Courseiva

CCNA Playbook Development Questions

49 questions · Playbook Development · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

A.Task
B.Condition
C.Data Collection
D.Parallel
AnswerA

Correct. A standard task is used to run integration commands or automations.

Why this answer

A Regular task (or Task) in an XSOAR playbook is used to run integration commands, automation scripts, or built-in actions directly.

Practice this question →
2
Multi-Selecthard

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Select 3 answers
A.'ToLower' to convert string characters to lowercase
B.'CompileToMachineCode' to convert context into native x86 assembly
C.'EncryptDatabase' to secure SQL storage
D.'concat' to combine multiple string values
E.'uniq' to remove duplicate items from a list
AnswersA, D, E

The ToLower transformer formats string casing.

Why this answer

XSOAR supports various built-in transformers such as concat, uniq, sort, and regex extraction for context manipulation.

Practice this question →
3
MCQmedium

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

A.Hardcode the expected string value directly into the task argument field
B.Store the value in a server-wide environment variable and call os.environ
C.Reference the context path using the ${Email.Body} syntax in the argument field
D.Write a custom integration instance configuration for that specific email
AnswerC

Context paths enclosed in ${} are evaluated at runtime and passed to the task arguments.

Why this answer

Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Practice this question →
4
MCQhard

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

A.Lock the content pack version in Marketplace settings to prevent all future updates.
B.Override playbook tasks by creating a separate script with the same name.
C.Edit the content pack files directly on the filesystem via SSH.
D.Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.
AnswerD

Cloning prevents your custom logic from being overwritten during content pack upgrades.

Why this answer

To customize built-in content safely, you should clone the playbook, modify the clone, and use the cloned version in your incident types.

Practice this question →
5
MCQhard

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

A.Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.
B.Write a custom Python automation script to manually push the incident field into the sub-playbook context every time.
C.Hardcode the IP addresses into the sub-playbook's default argument values.
D.Create a global variable in the Server Configuration settings.
AnswerA

Correct. Sub-playbook inputs are mapped using context path expressions to pull parent incident or context data.

Why this answer

To pass incident fields or context data to a sub-playbook, the engineer uses the Context or Incident field selector in the sub-playbook task configuration, referencing the path such as ${incident.ipaddresses}.

Practice this question →
6
MCQmedium

You need to ensure that a playbook task execution fails gracefully if the underlying integration command returns an error, allowing the playbook to continue down an alternative error-handling path. Which setting must you configure on the task?

A.Enable 'Skip task if empty' in the Task Details
B.Wrap the command in a try-except Python wrapper inside the playbook UI
C.Set 'Continue on error' under the task's Error Handling tab
D.Add a Post-processing script that catches exceptions
AnswerC

Enabling 'Continue on error' or configuring error routing allows the playbook to handle command failures gracefully.

Why this answer

By configuring the 'On error' setting of a task, an engineer can dictate whether a failure stops the playbook, continues, or routes down a specific error branch.

Practice this question →
7
MCQeasy

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

A.To define the regex pattern used for email parsing
B.To provide human-readable documentation on the playbook's purpose and workflow
C.To store encrypted API credentials for sub-playbooks
D.To execute initialization scripts when the playbook starts
AnswerB

Descriptions document the playbook's design and operational intent.

Why this answer

The description field provides documentation and details about what the playbook does, helping other analysts understand its purpose.

Practice this question →
8
MCQeasy

An XSOAR Engineer is configuring a playbook task and needs to reference the output of a previous task named 'Get Incident Details'. Which syntax is correct to access the 'ID' key from that task's output context?

A.${incident.GetIncidentDetails.ID}
B.${task.GetIncidentDetails.ID}
C.$GetIncidentDetails[ID]
D.${GetIncidentDetails.ID}
AnswerD

This is the correct syntax to access task output context in an XSOAR playbook.

Why this answer

Task outputs are stored in the Incident Context using the naming convention ${TaskName.Key}. Therefore, ${GetIncidentDetails.ID} correctly retrieves the ID from the specified task.

