3.3 Identify and Describe the Various Playbook Task Types XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of a section header task in an XSOAR playbook?

   • ATo branch execution based on a condition
   • BTo organize and label groups of tasks for readability and structure
   • CTo execute a single action or command
   • DTo gather input from users
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A playbook is becoming difficult to read because it contains 15 tasks that perform enrichment, containment, and notification steps all mixed together. The team wants to visually group these tasks into logical phases so that analysts can quickly understand the flow. Which task type should they add to the playbook to achieve this organization?

   • AConditional tasks that separate the phases based on the incident severity
   • BPlaybook tasks that call separate sub-playbooks for each phase
   • CData collection tasks that ask the analyst to identify which phase a task belongs to
   • DSection header tasks that label the enrichment, containment, and notification phases
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A team has a parent playbook that handles incident triage. It needs to call a sub-playbook for endpoint containment, but only if the incident severity is 'High' or 'Critical'. The containment sub-playbook requires the endpoint ID as an input. The team wants to avoid duplicating the containment logic in the parent playbook. Which configuration should they use?

   • AA conditional task that checks the severity and branches to a playbook task that calls the containment sub-playbook with the endpoint ID
   • BA playbook task that calls the containment sub-playbook unconditionally, and let the sub-playbook check the severity
   • CA data collection task that asks the analyst to manually run the containment sub-playbook
   • DA regular task that runs the containment command directly in the parent playbook
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A playbook is designed to handle phishing emails. After a data collection task gathers the email's sender address, the playbook must run a single command to query the internal directory for the sender's department. The team wants to keep this step simple and direct. Which task type should they use for the directory query?

   • AA playbook task that calls a sub-playbook containing the directory query
   • BA conditional task that checks if the sender is in the directory before querying
   • CA regular task that runs the directory query command with the sender address as input
   • DA section header task that labels the directory query step
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a regular task in an XSOAR playbook?

   • ATo execute a single action or command
   • BTo collect input from a user
   • CTo invoke a sub-playbook
   • DTo branch execution based on a condition
   Reveal Solution Discussion Select an answer first