XSOAR-Engineer Practice Test 15 — 15 Questions

Question 1

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 2

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Publishing playbooks involves defining a clear name, adding comprehensive descriptions, and associating the playbook with relevant incident types.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 3

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Accepted Answer

Update the indicator reputation to Benign or False Positive.. Whitelisting or marking an indicator as 'False Positive' or changing its score to 0/Benign updates its reputation across the platform.

Answer

Delete the incident associated with the indicator.

Answer

Export the indicator to a CSV file for manual review.

Answer

Disable the active playbook attached to the threat intel module.

Question 4

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Accepted Answer

In the task's Conditions tab using pre-conditions or filtering rules. Task-level conditional filtering (such as checking previous task results or verdicts) is configured in the Conditions tab of the task properties.

Answer

In the Incident Fields configuration menu

Answer

In the playbook Details tab under Script arguments

Answer

By writing a separate Condition task before every single integration task

Question 5

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Accepted Answer

The execution status of the task (e.g., completed, failed, in-progress). Color coding on playbook tasks in active incidents reflects their execution status (e.g., green for completed, red for failed, blue for in-progress).

Answer

The permission level required by the analyst viewing the task

Answer

The difficulty rating assigned by the playbook developer

Answer

The integration vendor associated with the task command

Question 6

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

Accepted Answer

Loop Task. A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Answer

Data Collection Task

Answer

Parallel Task Group

Answer

Conditional Task

Question 7

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.

Question 8

An engineer is troubleshooting a playbook where a task fails intermittently because an upstream integration command takes too long to return data. Which THREE configuration options or features can the engineer use to handle this timeout issue effectively? (Choose three)

Accepted Answer

Use asynchronous task execution where supported so the playbook continues while the command runs in the background.. Timeout and retry handling in XSOAR playbooks can be managed using task timeouts, retry mechanisms, or asynchronous execution patterns.

Answer

Increase the global server CPU allocation via the CLI.

Answer

Modify the incident type layout to hide slow tasks.

Question 9

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

Accepted Answer

The Loop feature configured directly on the task properties. To iterate over a list of items in XSOAR context, the engineer uses the Loop feature on the task, specifying the target context array.

Answer

A transformer function in the mapping section

Answer

A sub-playbook with parallel task execution

Answer

A Condition task evaluating the length of the Account array

Question 10

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

Accepted Answer

Use a context transformer or custom mapper in the task's Edit Outputs section to map 'IPAddress' to 'IP'.. XSOAR allows the use of built-in context transformers and custom mappers in playbook task settings to rename and restructure output keys.

Answer

Run a command to delete the context and recreate it using standard Python scripts.

Answer

Modify the global incident type schema to automatically alias IPAddress as IP.

Answer

Rename the integration instance name to match the desired output key.

Question 11

During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?

Accepted Answer

A manual task configured with prompt options and assigned to the relevant analyst role.. A manual task (or data collection task configured with a prompt) pauses playbook execution and assigns a pending task to an analyst or user role for approval.

Answer

An integration instance fetch-incidents polling interval adjustment.

Answer

A pre-processing rule that drops incoming JSON payloads lacking approval metadata.

Answer

A transformer function applied to incident field mapping.

Question 12

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Accepted Answer

In indicator extraction settings or playbook conditional filters that check for private IP ranges (RFC 1918) before querying external APIs.. Indicator filters or classifier rules can be configured to ignore private, reserved, or internal IP ranges before sending queries to external commercial threat intel feeds.

Answer

By increasing the timeout value of the HTTP client.

Answer

By disabling all threat intelligence integrations entirely.

Answer

Within the user permission role definitions.

Question 13

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

Accepted Answer

Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.. To pass incident fields or context data to a sub-playbook, the engineer uses the Context or Incident field selector in the sub-playbook task configuration, referencing the path such as ${incident.ipaddresses}.

Answer

Write a custom Python automation script to manually push the incident field into the sub-playbook context every time.

Answer

Hardcode the IP addresses into the sub-playbook's default argument values.

Answer

Create a global variable in the Server Configuration settings.

Question 14

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

Accepted Answer

Perform bulk actions such as tagging or updating reputation. The Threat Intel workspace allows analysts and administrators to manually create indicators and execute bulk actions like tagging.

Answer

Configure firewall routing tables

Answer

Modify core system database storage paths

Answer

Write raw Linux shell scripts to execute on remote feed servers

Question 15

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Content packs containing playbooks must properly bundle dependencies such as dependent sub-playbooks, required automation scripts, and necessary integration command mappings.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.