Practice this question →
9
MCQeasy

An engineer has completed building a new playbook and wants to test it on a live incident without affecting production data. What is the recommended method to test playbook modifications?

A.Run the playbook on a test incident in an XSOAR test environment or development instance
B.Export the playbook as a zip file and import it into a dashboard widget
C.Delete the old playbook and publish the new one directly to production
D.Enable 'Debug Mode' in server configurations and restart the service
AnswerA

Testing on dedicated test incidents ensures safe validation of playbook logic.

Why this answer

Engineers can test playbooks on existing test incidents or use the Playground feature within an incident to run specific tasks or playbooks safely.

Practice this question →
10
MCQmedium

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

A.Wrap them inside a single Data Collection Task.
B.Place them in a serial chain one after another.
C.Connect the preceding task to all three tasks in parallel, and route them into the joining task.
D.Use a Loop Task with a batch size of 3.
AnswerC

Connecting multiple branches in parallel and merging them at a downstream task achieves concurrent execution.

Why this answer

To run multiple tasks concurrently, you connect the preceding task to all three tasks simultaneously, and then connect all three tasks into the subsequent analysis task to join the workflow.

Practice this question →
11
Multi-Selecthard

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Select 3 answers
A.Integration dependencies or required integration commands.
B.Active incident war room chat logs from the development environment.
C.Local analyst user account credentials and password hashes.
D.Custom automation scripts and transformers used within playbook tasks.
E.Dependent sub-playbooks called by the main playbook.
AnswersA, D, E

Correct. Playbooks rely on integrations; ensuring integration dependencies are declared is vital.

Why this answer

Content packs containing playbooks must properly bundle dependencies such as dependent sub-playbooks, required automation scripts, and necessary integration command mappings.

Practice this question →
12
Multi-Selectmedium

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Select 2 answers
A.Direct SQL queries executed against the internal PostgreSQL database
B.Dynamic context path references using ${} syntax
C.Direct memory pointer addresses in C syntax
D.Local environment variables via bash export commands
E.Static text entered directly into the argument field
AnswersB, E

Context paths dynamically supply runtime data to arguments.

Why this answer

Task arguments can be populated with static text strings or dynamic context references enclosed in ${}.

Practice this question →
13
MCQmedium

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

A.A Conditional Task
B.A Data Collection Task
C.A Loop Task with an exit filter
D.A standard task with a Post-processing script
AnswerA

Conditional tasks evaluate expressions and direct the playbook down specific branches.

Why this answer

A Conditional Task allows an XSOAR engineer to evaluate conditions and route the playbook execution path to different branches based on the results.

Practice this question →
14
MCQmedium

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

A.In the Incident Fields configuration menu
B.In the task's Conditions tab using pre-conditions or filtering rules
C.In the playbook Details tab under Script arguments
D.By writing a separate Condition task before every single integration task
AnswerB

Correct. Task pre-conditions determine whether a task should run based on previous results.

Why this answer

Task-level conditional filtering (such as checking previous task results or verdicts) is configured in the Conditions tab of the task properties.

Practice this question →
15
Multi-Selectmedium

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Select 3 answers
A.A clear, descriptive name reflecting the playbook's workflow purpose
B.An attached compiled binary file for Windows execution
C.Documentation or description explaining input requirements and expected outcomes
D.Hardcoded passwords for external API integrations stored in plain text
E.Association with appropriate Incident Types so it triggers automatically when relevant cases are created
AnswersA, C, E

Descriptive names help identify playbook purpose.

Why this answer

Publishing playbooks involves defining a clear name, adding comprehensive descriptions, and associating the playbook with relevant incident types.

Practice this question →
16
MCQeasy

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

A.XML
B.JSON
C.CSV
D.YAML
AnswerB

Cortex XSOAR exports playbooks and content items as JSON files.

Why this answer

Playbooks and other content items in XSOAR are exported and packaged in JSON format.

