A security architect is designing an incident classification taxonomy in XSOAR for a multi-tenant MSSP environment. Different clients require different playbook execution paths based on their subscription tier. Where should the architect configure this logic?
When planning a new automation use case, an XSOAR analyst needs to reference documentation and example code for built-in automation scripts and commands. Where within the XSOAR UI can this reference library be accessed directly?
An XSOAR architect is designing high availability and disaster recovery (HA/DR) architecture for an enterprise deployment. Which THREE architectural elements are critical for ensuring seamless failover and data integrity? (Choose THREE)
A security team is planning a new XSOAR playbook that must automatically create a ServiceNow ticket whenever a phishing incident is created. The team wants to ensure that the ticket is created only once and that the ticket number is stored on the incident for later use. Which XSOAR feature should they configure in the playbook to achieve this requirement?
A security team is planning a new playbook that will automate the response to malware incidents. The playbook must perform several actions: isolate the infected endpoint using a supported EDR integration, block the malware hash on the firewall, and create a ticket in the ticketing system. The engineer wants to ensure that if any action fails, the playbook stops and notifies the analyst. Which playbook design element should be configured to achieve this?
An XSOAR architect is planning a playbook that must handle a high volume of incidents and include a loop over a list of indicators to perform enrichment. The loop should process each indicator sequentially, and if any enrichment fails, the playbook should retry up to three times before moving to the next indicator. Which XSOAR feature should the architect use to implement this loop with retry logic?
An XSOAR engineer is planning a playbook that must extract indicators from various incident artifacts and then enrich them using threat intelligence integrations. Which TWO methods can be used to extract indicators from incident data within a playbook task? (Choose two.)
An XSOAR engineer is planning a playbook that will enrich indicators using multiple threat intelligence sources. The playbook must extract indicators from incident fields, deduplicate them, and then enrich each unique indicator. Which TWO tasks or features should be used to achieve this efficiently? (Choose two.)
An XSOAR engineer is designing a playbook that must extract indicators from various sources (email, SIEM, endpoint) and deduplicate them before enrichment. The engineer wants to ensure that duplicate indicators are not enriched multiple times to save API calls. Which approach should the engineer take?
An XSOAR engineer is designing a playbook that must handle a high volume of phishing incidents. The playbook needs to extract URLs from the email body, check them against a blocklist, and if any URL is malicious, create a ticket in Jira and send an email to the security team. The engineer wants to minimize the number of tasks and ensure that the playbook stops processing further URLs once a malicious one is found. Which approach should the engineer take?
An XSOAR engineer is planning a playbook that must extract and transform data from a JSON API response. The engineer needs to extract a list of user email addresses from a nested JSON structure and then filter out internal domains. Which THREE actions should the engineer use to accomplish this? (Choose three.)
An XSOAR engineer is designing a playbook that must dynamically determine which sub-playbook to run based on the incident's 'Category' field. The categories can be 'Malware', 'Phishing', or 'Network'. The engineer wants to avoid multiple conditional tasks and instead use a single task that selects the appropriate sub-playbook. Which XSOAR feature should be used?
An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?
An XSOAR engineer is designing a SOC workflow that ingests thousands of alerts per hour from a cloud security posture management tool. Many alerts represent duplicate or recurring findings for the same asset within a short window. How should the engineer design the ingestion and processing flow to prevent incident fatigue?
During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?
An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?
When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?
An automation engineer is designing a complex incident investigation workflow where sub-playbooks are invoked dynamically based on asset criticality extracted during enrichment. Which XSOAR playbook feature allows calling another playbook conditionally based on incident context?
An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?
An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?
An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?
An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?
When planning an automated incident response workflow for endpoint isolation, an engineer wants to ensure that analysts receive immediate real-time desktop notifications whenever a critical incident requires manual intervention. Which XSOAR feature should be integrated into the playbook?
When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?
An organization is planning an XSOAR use case for vulnerability management triage. Vulnerability scans produce hundreds of thousands of findings daily. To prevent XSOAR from running out of memory or overwhelming the database, what is the best practice for ingestion planning?
An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?
An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?
