3.1 Use Playbooks for Automated Incident Response XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In XSIAM, what is the role of artifact handling in relation to playbooks?

   • APlaybooks can extract, add, or update artifacts associated with an incident
   • BArtifacts are only created by the playbook, not by analysts
   • CArtifacts are only used for manual analysis and cannot be accessed by playbooks
   • DArtifacts are automatically deleted after a playbook runs
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a security best practice when designing a playbook that interacts with external systems?

   • AEmbed credentials directly in the playbook for simplicity
   • BStore credentials in a secure vault and reference them in the playbook
   • CShare credentials with all analysts for transparency
   • DUse the same API key for all integrations to reduce complexity
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Where can an analyst view the execution history of a playbook in XSIAM?

   • AIn the threat intelligence feed
   • BIn the artifact repository
   • CIn the execution history or run log section of the playbook
   • DIn the playbook editor's design view
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A playbook that enriches incidents with external threat intelligence occasionally fails because the external API times out. The analyst wants to see which step failed and why, and then retry the failed step without re-running the entire playbook. What should the analyst do?

   • ADisable the playbook and create a new one with a different API integration.
   • BOpen the playbook execution history, inspect the failed step's error message, and use the 'Retry' option on that step.
   • CCheck the incident's audit log to find the error and then manually perform the enrichment.
   • DRe-run the entire playbook from the beginning to see the error and then fix the API issue.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When a playbook run fails during execution, what should an analyst do to understand the cause?

   • AReview the execution logs and error messages for that specific run
   • BManually run all actions in the playbook to see which one fails
   • CDelete the playbook and recreate it from scratch
   • DIgnore the failure because playbooks are not critical
   Reveal Solution Discussion Select an answer first