3.3 Identify and Describe the Various Playbook Task Types XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A playbook for data breach response needs to collect the affected data type from the analyst, then run a notification script, and finally check if the breach involves personal data. If it does, the playbook must send a regulatory notification. The team wants to minimize the number of task types used while keeping the logic clear. Which sequence of task types should they use?

   • ARegular task, data collection task, playbook task
   • BData collection task, regular task, conditional task
   • CPlaybook task, conditional task, regular task
   • DConditional task, regular task, data collection task
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An incident response playbook needs to gather the affected asset's hostname and the user's contact email from the analyst handling the case before proceeding with containment actions. The analyst must provide this information interactively during the playbook run. Which task type should be used to collect this input?

   • AA regular task that runs a script to extract the hostname and email from the incident fields
   • BA data collection task that prompts the analyst for the hostname and email address
   • CA conditional task that checks if the hostname and email are already present in the incident
   • DA section header task that labels the containment phase of the playbook
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In XSOAR, what does task looping allow a playbook task to do?

   • AIterate over a list of inputs, executing the task for each item
   • BBranch to different paths based on a condition
   • CExecute the task only once regardless of input
   • DDelay the task execution until a specified time
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A playbook needs to check the status of a sandbox analysis every 5 minutes until the analysis completes, up to a maximum of 10 checks. The team wants to configure a single task to perform this repeated status check without creating multiple copies of the task. Which task configuration should they use?

   • AEnable looping on the status-check task with a 5-minute delay between iterations and a maximum of 10 iterations
   • BUse a conditional task that checks the status and then calls itself recursively
   • CCreate 10 separate regular tasks, each with a 5-minute sleep before it
   • DSchedule the playbook to run every 5 minutes using a scheduler integration
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which XSOAR playbook task type is specifically designed to present a form to an analyst for input during playbook execution?

   • AData collection task
   • BRegular task
   • CConditional task
   • DSection header task
   Reveal Solution Discussion Select an answer first