XSOAR-Engineer Use Case Planning And Development — Timed 10 Questions

Question 1

A security architect is designing an incident classification taxonomy in XSOAR for a multi-tenant MSSP environment. Different clients require different playbook execution paths based on their subscription tier. Where should the architect configure this logic?

10 minute time limit — choose an answer to begin.

Accepted Answer

In Incident Types and Classifiers, mapping incoming tags to specific incident types and default playbooks.. In XSOAR, incident types and classifiers are the central configuration points for routing and categorizing incoming incidents. Classifiers map raw incoming data (e.g., from a SIEM or email) to specific incident types based on predefined rules, and each incident type can have a default playbook assigned. This allows multi-tenant MSSPs to define different incident types per client tier and automatically trigger the appropriate playbook based on subscription level.

Answer

Inside the server configuration (Settings > About > Troubleshooting) using global JSON overrides.

Answer

Within the integration instance configuration parameter list as static environment variables.

Answer

By hardcoding tenant checks into every individual task script using Python sys.argv.

Question 2

When planning a new automation use case, an XSOAR analyst needs to reference documentation and example code for built-in automation scripts and commands. Where within the XSOAR UI can this reference library be accessed directly?

Accepted Answer

In the Automation library (Playbooks > Scripts or Settings > Integrations > Automation).. The Automation library in XSOAR is the central repository for built-in automation scripts and commands, accessible via Playbooks > Scripts or Settings > Integrations > Automation. It provides documentation, example code, and the ability to create or edit scripts. This is where analysts reference and manage automation logic directly within the UI.

Answer

Within the incident list view column selector.

Answer

In the user profile settings under password reset.

Answer

Inside the dashboard widget editor.

Question 3

An XSOAR architect is designing high availability and disaster recovery (HA/DR) architecture for an enterprise deployment. Which THREE architectural elements are critical for ensuring seamless failover and data integrity? (Choose THREE)

Accepted Answer

Synchronizing Elasticsearch node clusters to maintain consistent search and context storage.. Clustered PostgreSQL database, synchronized Elasticsearch indices, and redundant remote engines or server nodes are vital for enterprise HA/DR.

Answer

Backing up log files manually to a USB flash drive once a year.

Answer

Running all integrations on a single unmanaged workstation without clustering.

Question 4

A security team is planning a new XSOAR playbook that must automatically create a ServiceNow ticket whenever a phishing incident is created. The team wants to ensure that the ticket is created only once and that the ticket number is stored on the incident for later use. Which XSOAR feature should they configure in the playbook to achieve this requirement?

Accepted Answer

Use the 'Create Record' task from the ServiceNow v2 integration and set the task to run only if the incident does not already have a ticket number.. The requirement is to create a ServiceNow ticket once per phishing incident and store the ticket number. Using the ServiceNow v2 integration's 'Create Record' task with a condition that checks for an existing ticket number ensures idempotency. This leverages built-in integration capabilities and stores the ticket number in the incident context for later use.

Answer

Use the 'ServiceNow Incident' integration with the 'create' command and set the task to run unconditionally, relying on ServiceNow's duplicate detection.

Answer

Configure a scheduled job that runs every hour and creates a ServiceNow ticket for any phishing incident without a ticket.

Answer

Create a custom automation script that calls the ServiceNow REST API directly and stores the response in the incident context.

Question 5

A security team is planning a new playbook that will automate the response to malware incidents. The playbook must perform several actions: isolate the infected endpoint using a supported EDR integration, block the malware hash on the firewall, and create a ticket in the ticketing system. The engineer wants to ensure that if any action fails, the playbook stops and notifies the analyst. Which playbook design element should be configured to achieve this?

Accepted Answer

Configure each task to use the 'Stop on error' option.. To ensure the playbook stops on any action failure, each critical task must be configured with 'Stop on error'. This setting halts the playbook and can trigger notifications. Other options either allow continuation on error, require manual conditionals, or incorrectly use run mode. The correct approach leverages built-in error handling for reliability.

Answer

Set the task 'Continue on error' to true for all tasks.

Answer

Use a conditional task after each action to check the result and manually stop the playbook.

Answer

Set the playbook's 'Run mode' to 'Stopped' before execution.

Question 6

An XSOAR architect is planning a playbook that must handle a high volume of incidents and include a loop over a list of indicators to perform enrichment. The loop should process each indicator sequentially, and if any enrichment fails, the playbook should retry up to three times before moving to the next indicator. Which XSOAR feature should the architect use to implement this loop with retry logic?

