2.7 Explain List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A playbook needs to look up a user's department based on their username. The mapping is static and changes rarely. Which XSOAR list type is most appropriate for this use case?

   • AIndicator list
   • BKey-value list
   • CCustom list
   • DContext list
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the immediate effect on a running playbook when an administrator edits a key-value list that the playbook is currently using?

   • AThe playbook will fail immediately
   • BThe playbook will automatically update its data
   • CThe playbook will restart from the beginning
   • DThe playbook will continue using the data it already retrieved
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager wants to allow junior analysts to view a list of approved sender domains but prevent them from modifying it. Only senior analysts should be able to edit the list. What is the most appropriate way to achieve this in XSOAR?

   • AEncrypt the list content so that only senior analysts can decrypt it.
   • BCreate a custom list and assign read-only permissions to the junior analyst role and read-write permissions to the senior analyst role.
   • CStore the list in a context variable and restrict access to the playbook that uses it.
   • DUse a key-value list and rely on the default permissions that allow all users to edit lists.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which XSOAR feature allows a playbook task to dynamically retrieve a value from a key-value list?

   • AThe 'List' indicator type
   • BThe 'GetList' automation
   • CThe 'List' data type in the incident layout
   • DThe 'FetchList' script
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team is designing a list to store IP addresses that should be blocked. They expect the list to grow to thousands of entries and be referenced frequently in playbooks. What is a best practice for managing this list to ensure performance and maintainability?

   • AUse a single large list with all IPs and reference it directly in every playbook.
   • BUse a key-value list where each IP is a key and the value is a timestamp.
   • CStore the IPs in a context variable instead of a list to avoid list size limits.
   • DSplit the list into smaller lists by category or region and use a naming convention that reflects the purpose.
   Reveal Solution Discussion Select an answer first