Practice this question →
17
MCQmedium

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

A.By writing all indicators manually to a local CSV file on the server
B.By enabling 'Auto-extract indicators' in the incident type or task output configuration settings
C.By assigning the playbook to the 'Indicator' incident type exclusively
D.By restarting the Cortex XSOAR server daemon
AnswerB

Auto-extraction settings ensure extracted values become formal indicators in XSOAR.

Why this answer

Indicators returned by automation scripts or commands in standard task outputs can be automatically processed and ingested into the Threat Intel module based on mapping and indicator extraction settings.

Practice this question →
18
MCQmedium

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

A.By using the 'AttachFile' system-wide environment variable
B.By passing the context path containing the file entry ID, such as ${File.EntryID}
C.By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt
D.By hardcoding the binary content of the file directly into the argument field
AnswerB

File attachment arguments expect the entry ID of the file stored in context.

Why this answer

File attachments in XSOAR tasks reference file entry IDs stored in context, typically accessed via context paths pointing to file objects.

Practice this question →
19
MCQhard

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

A.Yes, by editing the raw JSON and inserting a goto statement.
B.No, backward navigation is only possible by terminating the incident and creating a new one.
C.Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.
D.No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.
AnswerC

Playbooks support looping and backward routing via conditional or loop constructs.

Why this answer

Cortex XSOAR playbooks support loops and backward transitions (cycles) under specific conditions, allowing workflows to loop back to prior tasks.

Practice this question →
20
MCQeasy

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

A.The permission level required by the analyst viewing the task
B.The difficulty rating assigned by the playbook developer
C.The execution status of the task (e.g., completed, failed, in-progress)
D.The integration vendor associated with the task command
AnswerC

Task border colors indicate current execution states in active incidents.

Why this answer

Color coding on playbook tasks in active incidents reflects their execution status (e.g., green for completed, red for failed, blue for in-progress).

Practice this question →
21
MCQhard

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

A.Run a command to delete the context and recreate it using standard Python scripts.
B.Modify the global incident type schema to automatically alias IPAddress as IP.
C.Use a context transformer or custom mapper in the task's Edit Outputs section to map 'IPAddress' to 'IP'.
D.Rename the integration instance name to match the desired output key.
AnswerC

Correct. Task output mapping allows renaming and transforming keys using built-in mapping tools.

Why this answer

XSOAR allows the use of built-in context transformers and custom mappers in playbook task settings to rename and restructure output keys.

Practice this question →
22
MCQmedium

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

A.By emailing the JSON export to the team
B.By writing comments inside the incident war room
C.By adding Notes or Task Descriptions in the task properties drawer
D.By modifying the server's README.md file
AnswerC

Task descriptions and documentation fields allow engineers to document logic.

Why this answer

Playbook designers can add visual notes or descriptions to tasks and canvas areas to document workflow logic.

Practice this question →
23
MCQmedium

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

A.In the playbook JSON file by manually modifying the 'filters' array
B.In the server configuration under Incident Types
C.By writing a custom pre-processing script for every integration
D.In the task's 'Conditions' tab by defining expression rules based on incident severity
AnswerD

Task conditions evaluate incident fields like severity before running the task.

Why this answer

Task-level execution conditions are configured within the task's 'Conditions' tab in the task properties drawer.

Practice this question →
24
MCQmedium

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

A.The integration instance health status
B.The evaluation of the task's conditional expression against the current Incident Context
C.The system clock and task timeout thresholds
D.The user permissions of the analyst who opened the incident
AnswerB

Task conditions evaluate context data at runtime to decide execution.

Why this answer

Playbook task conditions evaluate context paths and expressions to determine whether the task should execute or be skipped.

Practice this question →
25
MCQeasy

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

A.Loop Task
B.Data Enrichment Task
C.Command Task
D.Prompt Task
AnswerD

Correct. Prompt tasks pause playbook execution to request user interaction or decisions.

Why this answer

A Data Collection or Prompt task is designed to pause the playbook and request manual input or a decision from an analyst.

