XSOAR-Engineer Playbook Development Practice Test 4 — 15 Questions

Question 1

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.

Question 2

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. The playbook design interface in Cortex XSOAR provides a task properties drawer where engineers can add Notes and Task Descriptions to document business logic, conditional branches, and expected outcomes. These fields are stored with the task definition and are visible to anyone editing or reviewing the playbook, making them the correct place for inline documentation. This keeps documentation versioned alongside the playbook itself rather than in external channels.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 3

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Option B is correct because task inputs in a playbook support dynamic context path references written with the ${} syntax, which resolves values from the playbook's context at runtime (for example ${incident.id} or ${alert.name}). Option E is correct because static text can be typed directly into the argument field, providing a literal value that is passed to the command argument without any resolution step. Option A is incorrect because playbooks do not query the internal PostgreSQL database directly to populate task arguments; data is supplied through context or static input. Option C is incorrect because memory pointer addresses in C syntax are not a supported input mechanism in playbook task configuration. Option D is incorrect because local environment variables set via bash export are not a supported way to pass values into playbook task arguments.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands

Question 4

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

Accepted Answer

Inputs. Task property drawers include tabs for Task Details, Inputs, Outputs, and Conditions.

Answer

Kernel

Answer

Compiler

Answer

Bios

Question 5

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Accepted Answer

Clone out-of-the-box content pack playbooks before making custom modifications to prevent loss during updates.. Best practices include cloning content pack items before editing, utilizing descriptive naming conventions, and exporting playbooks in JSON format for source control.

Answer

Directly edit the production server's internal SQLite database files while playbooks are running.

Answer

Store plaintext administrator passwords inside playbook task description fields for easy reference.

Question 6

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 7

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Accepted Answer

Executing the sub-playbook either synchronously or asynchronously. Option B is correct because Cortex XSOAR sub-playbooks can be invoked with the 'RunAsynchronously' setting, allowing the parent playbook to either wait for the sub-playbook to finish (synchronous) or continue execution while the sub-playbook runs in parallel (asynchronous). Option C is correct because the sub-playbook task configuration includes an 'Inputs' section where parent playbook context keys are mapped to the sub-playbook's defined input arguments, enabling data to flow into the sub-playbook. Option E is correct because the sub-playbook task also has an 'Outputs' section that maps the sub-playbook's output keys back into the parent playbook context, making the results available to subsequent tasks in the parent. Option A is incorrect because Cortex XSOAR playbooks operate at the orchestration layer and cannot directly modify OS kernel parameters. Option D is incorrect because sub-playbooks are interpreted automation content within the XSOAR engine, not compiled into native binary executables.

Answer

Directly modifying the underlying OS kernel parameters

Answer

Compiling the sub-playbook into a native binary executable file

Question 8

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. In a playbook Conditional Task, option B is correct because you can configure custom branch labels that name each possible outcome, allowing subsequent tasks to be routed based on which branch is taken. Option C is correct because the core of a Conditional Task is defining conditional expressions that evaluate incident fields or context data to determine which branch executes. Option E is correct because a Conditional Task supports a default (else) fallback path that runs when none of the specified conditions evaluate to true. Option A is not a playbook Conditional Task setting; compiling Python source into bytecode is a Python runtime/build operation, not a playbook configuration. Option D is not a Conditional Task setting either, since directly modifying firewall ACLs without commands is not a supported configuration mechanism in a Conditional Task.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 9

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

Accepted Answer

Check server log files (e.g., demisto.log) for Python tracebacks and error messages.. Troubleshooting script arguments involves inspecting task inputs in the playbook UI, checking the War Room for exact command execution syntax, and reviewing server log files for Python tracebacks.

Answer

Reinstall the underlying operating system and format all storage volumes.

Answer

Replace the server's network interface card to fix context serialization errors.

Question 10

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Option B is correct because Cortex XSOAR playbooks execute automated workflows that handle repetitive SOC tasks such as enrichment, triage, and containment actions, which directly reduces Mean Time to Respond (MTTR). Option D is correct because playbooks encode a defined, repeatable sequence of steps so that every analyst handles the same incident type consistently, standardizing incident response across the team. Option A is incorrect because playbooks do not permanently disable all external network connections during any alert; containment actions are typically scoped, conditional, and reversible. Option C is incorrect because XSOAR is designed to augment analysts, not eliminate human oversight; human-in-the-loop approvals and analyst judgment remain essential. Option E is incorrect because XSOAR does not replace SIEM databases with flat text files; it integrates with SIEMs and other tools rather than substituting their data stores.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 11

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Accepted Answer

'ToLower' to convert string characters to lowercase. Option A ('ToLower') is correct because Cortex XSOAR's built-in transformer set includes string transformers such as ToLower, which converts all characters in a given string value to lowercase within a context expression. Option D ('concat') is correct because concat is a built-in transformer that joins multiple string values together, allowing playbook authors to assemble composite strings from separate context fields. Option E ('uniq') is correct because uniq is a built-in list transformer that removes duplicate elements from a list, which is a standard list-manipulation operation in XSOAR context expressions. Option B ('CompileToMachineCode') is not a real XSOAR transformer; XSOAR does not compile context data into native x86 assembly. Option C ('EncryptDatabase') is also not a built-in transformer; XSOAR does not expose a transformer that secures SQL storage, as database encryption is not a context-expression string or list manipulation.

Answer

'CompileToMachineCode' to convert context into native x86 assembly

Answer

'EncryptDatabase' to secure SQL storage

Question 12

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Option A is correct because a clear, descriptive name that reflects the playbook's workflow purpose is essential for discoverability and for users to understand at a glance what the playbook does when browsing the organization-wide library. Option C is correct because documentation or a description explaining input requirements and expected outcomes ensures other analysts can correctly supply required inputs and understand what the playbook will produce, which is critical for reusable, organization-wide content. Option E is correct because associating the playbook with the appropriate Incident Types enables it to trigger automatically when relevant cases are created, which is the standard mechanism for mapping playbooks to case categories in platforms like Cortex XSOAR. Option B is not required because playbooks are defined as declarative workflows (YAML/JSON), not compiled binaries, and Windows execution is handled by integrations or scripts rather than an attached binary. Option D is incorrect and actively discouraged because hardcoding plain-text passwords violates security best practices; credentials should be stored in a secrets manager or credential store and referenced securely.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 13

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

Accepted Answer

Task. A Regular task (or Task) in an XSOAR playbook is used to run integration commands, automation scripts, or built-in actions directly.

Answer

Condition

Answer

Data Collection

Answer

Parallel

Question 14

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Accepted Answer

In the task's Conditions tab using pre-conditions or filtering rules. Task-level conditional filtering (such as checking previous task results or verdicts) is configured in the Conditions tab of the task properties.

Answer

In the Incident Fields configuration menu

Answer

In the playbook Details tab under Script arguments

Answer

By writing a separate Condition task before every single integration task

Question 15

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

Accepted Answer

Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.. To pass incident fields or context data to a sub-playbook, the engineer uses the Context or Incident field selector in the sub-playbook task configuration, referencing the path such as ${incident.ipaddresses}.

Answer

Write a custom Python automation script to manually push the incident field into the sub-playbook context every time.

Answer

Hardcode the IP addresses into the sub-playbook's default argument values.

Answer

Create a global variable in the Server Configuration settings.