XSIAM-Analyst Practice Question: An automation script requires secure storage of an API token used to query an external…
An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?
⚠ Common exam trap
XSIAM-Analyst often tests whether candidates confuse data-storage locations (lookups, playbooks, dashboards) with the dedicated encrypted credential store, so the trap is picking any option that merely 'contains' the token rather than the one designed to protect it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integration Instance Configuration Parameters (marked as Encrypted/Password)
Integration Instance Configuration Parameters marked as Encrypted/Password are the designated secure store for credentials such as API tokens in Cortex XSIAM. When a parameter is flagged as encrypted, the value is stored in the tenant's credential vault and masked in the UI, so playbooks and integrations reference it without ever exposing the plaintext secret. This is the platform-supported pattern for secrets used by external threat intel feed queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Within unencrypted XQL lookup CSV files.
Why it's wrong here
XQL lookup CSV files are stored unencrypted and readable by anyone with query access, exposing the token to every analyst. It is tempting because lookups are the natural place for reference data an automation script can query, and would be correct for non-sensitive enrichment lists such as IP ranges or asset inventories.
- ✗
Hardcoded directly inside the playbook JSON file.
Why it's wrong here
Playbook JSON is exported, shared and version-controlled, so a hardcoded token leaks to anyone reading the file and cannot be rotated without editing the playbook. It is tempting because it works immediately with no configuration, which suits throwaway lab scripts, but production secrets belong in a Cortex XSIAM credential or secret store referenced at runtime.
- ✓
Integration Instance Configuration Parameters (marked as Encrypted/Password)
Why this is correct
Integration instance parameters marked encrypted or password are stored as protected credentials within Cortex XSIAM, and the automation retrieves them at runtime without exposing the token in scripts or logs. This satisfies the stem's secure-storage requirement for querying the external threat intel feed.
- ✗
Inside public dashboard notes.
Why it's wrong here
Dashboard notes are rendered to all viewers and stored in plaintext, so the token is disclosed to anyone who opens the dashboard. It is tempting because notes are quick to edit and visible to the automation author, and would be correct for sharing non-sensitive context such as investigation summaries or runbook links.
About these practice questions
This XSIAM-Analyst question is part of Courseiva's 327-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar XSIAM-Analyst questions
- A Cortex XSIAM playbook invokes a sub-playbook to perform malware analysis on an uploaded file. The sub-playbook can ret…
- Where in the Cortex XSIAM web interface can an administrator view the graphical flowchart and execution status of a curr…
- A Cortex XSIAM playbook calls an external ticketing integration that returns HTTP 429 when the request rate exceeds the…
- When developing custom Python automation scripts for Cortex XSIAM, which THREE best practices should be followed for mai…
- A Cortex XSIAM analyst is building a playbook that must enrich an indicator by querying an external threat intelligence…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This XSIAM-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSIAM-Analyst exam.