Practice this question →
26
Multi-Selecteasy

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Select 2 answers
A.Firewall Task
B.Conditional Task
C.Database Task
D.Router Task
E.Automation Task
AnswersB, E

Conditional tasks handle branching logic based on context or incident fields.

Why this answer

Playbook task types include Automation, Conditional, Manual, Sub-playbook, and Data Collection tasks.

Practice this question →
27
Multi-Selecthard

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

Select 3 answers
A.Reinstall the underlying operating system and format all storage volumes.
B.Replace the server's network interface card to fix context serialization errors.
C.Check server log files (e.g., demisto.log) for Python tracebacks and error messages.
D.Inspect the task's 'Inputs' tab in the playbook editor to verify argument mapping and syntax.
E.Review the War Room or task execution details to see the exact arguments passed at runtime.
AnswersC, D, E

Server logs reveal script errors and tracebacks.

Why this answer

Troubleshooting script arguments involves inspecting task inputs in the playbook UI, checking the War Room for exact command execution syntax, and reviewing server log files for Python tracebacks.

Practice this question →
28
Multi-Selecteasy

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

Select 2 answers
A.Kernel
B.Inputs
C.Compiler
D.Outputs
E.Bios
AnswersB, D

The Inputs tab configures arguments passed to the task script.

Why this answer

Task property drawers include tabs for Task Details, Inputs, Outputs, and Conditions.

Practice this question →
29
MCQmedium

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

A.Data Collection Task
B.Loop Task
C.Parallel Task Group
D.Conditional Task
AnswerB

Loop tasks iterate over lists of data, executing tasks for each element.

Why this answer

A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Practice this question →
30
MCQhard

An engineer is utilizing the 'Set' task to manipulate context data. They want to clear an existing context key named 'MaliciousIP' entirely so subsequent tasks do not read stale data. How should this be configured in the Set task?

A.Run a bash command via integration to purge the Redis database.
B.Rename the playbook to force a context reset.
C.Delete the task and recreate the playbook canvas from scratch.
D.Set the value of 'MaliciousIP' to 'null' or leave the value field empty while checking the overwrite option.
AnswerD

Setting a context key to empty or null with overwrite clears the stale data.

Why this answer

To clear or overwrite a context key, you can assign an empty value or use specific context clearing methods provided by built-in automation helpers like ClearContext.

Practice this question →
31
Multi-Selectmedium

An engineer is troubleshooting a playbook where a task fails intermittently because an upstream integration command takes too long to return data. Which THREE configuration options or features can the engineer use to handle this timeout issue effectively? (Choose three)

Select 3 answers
A.Use asynchronous task execution where supported so the playbook continues while the command runs in the background.
B.Increase the global server CPU allocation via the CLI.
C.Configure task-level timeout settings to fail gracefully or trigger an alternate path.
D.Modify the incident type layout to hide slow tasks.
E.Enable task retry settings to automatically re-execute the command if it fails or times out.
AnswersA, C, E

Correct. Asynchronous execution prevents the playbook thread from blocking indefinitely.

Why this answer

Timeout and retry handling in XSOAR playbooks can be managed using task timeouts, retry mechanisms, or asynchronous execution patterns.

Practice this question →
32
Multi-Selecthard

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Select 3 answers
A.Directly edit the production server's internal SQLite database files while playbooks are running.
B.Store plaintext administrator passwords inside playbook task description fields for easy reference.
C.Clone out-of-the-box content pack playbooks before making custom modifications to prevent loss during updates.
D.Export playbooks as JSON files for version control integration (e.g., Git).
E.Use descriptive names and clear task documentation to assist team collaboration and maintenance.
AnswersC, D, E

Cloning protects custom changes from being overwritten during updates.

Why this answer

Best practices include cloning content pack items before editing, utilizing descriptive naming conventions, and exporting playbooks in JSON format for source control.

Practice this question →
33
MCQhard

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

A.It throws a validation error unless wrapped in a string transformer.
B.It passes only the first item in the list and discards the rest.
C.It converts the list into a JSON object and stores it in a temporary file.
D.It passes the list as a comma-separated string or array to the script argument based on argument definitions.
AnswerD

XSOAR automatically handles list context values when passed to script arguments.

