Automation And Playbooks practice questions

Wait for Analyst Review Task

Why it fails: Incorrect. This task pauses for human intervention, not automated webhooks.

Data Collection Task

Why it fails: Incorrect. Data collection gathers information immediately rather than pausing for an asynchronous external event.

Transformation Task

Why it fails: Incorrect. Transformation tasks process data and do not pause execution.

Automation > Playbooks > Mapping tab

Why it fails: Incorrect. Mapping is generally managed within Incident configuration settings.

Data Management > Parsers

Why it fails: Incorrect. Parsers handle incoming raw log ingestion, not playbook triggering.

XQL Search > Trigger Rules

Why it fails: Incorrect. XQL search is for querying, not configuring playbook associations.

Enable automatic database replication in settings.

Why it fails: Database replication settings govern data duplication between stores and have no bearing on playbook control flow or REST pagination tokens. It is tempting as a generic performance toggle, but implementing a do-while loop requires a playbook loop construct that iterates while the API returns a next-page token.

Configure a continuous cron schedule trigger on the playbook.

Why it fails: A cron schedule trigger starts the playbook at fixed times; it cannot iterate within a single run while pagination tokens remain. It is tempting because it repeats execution, but a do-while loop requires an in-playbook loop task that continues until the API returns no further token.

Increase the max incident count threshold.

Why it fails: The max incident count threshold caps how many incidents XSIAM ingests or displays; it does not affect script execution or paging logic. It is tempting as a tuning knob for volume, but a do-while paging loop needs an iterative playbook task that repeats while the API's pagination token remains present.

Live webcam feeds of analysts running playbooks

Why it fails: Incorrect. Video feeds are not part of XSIAM.

Local packet capture sniffer logs

Why it fails: Incorrect. PCAP logs are network captures, not playbook audit logs.

Define an HTTP request in the XSIAM HTTP Collector and reference it from the playbook.

Why it fails: The HTTP Collector is used to ingest logs and events into XSIAM, not to define outbound API requests for enrichment. It cannot be called from a playbook task to perform a reputation lookup. Using it here would not provide the required reusable request capability and would misdirect the analyst toward an ingestion feature.

Create a new integration instance for the internal API by selecting the Generic HTTP integration and configuring the base URL and authentication.

Why it fails: A Generic HTTP integration instance is used to connect to an external system, but it does not create a reusable request definition that can be called from multiple playbooks. Each playbook would still need to define its own HTTP task, duplicating the request configuration. This does not meet the requirement of avoiding duplication across playbooks.

Create a new HTTP request template in the XSIAM automation settings and use the 'http' task in the playbook to call it by name.

Why it fails: XSIAM does not provide a separate 'HTTP request template' construct in automation settings that playbooks call by name. While HTTP tasks can be configured directly, there is no built-in template repository for outbound requests. This option describes a feature that does not exist, so it cannot satisfy the reuse requirement.

Configure the task to run asynchronously and poll for its result using a condition task.

Why it fails: Asynchronous execution with polling is a valid pattern for long-running jobs, but it adds complexity and does not inherently fail fast when the CMDB is unreachable. You would need additional logic to detect unreachability, and the polling loop itself can mask the original timeout condition. It is not the most direct fix for the stated requirement.

Enable the task's 'continue on error' setting and add a manual review task after it.

Why it fails: Continuing on error prevents the playbook from stopping, but it also hides genuine failures such as an unreachable CMDB. A manual review task shifts the burden to an analyst and does not satisfy the requirement to fail fast when the CMDB is truly down. This approach trades reliability for noise and delays.

Set the task's timeout to a higher value and enable the task's retry with a fixed delay.

Why it fails: Increasing the timeout and adding retries may reduce premature failures, but it does not distinguish a slow-but-healthy CMDB from an unreachable one. The task will still fail once retries are exhausted, and the playbook may thrash on every incident. It also delays incident response unnecessarily when the CMDB is genuinely down.

Set the script's output type to 'JSON' in the script metadata so that XSIAM automatically parses the results.

Why it fails: XSIAM does not require setting an output type to JSON in metadata for automatic parsing. Outputs are defined by the script's return structure and the integration or script configuration. Relying on a metadata toggle is not how outputs become available; the script must return a structured result that the playbook can reference.

Configure the task to run asynchronously so outputs are stored in the incident context.

Why it fails: Running a task asynchronously changes execution flow but does not by itself store outputs in the incident context. Outputs become available through the script's return structure and the task's output definitions, not through asynchronous execution. Asynchronous execution is unrelated to output availability and could complicate result retrieval.

Add a 'Print' statement for each output value so it appears in the playbook execution log.

Why it fails: Print statements write to the execution log for debugging but do not create structured outputs that other tasks can consume. The playbook cannot reference printed text as a variable. While logging is useful, it does not satisfy the requirement to make outputs available to subsequent tasks.

