4.2 Differentiate Between Scripts and Jobs in Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A team has a script that performs a time-consuming data enrichment task. The script is currently called from multiple playbooks. The team wants to run this script automatically every 6 hours to pre-enrich data, but also needs to ensure that the script remains available for playbooks to call on-demand. What is the best approach?

   • AUse an automation rule to run the script on a schedule
   • BCreate a new playbook that runs the script and schedule the playbook
   • CConvert the script into a job and update playbooks to call the job
   • DCreate a job that calls the script every 6 hours and keep the script for playbook use
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key difference between a script and a job in Cortex XSOAR?

   • AScripts are always run in the cloud, while jobs run on-premises
   • BScripts are executed on demand or within playbooks, while jobs are scheduled to run automatically
   • CScripts are used for data storage, while jobs are used for data processing
   • DScripts can only be run by administrators, while jobs can be run by any user
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC team has a Python script that performs a complex data transformation on incident data. The script is currently run manually by analysts. The team now wants to run this script automatically every day at 02:00 to pre-process data for a daily report. However, the script also needs to remain available for manual execution by analysts during incident investigations. What is the best approach?

   • AUse an automation rule to run the script on a schedule
   • BCreate a new playbook that runs the script and schedule the playbook
   • CKeep the script and create a separate job that calls the script
   • DConvert the script into a job and remove the script
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is writing a custom Python function to parse a specific log format and extract IP addresses. The function will be used in multiple playbooks and also manually by analysts. What is the best way to package this functionality in Cortex XSOAR?

   • AAs a job that runs every hour
   • BAs a script that can be called from playbooks and the War Room
   • CAs a new incident type
   • DAs an automation rule that runs on incident creation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A playbook needs to perform a quick lookup of a file hash against a local database and then continue with the next step. The lookup logic is simple and does not need to be reused elsewhere. What is the most appropriate way to implement this step within the playbook?

   • ACreate a separate incident for the lookup
   • BWrite a script and call it from the playbook
   • CCreate a job to run the lookup on a schedule
   • DConfigure an automation rule to trigger the lookup
   Reveal Solution Discussion Select an answer first