3.3 Identify and Describe the Various Playbook Task Types XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In XSOAR, which task type allows you to call a sub-playbook that handles a specific type of incident, such as 'Phishing Investigation'?

   • ARegular task
   • BData collection task
   • CPlaybook task
   • DConditional task
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a regular task in an XSOAR playbook?

   • ACalling a sub-playbook that handles phishing
   • BPrompting the analyst to enter a classification
   • CRunning the 'get-incident' command to retrieve incident details
   • DChecking if the incident severity is high
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations team is building a playbook that enriches an indicator. They want the playbook to check if the indicator type is 'IP' and, if so, run a WHOIS lookup. If the indicator is not an IP, they want to skip the WHOIS lookup and proceed directly to the final report task. Which task type should they use to implement the branching logic?

   • AA playbook task that calls a sub-playbook containing the WHOIS lookup and the final report
   • BA data collection task that asks the analyst to manually decide whether to run the WHOIS lookup
   • CA regular task that runs a script to check the indicator type and then always executes the WHOIS lookup
   • DA conditional task that evaluates the indicator type and routes to the WHOIS task or the final report task
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the main purpose of a data collection task in an XSOAR playbook?

   • ATo execute a single command or script
   • BTo invoke a sub-playbook
   • CTo branch execution based on a condition
   • DTo gather input from users or external sources during playbook execution
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which XSOAR playbook task type would you use to ask an analyst to confirm whether an email is phishing before proceeding with containment?

   • AConditional task
   • BPlaybook task
   • CRegular task
   • DData collection task
   Reveal Solution Discussion Select an answer first