XSOAR-Engineer Playbook Development Practice Test 2 — 15 Questions

Question 1

An engineer is utilizing the 'Set' task to manipulate context data. They want to clear an existing context key named 'MaliciousIP' entirely so subsequent tasks do not read stale data. How should this be configured in the Set task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the value of 'MaliciousIP' to 'null' or leave the value field empty while checking the overwrite option.. To clear or overwrite a context key, you can assign an empty value or use specific context clearing methods provided by built-in automation helpers like ClearContext.

Answer

Run a bash command via integration to purge the Redis database.

Answer

Rename the playbook to force a context reset.

Answer

Delete the task and recreate the playbook canvas from scratch.

Question 2

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Accepted Answer

Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.. To customize built-in content safely, you should clone the playbook, modify the clone, and use the cloned version in your incident types.

Answer

Lock the content pack version in Marketplace settings to prevent all future updates.

Answer

Override playbook tasks by creating a separate script with the same name.

Answer

Edit the content pack files directly on the filesystem via SSH.

Question 3

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

Accepted Answer

Connect the preceding task to all three tasks in parallel, and route them into the joining task.. To run multiple tasks concurrently, you connect the preceding task to all three tasks simultaneously, and then connect all three tasks into the subsequent analysis task to join the workflow.

Answer

Wrap them inside a single Data Collection Task.

Answer

Place them in a serial chain one after another.

Answer

Use a Loop Task with a batch size of 3.

Question 4

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

Accepted Answer

To provide human-readable documentation on the playbook's purpose and workflow. The description field provides documentation and details about what the playbook does, helping other analysts understand its purpose.

Answer

To define the regex pattern used for email parsing

Answer

To store encrypted API credentials for sub-playbooks

Answer

To execute initialization scripts when the playbook starts

Question 5

Which visual indicator on a playbook task in the canvas signifies that the task is configured as a starting point (the entry point) of the playbook?

Accepted Answer

A green play/start icon or specific start node shape. The start task in an XSOAR playbook is typically represented as a distinct starting node connected to the first execution step.

Answer

A dashed border around the task box

Answer

A red exclamation mark badge

Answer

A padlock symbol in the corner

Question 6

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

Accepted Answer

By passing the context path containing the file entry ID, such as ${File.EntryID}. File attachments in XSOAR tasks reference file entry IDs stored in context, typically accessed via context paths pointing to file objects.

Answer

By using the 'AttachFile' system-wide environment variable

Answer

By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt

Answer

By hardcoding the binary content of the file directly into the argument field

Question 7

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks support loops and backward transitions (cycles) under specific conditions, allowing workflows to loop back to prior tasks.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 8

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

Accepted Answer

In the task's 'Conditions' tab by defining expression rules based on incident severity. Task-level execution conditions are configured within the task's 'Conditions' tab in the task properties drawer.

Answer

In the playbook JSON file by manually modifying the 'filters' array

Answer

In the server configuration under Incident Types

Answer

By writing a custom pre-processing script for every integration

Question 9

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Accepted Answer

The execution status of the task (e.g., completed, failed, in-progress). Color coding on playbook tasks in active incidents reflects their execution status (e.g., green for completed, red for failed, blue for in-progress).

Answer

The permission level required by the analyst viewing the task

Answer

The difficulty rating assigned by the playbook developer

Answer

The integration vendor associated with the task command

Question 10

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

Accepted Answer

By enabling 'Auto-extract indicators' in the incident type or task output configuration settings. Indicators returned by automation scripts or commands in standard task outputs can be automatically processed and ingested into the Threat Intel module based on mapping and indicator extraction settings.

Answer

By writing all indicators manually to a local CSV file on the server

Answer

By assigning the playbook to the 'Indicator' incident type exclusively

Answer

By restarting the Cortex XSOAR server daemon

Question 11

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Accepted Answer

Conditional Task. Playbook task types include Automation, Conditional, Manual, Sub-playbook, and Data Collection tasks.

Answer

Firewall Task

Answer

Database Task

Answer

Router Task

Question 12

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.

Question 13

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. Playbook designers can add visual notes or descriptions to tasks and canvas areas to document workflow logic.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 14

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Task arguments can be populated with static text strings or dynamic context references enclosed in ${}.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands

Question 15

Which THREE actions can be performed using the Loop task configuration in a Cortex XSOAR playbook? (Choose three)

Accepted Answer

Iterate over a list of items stored in the incident context. Loop tasks allow iterating over arrays, defining batch sizes/concurrency limits, and specifying exit criteria or conditions.

Answer

Automatically convert all looped outputs into PDF incident reports

Answer

Directly modify the core XSOAR database schema during each iteration