An XSOAR architect is designing custom incident layouts for a new ransomware response use case. The SOC team needs to see critical file hashes, affected machine names, and containment status immediately upon opening an incident. Where should the architect configure these visual elements?
An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?
An enterprise XSOAR administrator is planning the deployment of remote engines (DEX - Demisto Execution Engines) across multiple isolated regional network zones. What is the primary architectural purpose of deploying remote engines in this scenario?
An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?
An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?
An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?
An XSOAR architect is designing an automated incident lifecycle where incidents that remain unresolved after 72 hours must be automatically escalated to senior management and assigned a specific tag. Which XSOAR feature is designed to execute logic based on time-based triggers or SLAs?
An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?
An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?
When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)
An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?
An XSOAR architect is designing a SOC workflow where critical alerts from a SIEM must bypass the standard queue and immediately trigger an urgent page to the on-call engineer. Which integration category and playbook design pattern should be utilized?
An XSOAR architect is designing incident data ingestion flows. Which TWO mechanisms can be used to filter or modify incoming raw events before they are officially created as XSOAR incidents? (Choose TWO)
When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)
An XSOAR administrator is planning security and access controls for a multi-team SOC deployment. Which THREE components are essential when configuring Role-Based Access Control (RBAC) and data permissions? (Choose THREE)
When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)
An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)
An XSOAR implementation team is planning threat intelligence management workflows. Which THREE capabilities does XSOAR provide natively for managing and acting upon threat indicators? (Choose THREE)
When planning advanced playbook logic and data manipulation in XSOAR, which THREE methods can be used to extract, filter, or transform data within playbook tasks? (Choose THREE)
An XSOAR architect is designing an automated incident response workflow that requires human approval before executing destructive remediation actions. Which THREE design patterns or features should be incorporated to handle human interaction securely and effectively? (Choose THREE)
When planning the deployment of XSOAR integrations, which TWO configuration steps are typically required to connect an integration instance to an external product (e.g., a firewall or SIEM)? (Choose TWO)
An XSOAR architect is planning automated reporting and stakeholder notification workflows. Which THREE methods are supported for distributing reports or alert summaries to stakeholders outside the SOC? (Choose THREE)
An XSOAR automation engineer is planning incident classification and routing for incoming multi-source alerts. Which THREE elements must be considered when designing the mapping between incoming raw event fields and XSOAR incident fields? (Choose THREE)
A security team is planning an XSOAR playbook that must dynamically route incidents to different sub-playbooks based on the severity of the incident, which is stored in a custom incident field named 'incidentseverity'. The playbook should evaluate this field and then call the appropriate sub-playbook. Which XSOAR feature should the engineer use to implement this conditional branching?
An XSOAR engineer is designing a playbook that needs to extract the source IP address from an incident's details and then enrich it using a threat intelligence integration. The IP address is stored in the incident field 'sourceip'. Which XSOAR feature allows the playbook to pass this field value as an input to the integration command?
An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must automatically extract all indicators from the incident, enrich them using multiple threat intelligence integrations, and then calculate a severity score based on the enrichment results. The engineer wants to ensure that the playbook can be reused across different phishing incident types without modification. Which approach best meets these requirements?
An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must extract indicators from email attachments and then conditionally block malicious hashes on a firewall. The engineer wants to ensure that the playbook does not fail when an attachment is missing or when the firewall integration is unreachable. Which design approach best meets these requirements?
An XSOAR engineer is designing a playbook to automate phishing email triage using the Phishing incident type. The team wants each incoming phishing report to automatically trigger a sub-playbook that extracts indicators and checks reputation across configured threat intel integrations. Which XSOAR component should be configured to launch this sub-playbook automatically for every new phishing incident?
An XSOAR architect is planning a playbook for automated malware analysis. The playbook must submit files to a sandbox, retrieve the analysis report, and extract indicators. The sandbox integration may take variable time to return results, and the playbook must avoid blocking other tasks. Which TWO design elements are most appropriate to achieve this? (Choose two.)
An XSOAR engineer is designing a playbook that must handle incidents from a SIEM integration. The playbook needs to run a specific enrichment task only when the incident severity is High and the source IP is external. Which XSOAR feature should be used to implement this conditional logic within the playbook?
