XSOAR-Engineer Playbook Development Practice Test 3 — 15 Questions

Question 1

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. In Cortex XSOAR, when configuring a data collection task, the user's response is mapped to an incident field via the task's 'Assign to Incident Field' configuration setting. This setting explicitly binds the response to a chosen incident field, making it available for downstream playbook logic and incident context. Other tabs handle inputs, scripts, or display, not incident field assignment.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 2

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

Accepted Answer

It passes the list as a comma-separated string or array to the script argument based on argument definitions.. XSOAR automatically flattens or serializes list context outputs into comma-separated strings or passes them as array structures depending on argument definitions when referenced in task inputs.

Answer

It throws a validation error unless wrapped in a string transformer.

Answer

It passes only the first item in the list and discards the rest.

Answer

It converts the list into a JSON object and stores it in a temporary file.

Question 3

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

Accepted Answer

JSON. Playbooks and other content items in XSOAR are exported and packaged in JSON format.

Answer

XML

Answer

CSV

Answer

YAML

Question 4

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. In Cortex XSOAR, a task's Conditions tab defines a conditional expression that is evaluated against the current incident context (the JSON data available at that point in the playbook). If the expression evaluates to true, the task runs; if false, the task is skipped. This is the mechanism that determines task execution.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 5

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

Accepted Answer

Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.. By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Answer

Sub-playbooks share the exact same global context without any isolation or scoping.

Answer

All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.

Answer

Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.

Question 6

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

Accepted Answer

Loop Task. A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Answer

Data Collection Task

Answer

Parallel Task Group

Answer

Conditional Task

Question 7

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Accepted Answer

Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.. The recommended best practice for customizing a content-pack playbook without losing updates is to clone the playbook, modify the clone, and use the clone in your workflows. This preserves the original pack playbook so Marketplace upgrades can update it, while your customized clone remains under your control. It also keeps a clear separation between vendor content and custom logic.

Answer

Lock the content pack version in Marketplace settings to prevent all future updates.

Answer

Override playbook tasks by creating a separate script with the same name.

Answer

Edit the content pack files directly on the filesystem via SSH.

Question 8

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

Accepted Answer

Connect the preceding task to all three tasks in parallel, and route them into the joining task.. To run multiple tasks concurrently, you connect the preceding task to all three tasks simultaneously, and then connect all three tasks into the subsequent analysis task to join the workflow.

Answer

Wrap them inside a single Data Collection Task.

Answer

Place them in a serial chain one after another.

Answer

Use a Loop Task with a batch size of 3.

Question 9

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

Accepted Answer

To provide human-readable documentation on the playbook's purpose and workflow. The Playbook Description field in Cortex XSOAR is a free-text metadata field used to document the playbook's purpose, scope, and workflow for human readers. It appears in the playbook library and helps analysts and engineers understand what the playbook does without opening and tracing every task.

Answer

To define the regex pattern used for email parsing

Answer

To store encrypted API credentials for sub-playbooks

Answer

To execute initialization scripts when the playbook starts

Question 10

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

Accepted Answer

By passing the context path containing the file entry ID, such as ${File.EntryID}. In Cortex XSOAR, files stored in the incident context are referenced by their entry ID, which is a unique identifier for the file in the incident's file store. To attach such a file to an email, you use the context path containing the file entry ID, such as ${File.EntryID}. This allows the email task to retrieve the file from the incident's attachment store. The other options are invalid: there is no 'AttachFile' system variable, specifying a server filesystem path is not how XSOAR manages files, and hardcoding binary content is impractical.

Answer

By using the 'AttachFile' system-wide environment variable

Answer

By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt

Answer

By hardcoding the binary content of the file directly into the argument field

Question 11

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks are built as directed graphs that support Loop Tasks and conditional branches, which allow execution to return to an earlier task node. This is the supported mechanism for implementing backward transitions such as re-running a cleanup task after an analyst marks a phishing alert as a false positive.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 12

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

Accepted Answer

In the task's 'Conditions' tab by defining expression rules based on incident severity. The task-level 'Conditions' tab in the Cortex XSOAR playbook editor is the built-in mechanism for conditional task execution. It lets you define expression rules (e.g., using DBot or built-in incident fields like severity) that are evaluated at runtime before the task runs. Setting a condition such as 'severity equals High or Critical' ensures the task only executes for matching incidents without touching the underlying JSON or server config.

Answer

In the playbook JSON file by manually modifying the 'filters' array

Answer

In the server configuration under Incident Types

Answer

By writing a custom pre-processing script for every integration

Question 13

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Accepted Answer

The execution status of the task (e.g., completed, failed, in-progress). Color coding on playbook tasks in active incidents reflects their execution status (e.g., green for completed, red for failed, blue for in-progress).

Answer

The permission level required by the analyst viewing the task

Answer

The difficulty rating assigned by the playbook developer

Answer

The integration vendor associated with the task command

Question 14

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

Accepted Answer

By enabling 'Auto-extract indicators' in the incident type or task output configuration settings. Indicators returned by automation scripts or commands in standard task outputs can be automatically processed and ingested into the Threat Intel module based on mapping and indicator extraction settings.

Answer

By writing all indicators manually to a local CSV file on the server

Answer

By assigning the playbook to the 'Indicator' incident type exclusively

Answer

By restarting the Cortex XSOAR server daemon

Question 15

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Accepted Answer

Conditional Task. In the Cortex XSOAR playbook visual designer, a Conditional Task (B) is a valid task type that evaluates a set of conditions against the playbook context and routes execution down different branches based on whether the conditions evaluate to true or false. An Automation Task (E) is also valid: it runs a selected automation script (or command) and stores its output in the playbook context for later tasks to consume. These two are standard built-in task types in the XSOAR playbook editor. By contrast, Firewall Task (A), Database Task (C), and Router Task (D) are not task types offered by the XSOAR visual designer; firewall and database operations would be performed through integrations/commands inside an Automation or standard task, and 'Router Task' is not an XSOAR construct (branching is handled by Conditional Tasks).

Answer

Firewall Task

Answer

Database Task

Answer

Router Task