Cortex XSOAR And Automation

You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?

If an automation script is taking too long to run, how can you improve its performance?

Which TWO settings are configurable within an Integration Instance?

You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?

Where can you view the 'Context Data' for a specific incident?

You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?

You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Which THREE of the following are valid components of a standard Content Pack?

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

Which TWO actions are commonly performed during the 'Pre-processing' phase of incident ingestion?

An organization requires that sensitive PII data in incident notes is redacted before being sent to an external ticketing system. What is the most efficient way to perform this transformation in XSOAR?

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

When designing a custom layout, how do you make a field read-only for specific roles?

A Python script is failing with an 'Integration not found' error during execution. You have confirmed the integration is enabled. What is the likely issue?

Which TWO of these are valid methods to trigger an automated playbook?

You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?

Which THREE factors influence the performance of playbook execution?

Which THREE of the following are valid methods for triggering a playbook in Cortex XSOAR?

A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?

When configuring a new integration, you need to restrict the integration's access to only a subset of incident types. Which feature should be used?

You want to trigger a playbook automatically whenever a new indicator is created of a specific type. Where is this configuration set?

Which THREE of the following represent core components of a Cortex XSOAR incident?

You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Which THREE types of tasks can be added to a playbook workflow?

Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?

An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?

Which mechanism in Cortex XSOAR ensures that concurrent tasks do not attempt to update the same incident field simultaneously, causing a race condition?

Which THREE actions are available when configuring a 'Condition' task?

A playbook task is configured to run on a 'Worker' group. If you see the task stuck in 'Pending' state, what is the most likely cause?

A security analyst wants to ensure that specific indicators extracted from email alerts are automatically enriched upon ingestion. Which component should the analyst configure to achieve this?

A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?

What is the function of a 'Transformer' in a mapper?

Which object type should you use to store configuration data that needs to be accessed globally across multiple playbooks?

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Which THREE actions can be performed from the Incident 'Work Plan' tab?

You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?

What happens if a playbook task is configured to 'Continue on error' and the task fails?