Split the workflow so a scheduled job re-triggers the playbook every few minutes until the ticket closes

Why it fails: Re-triggering the entire playbook on a schedule restarts all prior tasks each cycle rather than pausing and resuming one execution. This duplicates actions already performed, risks conflicting runs against the same ticket, and loses in-memory context, so it does not provide the clean pause-then-resume behavior the scenario requires from a single playbook run.

Use a manual task that pauses the playbook until an analyst confirms the host is provisioned

Why it fails: A manual task does pause and later resume the playbook, but it resumes on human confirmation, not on the external system's completion signal. The scenario describes an API that reports provisioning status automatically, so requiring an analyst to watch and confirm would add unnecessary delay and human overhead instead of letting the playbook detect completion on its own.

Set the task's execution timeout to zero so the playbook waits indefinitely for the API response

Why it fails: Removing or zeroing a task timeout does not create a resumable wait; it simply lets the single task hang, consuming the playbook worker and risking a stalled run. If the vendor API never returns, the playbook remains stuck rather than pausing cleanly and resuming, and other tasks in the same branch cannot proceed, which is precisely what the analyst wants to avoid.

Data Hub > Query Service

Why it fails: Incorrect. The Query Service is for querying log data, not debugging active playbook script memory states.

Settings > Integrations > Instances logs

Why it fails: Incorrect. Integration instance logs show connection health, not specific playbook task execution runs.

Incidents > Audit Trail

Why it fails: Incorrect. The audit trail shows incident-level state changes, not granular script variable inputs/outputs.

Clear the XSIAM Redis cache via CLI.

Why it fails: Clearing the Redis cache removes cached data and does not alter how a failed parallel branch propagates its error to the parent task, so the rate-limited integration still fails the playbook. Cache clearing is for stale or corrupted cached values causing lookup errors, not for controlling task error handling.

Convert the playbook into a sub-playbook with synchronous execution.

Why it fails: Synchronous execution changes timing, not error propagation: a failing branch still returns a failure that the parent task evaluates, so the playbook aborts. Sub-playbooks are for reuse and modularity, and would be correct when the same task sequence must be called from multiple playbooks.

Increase the global playbook execution timeout limit.

Why it fails: A rate limit is an HTTP 429 rejection returned immediately, not a timeout, so extending the global timeout leaves the branch failing and the playbook aborting. Timeout increases are correct when a legitimate long-running task, such as a large query, exceeds the configured execution window.

Integration Instance

Why it fails: An Integration Instance is a configured connection to an external product, holding credentials and parameters, not a reusable task container. It is invoked by commands within tasks; the construct that packages tasks for multiple parent playbooks to call is a sub-playbook.

Custom Layout

Why it fails: A Custom Layout defines how incident or alert fields are arranged and displayed in the UI; it contains no executable tasks and cannot be called by a playbook. It is tempting as a reusable configuration artefact, but the construct packaging callable tasks is a sub-playbook.

XQL Alert Rule

Why it fails: An XQL Alert Rule queries datasets on a schedule and raises issues when conditions match; it executes no playbook tasks and cannot be invoked by a parent playbook. It is tempting because both are reusable, but reuse here concerns detection logic, not modular task packaging.

Set the task execution timeout to zero.

Why it fails: Setting a task timeout to zero controls how long a task may run, not whether it runs at all. It is tempting because zero suggests disabling, but the requirement is a conditional expression on the preceding task's hash count, which timeout configuration cannot evaluate.

Write an external Python script inside an integration.

Why it fails: An external Python script inside an integration performs custom logic but does not configure the task's built-in condition field. It is tempting because scripts can evaluate context, yet the platform's native conditional task condition on the hash count is the intended mechanism, requiring no custom integration.

Use a Loop task to iterate through every hash.

Why it fails: A Loop task iterates over every hash regardless of count, so it cannot gate execution on the count exceeding zero. It is tempting because loops process hash lists, but the requirement is a conditional task condition evaluating the context count, which a loop does not provide.

#{Path.To.Data}

Why it fails: Incorrect. Hash brackets are not used for context referencing.

{{Path.To.Data}}

Why it fails: Double curly braces are the Jinja2 templating delimiter used in Cortex XSOAR/XSIAM for rendering values, but the question asks for the context-data accessor syntax, which uses a different marker. This syntax would be right when writing a Jinja2 template expression inside a script or transformer.

[[Path.To.Data]]

Why it fails: Square brackets denote array indexing or list literals in most scripting and JSON-path contexts, not XSIAM context references. This syntax would be appropriate when indexing an array element in a script, but it cannot retrieve a named value from a previous task's output in a playbook.

Conditional Branching

Why it fails: Conditional Branching evaluates a task's output and routes execution down one path; it does not repeat a command across 50 addresses. It is tempting because it controls playbook flow, and would be correct when the requirement is to take different actions depending on whether an enrichment verdict is malicious or benign.

Data Collection Widget

Why it fails: A Data Collection Widget renders interactive input fields for an analyst during playbook execution; it cannot iterate over context arrays or invoke commands per element. It is tempting because it handles structured data entry, and would be correct when a playbook must pause and prompt a human to supply or confirm values.