Why this answer

XSOAR automatically flattens or serializes list context outputs into comma-separated strings or passes them as array structures depending on argument definitions when referenced in task inputs.

Practice this question →
34
MCQeasy

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

A.Dashboards -> Widgets -> Playbook Designer
B.Automation -> Playbooks
C.Settings -> Integrations -> Playbooks
D.Incidents -> Analysis -> Playbooks
AnswerB

Playbooks are located under the Automation menu in the Cortex XSOAR platform.

Why this answer

Playbooks are built and managed within the Playbooks section of the XSOAR UI.

Practice this question →
35
MCQmedium

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

A.A transformer function in the mapping section
B.A sub-playbook with parallel task execution
C.A Condition task evaluating the length of the Account array
D.The Loop feature configured directly on the task properties
AnswerD

Correct. Task looping allows execution of the same task for each item in a context array.

Why this answer

To iterate over a list of items in XSOAR context, the engineer uses the Loop feature on the task, specifying the target context array.

Practice this question →
36
MCQmedium

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

A.Configure the playbook trigger rules or associate it with an incident type that excludes automatic classifier fetching.
B.Disable the integration instance responsible for email fetching.
C.Set the playbook role restriction to Administrator only.
D.Delete the start task of the playbook.
AnswerA

Correct. Playbooks are tied to incident types and classifiers, or manually invoked.

Why this answer

Playbooks can be restricted by type or execution triggers. To prevent automatic triggering while allowing manual execution, the playbook should be associated with specific incident types or configured as manual-only.

Practice this question →
37
Multi-Selectmedium

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Select 3 answers
A.Directly modifying the underlying OS kernel parameters
B.Executing the sub-playbook either synchronously or asynchronously
C.Mapping parent playbook context data to sub-playbook input arguments
D.Compiling the sub-playbook into a native binary executable file
E.Mapping sub-playbook output keys back into the parent playbook context
AnswersB, C, E

Sub-playbook execution mode can be configured.

Why this answer

Sub-playbooks support input/output mapping to parent playbooks, independent versioning, and running standalone or nested.

Practice this question →
38
MCQhard

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

A.Sub-playbooks share the exact same global context without any isolation or scoping.
B.Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.
C.All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.
D.Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.
AnswerB

Explicit output mapping ensures keys generated inside a sub-playbook are properly passed to the parent playbook context.

Why this answer

By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Practice this question →
39
Multi-Selecteasy

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Select 2 answers
A.Analyzing the server's physical power supply status LEDs
B.Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab
C.Checking the War Room logs for command outputs and task messages
D.Inspecting the client browser's DNS cache settings
E.Reviewing the local SMTP mail server queue
AnswersB, C

Clicking a task node opens its execution results and logs.

Why this answer

Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Practice this question →
40
MCQhard

An engineer has configured a Loop Task in a playbook to iterate over a list of 50 IP addresses. To prevent the playbook from timing out or overwhelming the external API, the engineer needs to execute batches of 10 items concurrently. Where is this concurrency setting configured?

A.In the Loop tab of the specific playbook task properties drawer
B.In the playbook-level JSON file under the 'canvas' properties
C.In the integration instance settings for the executed command
D.In the global server configuration (Server Settings -> Incidents)
AnswerA

Task-specific loop properties, including batch size and concurrency, are configured directly within the task's Loop tab.

Why this answer

In XSOAR loop task configurations, the concurrency or batch size can be defined under the task's Loop configuration settings to control parallel execution limits.

Practice this question →
41
MCQmedium

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

A.In the task's 'Assign to Incident Field' configuration setting
B.In the 'Details' tab using custom markdown syntax
C.In the task's 'Inputs' tab under context mapping
D.In the 'Script arguments' section under the 'Key' parameter
AnswerA

The 'Assign to Incident Field' setting binds the collected user response directly to an incident field.

