An engineer is writing a playbook expression to filter a list of endpoints from context. They want to return only the endpoints where the 'OS' field equals 'Windows'. Which built-in transformer syntax is correct?
An engineer has configured a Loop Task in a playbook to iterate over a list of 50 IP addresses. To prevent the playbook from timing out or overwhelming the external API, the engineer needs to execute batches of 10 items concurrently. Where is this concurrency setting configured?
You need to ensure that a playbook task execution fails gracefully if the underlying integration command returns an error, allowing the playbook to continue down an alternative error-handling path. Which setting must you configure on the task?
An XSOAR Engineer is configuring a playbook task and needs to reference the output of a previous task named 'Get Incident Details'. Which syntax is correct to access the 'ID' key from that task's output context?
An engineer has completed building a new playbook and wants to test it on a live incident without affecting production data. What is the recommended method to test playbook modifications?
An engineer is utilizing the 'Set' task to manipulate context data. They want to clear an existing context key named 'MaliciousIP' entirely so subsequent tasks do not read stale data. How should this be configured in the Set task?
An engineer is troubleshooting a playbook where a task fails intermittently because an upstream integration command takes too long to return data. Which THREE configuration options or features can the engineer use to handle this timeout issue effectively? (Choose three)
An XSOAR Engineer is building a playbook with a conditional task that should route incidents to different branches depending on severity. The engineer wants the condition to evaluate a custom incident field named 'impactlevel' that contains a string value. Which of the following is the correct way to reference this field in the task's condition expression?
An engineer needs a playbook task to dynamically select an integration instance based on the incident's source brand. The playbook must not hard-code a single instance name because multiple instances of the same integration exist for different tenants. Which configuration should the engineer use?
An XSOAR Engineer is building a playbook that processes phishing incidents. They need to call the '!get-ip-reputation' command from a configured integration instance, but the command requires an incident field 'reported_ip' that is populated only after a previous task completes. The engineer wants to ensure the command runs with the correct value. What is the correct way to reference the incident field in the task's arguments?
You are building a playbook that must loop over a list of indicators and run an enrichment command for each one. The number of indicators is unknown at design time and can be up to 500. To avoid overwhelming the enrichment integration and to keep the playbook readable, you want the loop to process the list in fixed-size chunks. Which configuration should you use in the playbook task?
An XSOAR Engineer is designing a playbook that includes a sub-playbook. The sub-playbook needs to receive input from the parent playbook and return results back. Which TWO configurations are required to pass data from the parent playbook into the sub-playbook and retrieve output? (Choose two.)
An engineer is building a playbook that calls a sub-playbook to enrich indicators. The sub-playbook sets several context keys under a custom namespace. The engineer wants the parent playbook to access these keys directly without modifying the sub-playbook. Which configuration in the sub-playbook task ensures the sub-playbook's context is merged into the parent incident context?
An engineer is designing a playbook that must loop through a list of indicators and perform an enrichment task for each one. The engineer wants to ensure that the loop stops immediately if any enrichment task fails, rather than continuing to process remaining indicators. Which playbook task configuration should be used to achieve this behavior?
An XSOAR Engineer is designing a playbook that includes a conditional task to branch based on the severity of an incident. The engineer wants the playbook to proceed to a 'High Severity' branch only if the incident severity is 'High' or 'Critical'. The severity field is stored in the incident context as 'severity' with integer values (0=Unknown, 1=Low, 2=Medium, 3=High, 4=Critical). Which condition expression correctly implements this logic?
An engineer is designing a playbook where a task must run only if a previous task produced a non-empty list of IP addresses in the incident context. The list is stored under the key 'MaliciousIPs'. The engineer wants the playbook to continue normally when the list is empty, without raising an error or stopping the playbook. Which condition expression should be used in the task's 'Run if' field?
An engineer is designing a playbook that includes a task to run a script. The script must return a value that will be used to determine the next task in the playbook. Which TWO methods can the script use to control the playbook's flow? (Choose two.)
An engineer is designing a playbook that must handle errors gracefully. The playbook should continue executing subsequent tasks even if one task fails, and the engineer wants to capture the error details for later review. Which TWO configurations achieve this? (Choose two.)
An XSOAR Engineer is creating a new playbook and wants to add a task that sends an email to the incident owner. The engineer needs to dynamically include the incident owner's name in the email body. Which context path should be used to retrieve the owner's name?
An engineer is creating a sub-playbook that will be called from multiple parent playbooks. The sub-playbook must accept input values from the parent and return results that the parent can use. Which TWO configurations are required to enable this data exchange? (Choose two.)
