XSOAR-Engineer Playbook Development Practice Test 5 — 15 Questions

Question 1

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prompt Task. A Prompt Task in Cortex XSOAR is designed to pause playbook execution and present a question or decision to an analyst, allowing them to review indicators and choose to block or ignore. This task type is specifically built for human-in-the-loop interactions, ensuring analyst input before proceeding. It supports customizable prompts and response options.

Answer

Loop Task

Answer

Data Enrichment Task

Answer

Command Task

Question 2

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

Accepted Answer

The Loop feature configured directly on the task properties. To iterate over a list of items in XSOAR context, the engineer uses the Loop feature on the task, specifying the target context array.

Answer

A transformer function in the mapping section

Answer

A sub-playbook with parallel task execution

Answer

A Condition task evaluating the length of the Account array

Question 3

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

Accepted Answer

Use a context transformer or custom mapper in the task's Edit Outputs section to map 'IPAddress' to 'IP'.. XSOAR allows the use of built-in context transformers and custom mappers in playbook task settings to rename and restructure output keys.

Answer

Run a command to delete the context and recreate it using standard Python scripts.

Answer

Modify the global incident type schema to automatically alias IPAddress as IP.

Answer

Rename the integration instance name to match the desired output key.

Question 4

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Accepted Answer

Condition. Option B, Condition, is correct because a condition task evaluates a defined expression against playbook context data and branches execution down different paths depending on whether the result is true or false, which is exactly how XSOAR playbooks control decision-based flow. Option D, Parallel, is correct because a parallel task splits execution into multiple concurrent branches, allowing several task sequences to run simultaneously and then optionally rejoin, which directly controls the execution path and concurrency of the playbook. The unmarked options do not belong: Credential (A) is a task input/parameter type used to supply stored credentials to a task rather than a flow-control task, Enrichment (C) refers to tasks that query integrations to add data to the incident context rather than direct branching logic, and Mirroring (E) is an incident-level feature for syncing fields and entries with external systems such as ticketing platforms, not a playbook flow-control task type.

Answer

Credential

Answer

Enrichment

Answer

Mirroring

Question 5

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

Accepted Answer

Configure the playbook trigger rules or associate it with an incident type that excludes automatic classifier fetching.. Playbooks can be restricted by type or execution triggers. To prevent automatic triggering while allowing manual execution, the playbook should be associated with specific incident types or configured as manual-only.

Answer

Disable the integration instance responsible for email fetching.

Answer

Set the playbook role restriction to Administrator only.

Answer

Delete the start task of the playbook.

Question 6

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Option A is correct because a Content Pack must declare its integration dependencies (or the specific integration commands the playbook invokes) so that the target production environment has the required integrations installed and configured before the playbook runs. Option D is correct because custom automation scripts and transformers referenced by playbook tasks are not built-in and must be packaged or referenced in the pack, otherwise tasks will fail with missing-script errors. Option E is correct because any dependent sub-playbooks called by the main playbook must also be included or referenced in the pack, since sub-playbooks are separate content items and will not resolve automatically in the target environment. Option B is not correct because war room chat logs are runtime artifacts of the development environment, not deployable content, and are irrelevant to pack installation or execution. Option C is not correct because analyst credentials and password hashes are environment-specific secrets that should never be exported in a Content Pack and are not required for the playbook to install or run.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.

Question 7

An engineer is building a playbook that must run a set of enrichment tasks only when the incident severity is at least 'High'. The severity field is already populated in the incident context. The engineer wants to avoid duplicating tasks for each possible severity value. Which approach is most appropriate?

Accepted Answer

Add a condition task that evaluates the severity field and routes to a single branch for High and Critical severities.. A condition task is the native mechanism for branching on incident fields such as severity. By grouping High and Critical into a single branch with a logical condition, the engineer avoids duplicating enrichment tasks and enforces the severity threshold automatically. The other approaches either require manual effort, create unnecessary playbook sprawl, or do not evaluate the severity field at all.

Answer

Use a data collection task to read the severity value and then continue unconditionally.

Answer

Create four separate playbooks, one per severity level, and trigger each via a separate incident type.

Answer

Add a manual task that asks the analyst to confirm the severity before enrichment runs.

Question 8

You are building a playbook that must run a series of tasks in parallel to save time. After all parallel branches complete, you need to consolidate their outputs and continue with a single task. Which task type should you use to wait for all parallel branches to finish before proceeding?

Accepted Answer

Join task. When parallel branches are used, a Join task acts as a synchronization point. It waits for all incoming branches to finish before allowing the playbook to continue. This ensures that all parallel tasks have completed and their outputs are available before the next task runs. Other task types do not provide this built-in waiting behavior for multiple branches.

Answer

Manual task

Answer

Conditional task

Answer

Standard task

Question 9

An engineer wants a playbook to dynamically decide the next task based on a severity value that is computed at runtime by a script. The playbook must branch to different tasks depending on whether the computed severity is 'High', 'Medium', or 'Low'. Which task type should be used to achieve this dynamic branching?

