3.2 Identify and Describe Playbook Components XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is building a playbook that should only proceed with containment actions if the incident severity is 'High' or 'Critical'. Which task type should be used to evaluate the severity and branch the flow?

   • AA sub-playbook that contains the severity check and returns a boolean.
   • BAn integration task that queries the incident severity from the XSIAM API.
   • CA regular task that checks the severity and then stops the playbook if it is not High or Critical.
   • DA decision task that evaluates the severity and routes to the containment actions or to an end task.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A playbook has a task that queries an external service. The service is temporarily down. The analyst wants the playbook to try the query again after a short delay. What is the simplest way to achieve this?

   • AUse a sub-playbook that contains the query and call it multiple times.
   • BAdd a decision task after the query that checks if it failed and loops back to the query.
   • CSet the query task to 'Continue on error' and add a separate task that re-runs the query.
   • DConfigure the query task's retry settings to retry a specified number of times with a delay.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is designing a playbook that should send an email notification if a certain condition is met. Which task type should be used to send the email?

   • AA regular task.
   • BAn integration task.
   • CA decision task.
   • DA sub-playbook.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A playbook is designed to handle endpoint isolation. It calls a sub-playbook that performs the isolation on the endpoint. The sub-playbook fails because the endpoint is already isolated. The parent playbook should continue to the next step (notifying the analyst) even if the sub-playbook fails. What should the analyst configure?

   • AConfigure an error path from the sub-playbook task to the notification task.
   • BSet the sub-playbook task to 'Continue on error'.
   • CAdd a retry loop around the sub-playbook task.
   • DModify the sub-playbook to catch its own errors and return a success status.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team has a complex playbook that handles malware analysis. They want to reuse the 'file detonation' portion of the playbook in other playbooks. What is the best way to make this portion reusable?

   • AConvert the file detonation portion into a sub-playbook and call it from the main playbook and other playbooks.
   • BUse a decision task to conditionally run the file detonation steps.
   • CCopy the file detonation tasks into each playbook that needs them.
   • DCreate a new integration task that performs file detonation.
   Reveal Solution Discussion Select an answer first