XSOAR-Engineer Playbook Development Practice Test 2 — 15 Questions

Question 1

An engineer is designing a playbook that must loop through a list of indicators and perform an enrichment task for each one. The engineer wants to ensure that the loop stops immediately if any enrichment task fails, rather than continuing to process remaining indicators. Which playbook task configuration should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the loop task's 'continue on error' option to false and configure the enrichment task to raise an error on failure.. The loop task has a 'continue on error' setting that defaults to true. Disabling it causes the loop to stop immediately if any iteration fails. The enrichment task must be configured to raise an error on failure, which is typical for integration commands when they encounter issues. This combination ensures the loop halts on the first failure, meeting the requirement.

Answer

Configure the loop task to run in parallel mode and set a maximum error threshold of 1.

Answer

Add a 'stop loop' task after the enrichment task that executes only when the enrichment task fails.

Answer

Use a condition task inside the loop that checks the enrichment task's status and breaks if it is not success.

Question 2

An XSOAR Engineer is designing a playbook that includes a conditional task to branch based on the severity of an incident. The engineer wants the playbook to proceed to a 'High Severity' branch only if the incident severity is 'High' or 'Critical'. The severity field is stored in the incident context as 'severity' with integer values (0=Unknown, 1=Low, 2=Medium, 3=High, 4=Critical). Which condition expression correctly implements this logic?

Accepted Answer

${incident.severity} == 3 or ${incident.severity} == 4. The correct expression uses integer comparisons with the 'or' operator to check for severity values 3 and 4. This precisely matches the requirement to branch for High or Critical incidents. Other options either use incorrect data types, unsupported operators, or a range that might not be as explicit. Understanding the severity scale and the expression syntax is crucial for building accurate playbook logic.

Answer

${incident.severity} >= 3

Answer

${incident.severity} in (3,4)

Answer

${incident.severity} == 'High' or ${incident.severity} == 'Critical'

Question 3

An engineer is designing a playbook where a task must run only if a previous task produced a non-empty list of IP addresses in the incident context. The list is stored under the key 'MaliciousIPs'. The engineer wants the playbook to continue normally when the list is empty, without raising an error or stopping the playbook. Which condition expression should be used in the task's 'Run if' field?

Accepted Answer

notEmpty(MaliciousIPs). Cortex XSOAR provides condition helper functions such as notEmpty() to test whether a context value is present and non-empty. Using notEmpty(MaliciousIPs) ensures the task runs only when the list has at least one element, and it does not throw an error when the key is missing or the list is empty. This keeps the playbook flow intact without extra branching.

Answer

MaliciousIPs && MaliciousIPs.length > 0

Answer

MaliciousIPs && MaliciousIPs.size > 0

Answer

exists(MaliciousIPs) && MaliciousIPs != []

Question 4

An engineer is designing a playbook that includes a task to run a script. The script must return a value that will be used to determine the next task in the playbook. Which TWO methods can the script use to control the playbook's flow? (Choose two.)

Accepted Answer

Set a context key that is evaluated by a subsequent conditional task.. Scripts can influence playbook flow by setting context keys that conditional tasks evaluate, or by returning values that conditional tasks use as conditions. These methods decouple the script from the playbook structure and are standard practices. Other options either rely on non-existent features or require explicit configuration that is not automatic.

Answer

Return a string that matches the name of a task in the playbook.

Answer

Return a dictionary with a key named 'next_task' containing the task ID.

Answer

Use the return_when or next_task parameter in the script's metadata.

Question 5

An engineer is designing a playbook that must loop through a list of indicators and perform an enrichment task for each one. The engineer wants to ensure that the loop stops immediately if any enrichment task fails, rather than continuing to process remaining indicators. Which playbook task configuration should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Wrap the task in a sub-playbook and set the sub-playbook's 'Continue on error' to true.. Both enabling 'Continue on error' on a task and using a sub-playbook with 'Continue on error' allow the playbook to proceed past failures. Error outputs are stored in context so later tasks can reference them. The other options either do not prevent the playbook from halting or rely on manual intervention, which does not meet the requirement for automatic error handling.

Answer

Configure the task to retry three times and then fail the playbook.

Answer

Add a manual task that prompts the analyst to skip the failed task.

Answer

Use a condition task after the failing task to check if the task succeeded.

Question 6

An XSOAR Engineer is creating a new playbook and wants to add a task that sends an email to the incident owner. The engineer needs to dynamically include the incident owner's name in the email body. Which context path should be used to retrieve the owner's name?

Accepted Answer

${incident.owner}. The incident owner is accessed via ${incident.owner}. This returns the username or name of the owner, which can be used in the email body. Other paths either do not exist or incorrectly assume a nested structure. This is a basic but essential context path for playbook development.

Answer

${incident.ownerName}

Answer

${incident.owner.email}

Answer

${incident.assignedUser}

Question 7

An engineer is creating a sub-playbook that will be called from multiple parent playbooks. The sub-playbook must accept input values from the parent and return results that the parent can use. Which TWO configurations are required to enable this data exchange? (Choose two.)

Accepted Answer

Define input parameters in the sub-playbook's settings and reference them in tasks using the ${inputs.parameter_name} syntax.. To exchange data between a parent and sub-playbook, the sub-playbook must define input parameters, and the parent task must pass values to those parameters. Outputs from the sub-playbook are then accessible in the parent via the task's context, so no additional output parameter definition or manual copying is needed. These two configurations establish the required input and output flow.