A large enterprise is using XSOAR to manage security incidents. The SOC manager wants to ensure that when a critical incident is created, an email notification is sent to the on-call team, and a Slack message is posted to the security channel. The notifications should include a link to the incident in XSOAR. The engineer needs to choose the most efficient way to implement this in a playbook. Which approach should the engineer take?
An XSOAR engineer is planning a playbook to handle phishing incidents. The playbook must send an email notification to the SOC manager only when the incident severity is 'High' and the phishing email contains at least one malicious attachment. Which approach should the engineer use to implement this conditional notification?
An XSOAR engineer is building a playbook for a new use case: automatically enriching IP addresses from a SIEM alert using a threat intelligence integration. The engineer wants to ensure that the playbook can be easily reused for different incident types. Which approach should the engineer take?
An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?
A security team is planning a new use case in XSOAR to automate the response to malware detections from an endpoint protection platform. The playbook must isolate the infected endpoint, collect forensic data, and notify the incident response team. Which initial step should the engineer take to ensure the playbook can execute these actions?
An XSOAR engineer is planning a playbook to handle malware incidents. The playbook must extract indicators from the incident, enrich them, and then decide whether to block them. The engineer wants to ensure that the playbook is modular and reusable across different incident types. Which TWO design approaches should the engineer use? (Choose two.)
An XSOAR engineer is designing a playbook that integrates with a ticketing system to create tickets for high-severity incidents. The playbook must avoid creating duplicate tickets if the incident is updated multiple times. Which method should the engineer use to track whether a ticket has already been created?
An XSOAR engineer is planning a new playbook for automated incident response. The playbook needs to run different branches based on the severity of the incident: if severity is 'High', it should trigger a full response; if 'Medium', a partial response; and if 'Low', just a notification. Which playbook task type should be used to implement this branching logic?
An XSOAR engineer is planning a new playbook for malware analysis. The playbook should run a series of tasks, and the engineer wants to ensure that if any task fails, the playbook continues to the next task without stopping. Which playbook setting should be configured to achieve this behavior?
A SOC is designing a new use case for XSOAR that must automatically enrich every newly created incident with data from an internal CMDB. The CMDB integration can only be queried by hostname, and the hostname is stored in a custom incident field named 'affectedhost'. The enrichment must run exactly once per incident and must not block the rest of the playbook if the CMDB is unreachable. Which XSOAR design element should the engineer use to meet these requirements?
An XSOAR engineer is planning a playbook for a new use case that must process incidents arriving from a third-party SIEM. The SIEM sends incidents with a severity value as a string ('low', 'medium', 'high') and the SOC wants the playbook to route incidents to different sub-playbooks based on that value, but also wants to be able to change the mapping later without editing the playbook. Which design approach best meets these requirements?
An XSOAR engineer is scoping a new use case that ingests alerts from a SIEM into XSOAR for automated triage. The SOC lead wants to know which native mechanism should be used to define how many alerts per minute XSOAR accepts and how the ingestion source is authenticated, without writing custom polling logic. Which XSOAR component should the engineer configure to meet this requirement?
An XSOAR engineer is designing a playbook that must decide whether to auto-remediate or escalate based on a risk score returned by an external scoring API. The API occasionally returns HTTP 500 errors, and the playbook must not silently proceed with a default branch when that happens. Which playbook design approach best satisfies this requirement?
A SOC team wants XSOAR to automatically create a case in their case management system whenever a high-severity incident is opened, and to close that case when the XSOAR incident is closed. The engineer is planning the use case and needs to identify the two lifecycle events that must be mapped. Which pair of XSOAR incident lifecycle events should the engineer plan for?
An XSOAR engineer is planning a use case that must deduplicate alerts arriving from a cloud workload protection platform before they become incidents, so that repeated alerts about the same resource within a short window are merged. Which TWO design elements should the engineer include in the plan? (Choose two.)
An XSOAR engineer is planning a use case where a playbook must pause and wait for an analyst to approve a destructive containment action before continuing. The approval may take hours, and the playbook must resume automatically once the analyst responds. Which XSOAR task type should the engineer use to implement this wait-and-resume behavior?