Cortex XSOAR And Automation

You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?

If an automation script is taking too long to run, how can you improve its performance?

Which TWO settings are configurable within an Integration Instance?

A Cortex XSOAR engineer is building a playbook that must run a specific enrichment task only when a prior task completes with a status of 'Failed'. Where in the playbook task configuration should the engineer define this conditional behavior?

A security analyst is creating a new Cortex XSOAR playbook and wants to add a task that sends an email notification to the incident owner. Which task type should the analyst select to achieve this?

You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?

Where can you view the 'Context Data' for a specific incident?

An automation engineer is creating a playbook in Cortex XSOAR that must run a custom Python script to parse a raw email attachment. The script requires access to the incident's custom field 'attachment_hash' and must return a dictionary with keys 'verdict' and 'score'. Which task type should be used, and how are inputs and outputs configured for this task?

You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

A security team is using Cortex XSOAR to automate phishing investigations. An engineer needs to store the original sender's email address from the incident's custom fields into a playbook context key for later use in a conditional task. Which of the following is the correct way to reference and assign this value?

A SecOps engineer is building a Cortex XSOAR playbook to process phishing incidents. They need a task that will execute a custom Python script to parse email headers and then pass the extracted sender domain to the next task. Which type of playbook task should they use to run the custom Python code?

A SOC analyst is building a playbook in Cortex XSOAR to automate the investigation of suspicious login alerts. The playbook needs to query an external threat intelligence platform for the reputation of the source IP address. Which type of task should the analyst use to perform this action?

Which THREE of the following are valid components of a standard Content Pack?

While designing a playbook, an automation engineer needs a task to execute only when the incident severity is exactly 'High'. Which of the following conditions should be used in the task's 'Run if' field?

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

You are creating a new playbook and need to add a task that will send an email to the security team with the details of the incident. Which task type should you use to accomplish this?

A security engineer is creating a custom integration that requires a secure API key to be stored and used across multiple playbooks. Where should the API key be configured to ensure it is securely stored and easily accessible?

An organization requires that sensitive PII data in incident notes is redacted before being sent to an external ticketing system. What is the most efficient way to perform this transformation in XSOAR?

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

When designing a custom layout, how do you make a field read-only for specific roles?

A Cortex XSOAR administrator needs to ensure that a specific playbook only runs when an incident is created with a severity of 'High' and the incident type is 'Phishing'. Which configuration should they use to enforce this condition?

A Cortex XSOAR engineer is designing a playbook that requires user interaction to approve a remediation action. The engineer needs to configure a task that pauses the playbook until an analyst responds. Which two task types can be used to achieve this? (Choose two.)

You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?

Which THREE factors influence the performance of playbook execution?

During playbook development, an engineer needs to store a list of suspicious IP addresses extracted from an incident into a context key that can be accessed by multiple tasks. Which context key should they use to ensure the data is available throughout the playbook?

A Cortex XSOAR engineer is designing a playbook to automate the response to a phishing incident. They need to ensure that the playbook can handle cases where the email contains attachments. Which two tasks should they include to extract and analyze attachments? (Choose two.)

A Cortex XSOAR administrator needs to ensure that a custom integration script can access an API key stored securely without hardcoding it in the script. Which method should be used to store and retrieve the API key?

You are building a playbook that must handle incidents differently based on the severity of the alert. The severity is stored in the incident field 'severity' as an integer (0-4). You want to conditionally execute a task only when severity is 3 or higher. Which built-in playbook task type should you use to evaluate this condition and route the workflow accordingly?

A playbook task that runs a reputation command on an IP address is taking a long time to complete. The analyst wants to limit the task's execution time to 5 minutes and automatically mark it as failed if it exceeds that limit. Which configuration should be applied to the task?

Which THREE of the following represent core components of a Cortex XSOAR incident?

You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

A security analyst needs to ensure that a playbook only proceeds to the containment phase if the severity of the incident is 'High' or 'Critical'. The severity is stored in the incident field 'severity'. Which task type should be used to implement this branching logic?

Which THREE types of tasks can be added to a playbook workflow?

Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?

An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?

A playbook task is configured to run on a 'Worker' group. If you see the task stuck in 'Pending' state, what is the most likely cause?

A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?

What is the function of a 'Transformer' in a mapper?

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?

You are designing a playbook that must extract indicators from an incident's attachments. The attachments can be of various file types, including PDF and text. You want to use a built-in script to extract indicators such as IPs, URLs, and hashes from these files. Which Cortex XSOAR script should you use for this purpose?

Which THREE actions can be performed from the Incident 'Work Plan' tab?

What happens if a playbook task is configured to 'Continue on error' and the task fails?