Why this answer

Data collection tasks allow mapping user inputs directly to incident fields using the task's 'Mapping' or 'Assign to Incident Field' settings.

Practice this question →
42
Multi-Selecteasy

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Select 2 answers
A.Credential
B.Condition
C.Enrichment
D.Parallel
E.Mirroring
AnswersB, D

Correct. Condition tasks provide if/else branching logic.

Why this answer

Flow control tasks in XSOAR include Condition tasks (for branching) and Parallel tasks (for splitting execution paths).

Practice this question →
43
MCQhard

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

A.Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.
B.No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.
C.No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.
D.Yes, but only if the sub-playbook contains fewer than 10 tasks.
AnswerA

Synchronous execution is the default behavior when calling a sub-playbook.

Why this answer

Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Practice this question →
44
Multi-Selecteasy

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Select 2 answers
A.Permanently disabling all external network connections during any alert
B.Automating repetitive tasks to reduce Mean Time to Respond (MTTR)
C.Eliminating the need for any human oversight in security operations
D.Standardizing incident response processes to ensure consistent handling across analysts
E.Replacing all SIEM databases with flat text files
AnswersB, D

Automation speeds up routine tasks, lowering MTTR.

Why this answer

Playbooks standardize incident response workflows and automate repetitive tasks to reduce response times.

Practice this question →
45
Multi-Selectmedium

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Select 3 answers
A.Compiling Python source code into machine bytecode
B.Configuring custom branch labels for different outcomes
C.Defining conditional expressions using incident fields or context data
D.Directly modifying firewall access control lists without commands
E.Establishing a default (else) fallback path if no specific conditions match
AnswersB, C, E

Branches can be labeled for clarity and routing.

Why this answer

Conditional tasks allow evaluating expressions, defining custom labels for branches, and setting a default fallback path.

Practice this question →
46
MCQhard

An engineer is writing a playbook expression to filter a list of endpoints from context. They want to return only the endpoints where the 'OS' field equals 'Windows'. Which built-in transformer syntax is correct?

A.Using the 'Val' transformer with a conditional expression like 'val.OS == \'Windows\''
B.${Endpoints.OS(val == 'Windows')}
C.${Endpoints | filter(OS == 'Windows')}
D.${Endpoints.[?(OS == 'Windows')] }
AnswerA

XSOAR transformers allow filtering lists using expressions where 'val' represents the iterated object.

Why this answer

The grep transformer or filter syntax using jq-like syntax or XSOAR built-in transformers is used. Specifically, the 'Access' or 'Filter' transformer with condition syntax is applied.

Practice this question →
47
MCQeasy

Which visual indicator on a playbook task in the canvas signifies that the task is configured as a starting point (the entry point) of the playbook?

A.A dashed border around the task box
B.A red exclamation mark badge
C.A padlock symbol in the corner
D.A green play/start icon or specific start node shape
AnswerD

The start node designates where playbook execution begins.

Why this answer

The start task in an XSOAR playbook is typically represented as a distinct starting node connected to the first execution step.

Practice this question →
48
MCQeasy

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

A.Data Collection Task
B.Sub-playbook Task
C.Manual Task
D.Automation Task
AnswerC

Manual tasks pause the playbook and prompt a human analyst for input or decision-making.

Why this answer

A Manual Task is designed specifically to pause playbook execution and present a form or prompt to a human analyst for review and input.

Practice this question →
49
Multi-Selecthard

Which THREE actions can be performed using the Loop task configuration in a Cortex XSOAR playbook? (Choose three)

Select 3 answers
A.Automatically convert all looped outputs into PDF incident reports
B.Iterate over a list of items stored in the incident context
C.Directly modify the core XSOAR database schema during each iteration
D.Define a maximum batch size or concurrency limit for parallel iterations
E.Set an exit condition to terminate the loop early based on context evaluation
AnswersB, D, E

Loop tasks process arrays from context.

Why this answer

Loop tasks allow iterating over arrays, defining batch sizes/concurrency limits, and specifying exit criteria or conditions.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Playbook Development questions.

Start 20-question session