone script scheduling.

Answer

War Room CLI command '!schedule' with a script name

Answer

Playbook trigger with 'scheduled' type

Answer

Incident type 'timer' with a script action

Question 13

A Cortex XSIAM engineer writes a custom Python automation that must return a structured result to the playbook so a later conditional task can branch on a specific field. The engineer wants the returned data to be accessible as a named output rather than only as raw command output. Which action should the script take to expose the value?

Accepted Answer

Return the value as a key in the script's structured output object so it is exposed as a named context entry.. To let a later conditional task branch on a specific field, the custom automation must surface that value as a named entry in the playbook context. Returning it inside the script's structured output object accomplishes this, giving downstream tasks a stable, addressable name to reference.

Answer

Write the value into a global variable from within the script for the conditional task to read.

Answer

Print the value to standard output and let the playbook parse the raw text of the command result.

Answer

Append the value to the incident's custom fields so the conditional task can read it from the incident object.

Question 14

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

Accepted Answer

Upload the client certificate and its private key to the integration instance's certificate configuration.. The API enforces mutual TLS, so the integration must present a client certificate and its private key when connecting. Storing that material in the integration instance's certificate configuration makes it available to the runtime environment, which is why the call succeeds there while failing when the credential is only present on the workstation.

Answer

Paste the certificate's public portion into the integration's API key parameter field.

Answer

Copy the certificate file to the engineer's workstation trust store and re-run the test.

Answer

Add the API hostname to the integration's proxy exclusion list so the call bypasses the proxy.

Question 15

A Cortex XSIAM engineer needs to create a new automation script that will be used across multiple playbooks. The script must accept an input argument called 'incident_id' and return the incident's severity as a string. Which step is required to make the script available for use in playbooks?

Accepted Answer

Create the script in the 'Automation' section of Cortex XSIAM and ensure it is enabled.. Custom automation scripts in Cortex XSIAM are created in the 'Automation' section. After creating and enabling the script, it can be selected as a task in any playbook. The script can accept input arguments like 'incident_id' and return outputs that can be used in subsequent tasks. This method ensures the script is centrally managed and reusable across playbooks.

Answer

Add the script to the 'Scripts' section in the Cortex XSIAM marketplace and install it.

Answer

Define the script as a playbook task and then export it as a reusable script.

Answer

Upload the script as a Python file to the Cortex XSIAM server via SSH and register it using the command line.