2.7 Explain List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   What is a best practice for maintaining lists in XSOAR to ensure reliability in automation workflows?

   • AKeep all lists in a single, large list to reduce the number of entities
   • BUse lists only for temporary data
   • CRegularly review and clean up unused lists
   • DAvoid documenting list purposes to save time
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst notices that a playbook is using an outdated list of allowed file hashes. The list is a key-value list where the key is the hash and the value is the description. The analyst needs to add a new hash and update the description of an existing hash. What is the most efficient way to do this?

   • ACreate a new list and update the playbook to reference the new list.
   • BUse a script to overwrite the entire list with a new JSON object containing all entries.
   • CDelete the list and recreate it with all the entries, including the new hash.
   • DEdit the list in the UI and manually add the new entry and modify the existing one.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An administrator needs to update a list of blocked IP addresses in a production environment. The list is used by several playbooks. What is the safest way to update the list to minimize the risk of breaking running playbooks?

   • AUse a script to overwrite the list content without any testing.
   • BDelete the existing list and recreate it with the new content.
   • CCreate a new list with the updated content, test it, and then switch playbooks to reference the new list.
   • DEdit the list directly in the UI during peak hours.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A playbook is designed to block IP addresses from a list. The list is updated frequently by an external system via API. The playbook runs every 5 minutes. An analyst notices that sometimes the playbook blocks IPs that were removed from the list minutes earlier. What is the most likely cause?

   • AThe playbook is using a different list than the one being updated.
   • BThe list permissions are preventing the playbook from reading the latest version.
   • CThe playbook is caching the list content at the start of each run.
   • DThe external system is not updating the list correctly.
   Reveal Solution Discussion Select an answer first