An engineer is building a playbook that processes malware alerts. After a task runs the '!file' command, the result is stored in the context key File. The engineer needs to ensure that a subsequent task only executes if the file's SHA256 hash is found in a threat intelligence feed. Which playbook expression should be used in the condition task to check if the SHA256 value exists in the 'File.SHA256' context path?
An engineer is designing a playbook that must handle multiple branches based on indicator reputation. The playbook receives a list of indicators in the 'Indicators' context key, each with a 'Reputation' field that can be 'Good', 'Bad', or 'Unknown'. The engineer wants to create a condition task that evaluates to true only if there is at least one indicator with 'Reputation' equal to 'Bad' and at least one indicator with 'Reputation' equal to 'Unknown'. Which two expressions, when combined with an AND operator, will achieve this? (Choose two.)
An engineer is creating a playbook task that must run a script only when the incident severity is 'High' or 'Critical'. The incident severity is stored in the 'incident.severity' context key. Which condition expression correctly checks for these severities?
An engineer is designing a playbook that must execute a task only if the incident has a custom field 'Department' with the value 'Finance' and the incident severity is not 'Low'. The custom field is stored in the context as 'incident.department'. Which condition expression correctly implements this logic?
When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?
You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?
You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?
When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?
You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?
An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?
An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?
You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?
An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?
You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?
When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?
An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?
You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?
An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?
You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?
An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?
An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)
When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)
An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?
An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?
An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?
While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?
An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?
An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?
When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)
An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?
When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)
An engineer is building a playbook that must run a set of enrichment tasks only when the incident severity is at least 'High'. The severity field is already populated in the incident context. The engineer wants to avoid duplicating tasks for each possible severity value. Which approach is most appropriate?
You are building a playbook that must run a series of tasks in parallel to save time. After all parallel branches complete, you need to consolidate their outputs and continue with a single task. Which task type should you use to wait for all parallel branches to finish before proceeding?
An engineer wants a playbook to dynamically decide the next task based on a severity value that is computed at runtime by a script. The playbook must branch to different tasks depending on whether the computed severity is 'High', 'Medium', or 'Low'. Which task type should be used to achieve this dynamic branching?
You are creating a playbook that includes a task to query a threat intelligence integration. The integration command returns a list of indicators, but you only want to proceed if the list is not empty. Which playbook task configuration should you use to evaluate the result and branch accordingly?
An engineer is designing a playbook that must iterate over a list of IP addresses stored in the incident context under the key 'IPs'. For each IP, the playbook should run a reputation check and then add a note to the incident. Which playbook task type should be used to loop over the list and execute the sub-tasks for each item?
An engineer is creating a playbook that needs to send an email notification to the security team when a high-severity incident is detected. The engineer wants to include the incident ID and severity in the email body. Which task type should be used to compose and send the email?
A playbook task is configured to run a command that returns a large JSON object. The engineer wants to store only a specific nested field from the command result into the incident context for later use. Which task configuration should be used?
An engineer is designing a playbook that includes a sub-playbook to perform IP enrichment. The sub-playbook returns a list of enriched IPs in its context under the key 'EnrichedIPs'. The engineer wants to access this list in the parent playbook to use in a subsequent task. Which syntax should be used to reference the list in the parent playbook task?
An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?
An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?
An XSOAR Engineer is designing a playbook that must handle multiple branches based on indicator reputation. The engineer wants to ensure that certain tasks only execute when the indicator's reputation is 'Bad' or 'Suspicious'. Which TWO methods can be used to implement this conditional logic in the playbook? (Choose two.)
An engineer wants to test a playbook that is still in development. The playbook should only be triggered for incidents with the type 'Phishing' and severity 'High'. Which configuration ensures the playbook runs only under these conditions?
An engineer is debugging a playbook that occasionally fails when a task calls an automation script. The script expects a JSON string as input, but the engineer is passing a context object directly. The playbook sometimes works and sometimes fails, depending on the data. Which action should the engineer take to ensure the automation receives the correct input type?
An engineer is building a playbook that must route incidents to different analysts based on severity. The severity is stored in the incident field 'severity' and can be 'Low', 'Medium', 'High', or 'Critical'. The engineer wants to assign the incident to the 'Tier1' team for Low and Medium, and to the 'Tier2' team for High and Critical. What is the most efficient way to implement this routing in the playbook?
An engineer is developing a playbook that includes a task to run an integration command. The command returns a JSON object with a field 'result' that contains a list of indicators. The engineer wants to iterate over each indicator in the list and perform a sub-playbook for each one. Which playbook feature should the engineer use to accomplish this?
An engineer is building a playbook that calls a sub-playbook to enrich indicators. The sub-playbook returns a list of enriched indicators in the context key 'EnrichedIndicators'. The engineer needs to pass this list to a subsequent task that expects a comma-separated string of indicator values. Which transformer should be used to convert the list to a comma-separated string?