XSOAR-Engineer Playbook Development — Timed 15 Questions

Question 1

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. Playbooks are built and managed within the Playbooks section of the XSOAR UI.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 2

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task is designed specifically to pause playbook execution and present a form or prompt to a human analyst for review and input.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 3

An engineer is writing a playbook expression to filter a list of endpoints from context. They want to return only the endpoints where the 'OS' field equals 'Windows'. Which built-in transformer syntax is correct?

Accepted Answer

Using the 'Val' transformer with a conditional expression like 'val.OS == \'Windows\''. The grep transformer or filter syntax using jq-like syntax or XSOAR built-in transformers is used. Specifically, the 'Access' or 'Filter' transformer with condition syntax is applied.

Answer

${Endpoints.OS(val == 'Windows')}

Answer

${Endpoints | filter(OS == 'Windows')}

Answer

${Endpoints.[?(OS == 'Windows')] }

Question 4

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Accepted Answer

Reference the context path using the ${Email.Body} syntax in the argument field. Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Answer

Hardcode the expected string value directly into the task argument field

Answer

Store the value in a server-wide environment variable and call os.environ

Answer

Write a custom integration instance configuration for that specific email

Question 5

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

Accepted Answer

A Conditional Task. A Conditional Task allows an XSOAR engineer to evaluate conditions and route the playbook execution path to different branches based on the results.

Answer

A Data Collection Task

Answer

A Loop Task with an exit filter

Answer

A standard task with a Post-processing script

Question 6

An engineer has configured a Loop Task in a playbook to iterate over a list of 50 IP addresses. To prevent the playbook from timing out or overwhelming the external API, the engineer needs to execute batches of 10 items concurrently. Where is this concurrency setting configured?

Accepted Answer

In the Loop tab of the specific playbook task properties drawer. In XSOAR loop task configurations, the concurrency or batch size can be defined under the task's Loop configuration settings to control parallel execution limits.

Answer

In the playbook-level JSON file under the 'canvas' properties

Answer

In the integration instance settings for the executed command

Answer

In the global server configuration (Server Settings -> Incidents)

Question 7

You need to ensure that a playbook task execution fails gracefully if the underlying integration command returns an error, allowing the playbook to continue down an alternative error-handling path. Which setting must you configure on the task?

Accepted Answer

Set 'Continue on error' under the task's Error Handling tab. By configuring the 'On error' setting of a task, an engineer can dictate whether a failure stops the playbook, continues, or routes down a specific error branch.

Answer

Enable 'Skip task if empty' in the Task Details

Answer

Wrap the command in a try-except Python wrapper inside the playbook UI

Answer

Add a Post-processing script that catches exceptions

Question 8

An XSOAR Engineer is configuring a playbook task and needs to reference the output of a previous task named 'Get Incident Details'. Which syntax is correct to access the 'ID' key from that task's output context?

Accepted Answer

${GetIncidentDetails.ID}. Task outputs are stored in the Incident Context using the naming convention ${TaskName.Key}. Therefore, ${GetIncidentDetails.ID} correctly retrieves the ID from the specified task.

Answer

${incident.GetIncidentDetails.ID}

Answer

${task.GetIncidentDetails.ID}

Answer

$GetIncidentDetails[ID]

Question 9

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. Data collection tasks allow mapping user inputs directly to incident fields using the task's 'Mapping' or 'Assign to Incident Field' settings.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 10

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

Accepted Answer

It passes the list as a comma-separated string or array to the script argument based on argument definitions.. XSOAR automatically flattens or serializes list context outputs into comma-separated strings or passes them as array structures depending on argument definitions when referenced in task inputs.

Answer

It throws a validation error unless wrapped in a string transformer.

Answer

It passes only the first item in the list and discards the rest.

Answer

It converts the list into a JSON object and stores it in a temporary file.

Question 11

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

Accepted Answer

JSON. Playbooks and other content items in XSOAR are exported and packaged in JSON format.

Answer

XML

Answer

CSV

Answer

YAML

Question 12

An engineer has completed building a new playbook and wants to test it on a live incident without affecting production data. What is the recommended method to test playbook modifications?

Accepted Answer

Run the playbook on a test incident in an XSOAR test environment or development instance. Engineers can test playbooks on existing test incidents or use the Playground feature within an incident to run specific tasks or playbooks safely.

Answer

Export the playbook as a zip file and import it into a dashboard widget

Answer

Delete the old playbook and publish the new one directly to production

Answer

Enable 'Debug Mode' in server configurations and restart the service

Question 13

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. Playbook task conditions evaluate context paths and expressions to determine whether the task should execute or be skipped.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 14

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

Accepted Answer

Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.. By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Answer

Sub-playbooks share the exact same global context without any isolation or scoping.

Answer

All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.

Answer

Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.

Question 15

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

Accepted Answer

Loop Task. A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Answer

Data Collection Task

Answer

Parallel Task Group

Answer

Conditional Task