Transformer Function

Why it fails: Transformer Functions map, filter or reformat existing context data, but they do not execute enrichment commands against each element. It is tempting because it processes lists, and would be correct when the requirement is to reshape or extract fields from a 50-item array rather than act on every entry.

Data Hub > Pipelines

Why it fails: Data Hub > Pipelines configures data ingestion and parsing pipelines feeding Cortex XSIAM, unrelated to playbook execution. It is correct for onboarding and normalising log sources. The graphical flowchart and live status of a running playbook are viewed from the active incident's playbook execution view.

Dashboards > Incident Overview

Why it fails: Dashboards > Incident Overview presents aggregated incident metrics and charts, not the live playbook task graph for a single incident. It is the right place for monitoring overall incident trends. Viewing a running playbook's flowchart and task status requires the incident's playbook execution view.

Settings > Automation > Playbooks

Why it fails: Settings > Automation > Playbooks manages playbook definitions, versions and configuration, not the execution state of a playbook instance. It is correct for authoring or editing playbooks. Observing a currently running playbook's flowchart and task status happens from the active incident's playbook view.

Incident Layout Scripts

Why it fails: Incident layout scripts are custom scripts bound to layout elements; they require code and run at render time, not as a no-code playbook step. It is tempting because layout scripts do affect incident display, and would be correct if custom JavaScript were permitted to reformat the timestamp.

Syslog Forwarding Rules

Why it fails: Syslog forwarding rules route log events to external destinations; they do not transform field values inside a playbook. It is tempting because forwarding rules are configured in XSIAM and touch incoming data, and would be correct if the requirement were to send parsed events onward to a SIEM or syslog receiver.

XQL Aggregate Functions

Why it fails: XQL aggregate functions compute summaries such as counts, averages, and groupings across datasets; they cannot parse or reformat a timestamp string. It is tempting because XQL is XSIAM's native query language and handles many data transformations, and would be correct if the task were to aggregate incident metrics rather than format a single value.

sys.stdout.write()

Why it fails: sys.stdout.write() sends text to the task's standard output stream, which the playbook engine does not parse into incident fields. It is used for console logging or debugging output; writing to the incident context requires the return-value mechanism the platform reads.

print()

Why it fails: print() writes to standard output, which appears in task logs but is not captured as structured incident context. It is used for debugging and log visibility; returning results to the incident context requires the platform's designated output mechanism, not console printing.

requests.post()

Why it fails: requests.post() issues an outbound HTTP request to an external endpoint, returning a response object rather than populating incident fields. It is the correct tool for calling APIs or webhooks from a script, not for passing task results back into the Cortex XSIAM incident context.

Convert the playbook into a manual-only workflow.

Why it fails: Converting to manual-only abandons automation entirely, so the timeout is never retried and an analyst must intervene each run. It is tempting when failures need human judgement, and would be correct for tasks requiring approval or contextual decisions rather than transient network faults.

Permanently disable the integration instance.

Why it fails: Disabling the integration instance removes all connectivity to the asset database, so every subsequent task fails rather than only the intermittent timeout. It is tempting as a way to stop repeated error noise, and would be correct when the integration is permanently decommissioned or credentials are revoked.

Increase the database server's hardware CPU cores.

Why it fails: Raising CPU cores cannot prevent a transient network timeout; the playbook needs retry logic with backoff, since the failure originates in the network path, not compute capacity. Hardware scaling is tempting because it genuinely helps when a task times out due to sustained CPU saturation during heavy processing.

Notification Task

Why it fails: A notification task only sends an alert message; it cannot evaluate severity or branch the playbook, so the Tier 2 assignment would run regardless of the 'High' condition. Notifications suit keeping stakeholders informed after a decision, not gating task execution.

Data Parsing Task

Why it fails: Data parsing extracts and normalises fields from raw event data; it does not evaluate a condition or control task flow. Parsing is the right choice when incoming logs need their fields mapped before other tasks can read them.

Enrichment Task

Why it fails: Enrichment adds context such as threat intelligence or asset data to an incident; it cannot branch on severity. Enrichment is correct when analysts need extra context attached before triage, not when a conditional gate must decide whether assignment occurs.

To debug network firewall rules.

Why it fails: The Playbook Debugger validates playbook logic and task data flow, not firewall rule configuration. It is tempting because playbooks frequently invoke firewall actions, and a rule-testing or policy-validation tool would be correct when the requirement is confirming network access rules behave as intended.

To analyze log parsing syntax in Data Hub.

Why it fails: Log-parsing syntax belongs to Data Hub configuration, not playbook execution; the debugger runs a playbook against sample data to inspect task inputs, outputs and branching. It is tempting because both features aid troubleshooting, but syntax validation occurs when configuring parsers, not when testing playbook logic.

To scan endpoints for malware signatures.

Why it fails: The Playbook Debugger executes a playbook against sample or historical data to inspect task inputs, outputs and branching, and does not perform endpoint scanning. It is tempting because playbooks can contain remediation tasks, and an endpoint scanning action would be correct when the requirement is detecting malware on hosts.