Answer

Enable 'Return results' in the sub-playbook task and select the context keys to promote to the parent incident.

Answer

In the sub-playbook, create output parameters and map them to context keys that the parent can retrieve.

Answer

Use a 'Set' task in the parent to manually copy values from the sub-playbook's context after it completes.

Question 8

An engineer is building a playbook that processes malware alerts. After a task runs the '!file' command, the result is stored in the context key File. The engineer needs to ensure that a subsequent task only executes if the file's SHA256 hash is found in a threat intelligence feed. Which playbook expression should be used in the condition task to check if the SHA256 value exists in the 'File.SHA256' context path?

Accepted Answer

contains(${ThreatIntelFeed.SHA256}, ${File.SHA256}). To conditionally execute a task based on whether a file's SHA256 hash exists in a threat intelligence feed, the engineer should use the contains() function. XSOAR expressions support contains() to check for membership in lists or substrings. The expression 'contains(${ThreatIntelFeed.SHA256}, ${File.SHA256})' correctly evaluates to true if the hash is found, enabling precise control flow. Other options either check for mere existence or use invalid syntax.

Answer

${File.SHA256} in ${ThreatIntelFeed.SHA256}

Answer

exists(${File.SHA256})

Answer

val = ${File.SHA256}; if (val in threatIntel) then true else false

Question 9

An engineer is designing a playbook that must loop through a list of indicators and perform an enrichment task for each one. The engineer wants to ensure that the loop stops immediately if any enrichment task fails, rather than continuing to process remaining indicators. Which playbook task configuration should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

contains(${Indicators.Reputation}, "Unknown"). To verify that at least one indicator has 'Bad' reputation and at least one has 'Unknown', the engineer should use contains() on the 'Indicators.Reputation' list for each value. The contains() function returns true if the list includes the specified string. Combining these two contains() checks with an AND operator ensures both conditions are satisfied. Other options misuse exists() or count() with incorrect arguments, or use unsupported functions like 'some'.

Answer

some(${Indicators.Reputation}, "Unknown")

Answer

exists(${Indicators.Reputation}, "Bad")

Answer

count(${Indicators.Reputation}, "Bad") > 0

Question 10

An engineer is creating a playbook task that must run a script only when the incident severity is 'High' or 'Critical'. The incident severity is stored in the 'incident.severity' context key. Which condition expression correctly checks for these severities?

Accepted Answer

${incident.severity} == 3 || ${incident.severity} == 4. XSOAR incident severity is stored as an integer: 4 for High and 5 for Critical. The condition must use these numeric values and the logical OR operator (||) to check for either. The correct expression is '${incident.severity} == 4 || ${incident.severity} == 5'. Using string literals or incorrect numeric values (like 3 for Medium) will not match the required severities. Proper syntax with ${} and full context path is essential.

Answer

severity == 4 or severity == 5

Answer

${incident.severity} == 4 || ${incident.severity} == 5

Answer

${incident.severity} == "High" || ${incident.severity} == "Critical"

Question 11

An engineer is designing a playbook that must loop through a list of indicators and perform an enrichment task for each one. The engineer wants to ensure that the loop stops immediately if any enrichment task fails, rather than continuing to process remaining indicators. Which playbook task configuration should be used to achieve this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

${incident.department} == "Finance" && ${incident.severity} != 2. The condition must combine two checks with AND: the custom field 'incident.department' equals 'Finance', and the incident severity is not Low. Since severity is numeric, 'Low' corresponds to 2, so the correct comparison is '!= 2'. Using string comparison for severity or logical OR would produce incorrect behavior. The expression '${incident.department} == "Finance" && ${incident.severity} != 2' precisely meets the requirement.

Answer

${incident.department} == "Finance" && ${incident.severity} > 2

Answer

${incident.department} == "Finance" && ${incident.severity} != "Low"

Answer

${incident.department} == "Finance" || ${incident.severity} != 2

Question 12

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. In the Cortex XSOAR UI, playbooks are created and modified visually under the 'Automation' tab, specifically the 'Playbooks' section. This is where the Playbook Designer is accessible, allowing drag-and-drop editing of tasks, conditions, and flows. The other options refer to unrelated UI areas such as dashboards, integrations, or incident analysis, which do not host the playbook editor.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 13

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task in Cortex XSOAR is designed to pause the playbook and present instructions or a form to a human analyst for manual review or decision. This is ideal for phishing email review where an analyst must inspect the email and determine if it is malicious. Data Collection tasks gather data, Sub-playbooks run other playbooks, and Automation tasks execute scripts without human intervention.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 14

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Accepted Answer

Reference the context path using the ${Email.Body} syntax in the argument field. Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Answer

Hardcode the expected string value directly into the task argument field

Answer

Store the value in a server-wide environment variable and call os.environ

Answer

Write a custom integration instance configuration for that specific email

Question 15

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

Accepted Answer

A Conditional Task. A Conditional Task allows an XSOAR engineer to evaluate conditions and route the playbook execution path to different branches based on the results.

Answer

A Data Collection Task

Answer

A Loop Task with an exit filter

Answer

A standard task with a Post-processing script