Accepted Answer

Conditional task. A conditional task evaluates custom conditions against the incident context at runtime, enabling the playbook to follow different paths based on computed values such as severity. This is the intended mechanism for dynamic branching in Cortex XSOAR playbooks. Other task types either execute a single action, collect input, or require manual completion, and do not provide conditional routing.

Answer

Data collection task

Answer

Standard task

Answer

Manual task

Question 10

You are creating a playbook that includes a task to query a threat intelligence integration. The integration command returns a list of indicators, but you only want to proceed if the list is not empty. Which playbook task configuration should you use to evaluate the result and branch accordingly?

Accepted Answer

Add a Conditional task after the integration task and set the condition to check if the indicator list is not empty.. To branch based on the output of an integration task, you need a Conditional task. It can evaluate the indicator list and route execution down the appropriate path. The integration task itself does not provide conditional branching; it only returns data. A Conditional task is the correct way to implement logic that checks for non-empty results and proceeds accordingly.

Answer

Use a Standard task with a script that checks the list and then manually routes the playbook by setting a context key.

Answer

Add a Manual task that asks the analyst to review the list and decide whether to continue.

Answer

Configure the integration task to only return results if the list is not empty by setting a filter in the command arguments.

Question 11

An engineer is designing a playbook that must iterate over a list of IP addresses stored in the incident context under the key 'IPs'. For each IP, the playbook should run a reputation check and then add a note to the incident. Which playbook task type should be used to loop over the list and execute the sub-tasks for each item?

Accepted Answer

For-each task. The For-each task is specifically designed to iterate over a list and execute a set of sub-tasks for each element. In this scenario, it will loop through the 'IPs' list, run the reputation check, and add a note for each IP. This provides a clean, maintainable way to handle repetitive actions without manual intervention or custom scripting.

Answer

Conditional task

Answer

Manual task to select each IP and trigger the sub-tasks

Answer

Standard task with a script that loops internally

Question 12

An engineer is creating a playbook that needs to send an email notification to the security team when a high-severity incident is detected. The engineer wants to include the incident ID and severity in the email body. Which task type should be used to compose and send the email?

Accepted Answer

A standard task that calls the 'send-mail' integration command with the necessary arguments.. The 'send-mail' integration command is designed for sending emails from playbooks. By using a standard task that calls this command, the engineer can automatically compose and send an email with dynamic content from the incident context, such as ID and severity. Other task types are not intended for sending emails or would require manual intervention.

Answer

A manual task that prompts the analyst to send an email manually.

Answer

A condition task that evaluates the severity and then uses a transformer to send an email.

Answer

A data collection task that gathers email content from the analyst before sending.

Question 13

A playbook task is configured to run a command that returns a large JSON object. The engineer wants to store only a specific nested field from the command result into the incident context for later use. Which task configuration should be used?

Accepted Answer

In the task's 'Outputs' section, map a new context key to the nested field using the command's context path.. The Outputs section of a task is designed to map values from the command result to context keys. By specifying the correct context path for the nested field, the engineer can store just that value. This keeps the context concise and ensures later tasks can reference the specific data without parsing large JSON objects or requiring manual intervention.

Answer

Add a 'Data Collection' task that asks the analyst to manually copy the nested field from the command result.

Answer

Enable 'Store raw output' and then use a 'Set' task to copy the entire JSON object into a new key.

Answer

Use a 'Transform' task with a JSONPath expression to extract the field and write it directly to the incident context.

Question 14

An engineer is designing a playbook that includes a sub-playbook to perform IP enrichment. The sub-playbook returns a list of enriched IPs in its context under the key 'EnrichedIPs'. The engineer wants to access this list in the parent playbook to use in a subsequent task. Which syntax should be used to reference the list in the parent playbook task?

Accepted Answer

The engineer must configure the sub-playbook task's outputs to map 'EnrichedIPs' to a parent context key, then reference that key.. Sub-playbook outputs must be explicitly mapped to parent context keys in the sub-playbook task's outputs configuration. Without this mapping, the parent playbook cannot directly access the sub-playbook's internal context. Once mapped, the engineer can reference the parent key in subsequent tasks. This design enforces clear data flow between playbooks.

Answer

${subplaybook.EnrichedIPs}

Answer

${SubPlaybookName.EnrichedIPs}

Answer

${EnrichedIPs}

Question 15

An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?

Accepted Answer

Manual task. A manual task is specifically designed to pause playbook execution and present a customizable form for human input. It is the appropriate task type for manual approvals, allowing the analyst to approve or reject an action before the playbook continues. Other task types either automate execution, evaluate conditions, or collect data without a built-in approval mechanism.

Answer

Data collection task

Answer

Standard task

Answer

Conditional task