3.2 Identify and Describe Playbook Components XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A team has a sub-playbook that enriches an IP address. The sub-playbook is used by two parent playbooks. One parent playbook requires the enrichment to be mandatory; if it fails, the parent should stop. The other parent playbook treats enrichment as optional; if it fails, the parent should continue. What is the best way to handle this difference?

   • AModify the sub-playbook to always succeed, and handle the failure in the parent playbooks.
   • BCreate two separate sub-playbooks, one that fails on error and one that continues on error.
   • CConfigure the sub-playbook task in each parent playbook with the appropriate 'Continue on error' setting.
   • DAdd a decision task inside the sub-playbook that checks a flag passed from the parent playbook.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is designing a playbook that queries an external sandbox service to analyze a suspicious file. The sandbox service occasionally returns a transient HTTP 500 error. The analyst wants the playbook to automatically retry the query a few times before giving up. What is the most efficient way to configure this in XSIAM?

   • AUse a sub-playbook that contains the query task and call it multiple times in sequence.
   • BConfigure the retry settings on the integration task that calls the sandbox service, specifying the number of retries and the interval between them.
   • CSet up an error path from the query task to a regular task that sleeps for 30 seconds and then re-runs the query.
   • DAdd a decision task after the query that checks the HTTP status code and loops back to the query task if it is 500.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A playbook needs to perform a series of steps: enrich an IP, enrich a domain, and then check both results against a blocklist. The enrichment steps are independent of each other. Which task configuration would minimize the total execution time?

   • AConnect the IP enrichment task to the domain enrichment task, and then connect the domain enrichment task to the blocklist check.
   • BUse a single integration task that enriches both the IP and the domain.
   • CUse a sub-playbook that contains both enrichment tasks and the blocklist check.
   • DConnect both enrichment tasks to the same starting point, and then connect both to the blocklist check.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of using a sub-playbook in XSIAM?

   • ATo handle error conditions exclusively
   • BTo modularize playbook logic and enable reuse across multiple playbooks
   • CTo provide a visual representation of the playbook flow
   • DTo replace the need for integration tasks
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A playbook has a task that calls an external API. The API sometimes returns a 429 (Too Many Requests) error. The analyst wants the playbook to retry the task, but only for 429 errors, not for other errors. What is the best way to achieve this?

   • AConfigure the task's retry settings to retry 3 times with a 30-second interval.
   • BUse an error path from the task to a decision task that checks the error code. If it is 429, loop back to the task; otherwise, proceed to the error handling.
   • CSet the task to 'Continue on error' and add a separate task that checks the error code.
   • DModify the external API to not return 429 errors.
   Reveal Solution Discussion Select an answer first