3.8 Explain the Process of Creating and Applying Automation Scripts XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is creating an automation script in XSOAR that will extract file hashes from an incident's attachment metadata. The script needs to accept the attachment ID as input and return a list of SHA256 hashes. The analyst writes the script and wants to define the input parameter so it appears in the playbook task configuration. Which action must the analyst take in the script's code to ensure the input is recognized by the playbook builder?

   • AAdd a comment block at the top of the script that declares the input name and type using the XSOAR metadata format.
   • BUse the 'return_outputs' function with a dictionary that includes the input key.
   • CCreate a separate YAML file in the same pack that lists the script's inputs and outputs.
   • DCall demisto.args() inside the main function to register the parameter dynamically at runtime.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An engineer has written a new automation script that parses JSON data from a webhook. Before adding it to a playbook, the engineer wants to verify the script's logic with sample data in a controlled environment. Which approach should the engineer use to test the script in XSOAR?

   • ACreate a new incident and attach the sample JSON as a file, then run the script from the war room.
   • BAdd the script to a temporary playbook and execute the playbook with a test incident.
   • CRun the script from the 'Automations' page using the 'Test' button and provide sample JSON as the argument.
   • DUse the 'debug' command in the XSOAR CLI to step through the script line by line.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC team has an automation script that enriches domain names. They need to update the script to use a new API endpoint, but several playbooks currently reference the old version. The team wants to ensure the playbooks continue to work while the new version is validated. What is the recommended approach for managing this change in XSOAR?

   • ACreate a new version of the script and update the playbook tasks to reference the new version after testing.
   • BEdit the existing script in place and immediately save the changes so all playbooks use the new endpoint.
   • CCopy the script to a new pack and leave the original untouched, then update playbooks to use the new pack.
   • DDelete the old script and create a new one with a different name, then update all playbooks manually.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A playbook has a task that runs an automation script to enrich an IP address. The script sometimes fails when the external threat-intel service is unreachable. The analyst wants the playbook to retry the task twice with a 30-second delay between attempts before marking the task as failed. Which configuration should the analyst apply to the playbook task?

   • AModify the script to include a while loop that retries the API call internally before returning an error.
   • BAdd a second task that runs the same script and configure the first task to 'skip on failure'.
   • CWrap the script call in a conditional task that checks the return value and loops back to the same task.
   • DSet the task's retry count to 2 and the retry interval to 30 seconds in the task's 'Retries' settings.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An engineer is troubleshooting a script that works in the XSOAR test environment but fails only in production. The script uses an API key stored in an integration instance. The engineer suspects the issue is related to the integration instance configuration. What is the most effective way to verify this hypothesis?

   • ACheck the script's code to see if it references a hardcoded API key.
   • BReview the playbook task's parameter mapping to ensure the correct integration instance is selected.
   • CCompare the integration instance settings between the test and production environments.
   • DRun the script manually in production with the same arguments and check if it fails, then inspect the war room error for authentication details.
   Reveal Solution Discussion Select an answer first