Accepted Answer

Use a script task that iterates over the list and calls the enrichment command with retry logic in Python.. A script task provides the necessary control to iterate over a list, execute enrichment commands, and implement retry logic. By using demisto.executeCommand, the script can call the integration command for each indicator, check the result, and retry up to three times on failure before proceeding. This meets the requirements for sequential processing and error handling.

Answer

Use the built-in loop task with a list input and configure retry settings on the enrichment task.

Answer

Use a sub-playbook that contains the enrichment tasks, and call it in a loop using a condition task.

Answer

Use a manual task for each indicator and have the analyst retry on failure.

Question 7

An XSOAR engineer is planning a playbook that must extract indicators from various incident artifacts and then enrich them using threat intelligence integrations. Which TWO methods can be used to extract indicators from incident data within a playbook task? (Choose two.)

Accepted Answer

Running a custom Python script that uses regular expressions to parse the data. The built-in ExtractIndicators automation and custom Python scripts are both valid methods to extract indicators from incident data within a playbook task. The automation provides a quick, pre-built solution, while a custom script offers flexibility for specific parsing needs. Other options either operate at different stages (ingestion or incident creation) or are not actual commands, so they cannot be used within a playbook task for extraction.

Answer

Configuring an indicator extraction rule in the integration instance settings

Answer

Enabling the automatic indicator extraction option in the incident type settings

Answer

Using the 'extractIndicators' command in a command-line task

Question 8

An XSOAR engineer is planning a playbook that will enrich indicators using multiple threat intelligence sources. The playbook must extract indicators from incident fields, deduplicate them, and then enrich each unique indicator. Which TWO tasks or features should be used to achieve this efficiently? (Choose two.)

Accepted Answer

Use the 'Enrich Indicators' task to enrich each unique indicator with threat intelligence.. To efficiently extract and enrich indicators, the engineer should use the 'Extract Indicators' task to parse indicators from incident fields, and then the 'Enrich Indicators' task to enrich them. Deduplication is important but is not a standalone task; it can be done via scripting or formatting. The combination of these two tasks covers the core requirements.

Answer

Use the 'Deduplicate' task to remove duplicate indicators from the list.

Answer

Use the 'Indicator Enrichment' sub-playbook to automatically enrich all indicators.

Answer

Use the 'Create Indicators' task to generate new indicators from the extracted data.

Question 9

An XSOAR engineer is designing a playbook that must extract indicators from various sources (email, SIEM, endpoint) and deduplicate them before enrichment. The engineer wants to ensure that duplicate indicators are not enriched multiple times to save API calls. Which approach should the engineer take?

Accepted Answer

Use the 'ExtractIndicators' command to extract indicators, then use the 'GetDuplicates' script to remove duplicates before enrichment.. Extracting indicators and then deduplicating with the 'GetDuplicates' script ensures that only unique indicators are enriched. This approach minimizes API calls and is efficient. It leverages built-in XSOAR commands, which are designed for this purpose and are more maintainable than custom scripts or relying on integration behavior.

Answer

Use a single enrichment task that processes all indicators at once, relying on the integration to handle duplicates internally.

Answer

Use a script to manually parse each source and store indicators in a set, then enrich each unique indicator individually.

Answer

Configure the enrichment integration to cache results so that duplicate indicators return cached data without API calls.

Question 10

An XSOAR engineer is designing a playbook that must handle a high volume of phishing incidents. The playbook needs to extract URLs from the email body, check them against a blocklist, and if any URL is malicious, create a ticket in Jira and send an email to the security team. The engineer wants to minimize the number of tasks and ensure that the playbook stops processing further URLs once a malicious one is found. Which approach should the engineer take?

Accepted Answer

Use a 'Foreach' task to iterate over URLs, and within it, use a condition to check if a malicious URL has already been found; if so, skip further checks.. To stop processing further URLs once a malicious one is found, the engineer can use a 'Foreach' task with a condition that checks if a malicious URL has already been detected. If so, the check is skipped for subsequent URLs. This approach works within XSOAR's capabilities and minimizes unnecessary checks, while still allowing ticket creation and email notification after the loop.

Answer

Use a 'Foreach' task to iterate over URLs, and within it, check each URL against the blocklist. If a malicious URL is found, use a 'break' condition to exit the loop and proceed to ticket creation.

Answer

Use a 'GenericPolling' task to poll the blocklist for each URL sequentially and stop when a malicious one is found.

Answer

Use a 'Foreach' task with parallel execution to check all URLs simultaneously, then aggregate results and proceed if any are malicious.