By default, automation written in which language will be executed in a Docker container?
For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?
What is the correct definition regarding integration parameters and command arguments?
Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?
When uploading content, which two options could the upload include? (Choose two.)
When re-assigning an existing incident to a new incident type, an engineer is concerned about the preservation of critical data currently stored in fields that are only associated to the original incident type.
Upon making the change, in which state will the critical data be in the now unassociated fields?.
What happens if both a Classifier and Incident Type are configured in an integration instance's settings?
Which two options are the most effective for moving content between two environments? (Choose two.)
What can you use to assign a layout, field, and playbook to an incoming incident?
After enriching a username using Active Directory, an engineer would like to send an email to the user’s manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager’s email is returned, but not saved in the context.
How can the engineer save the data so it will be accessible?
During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.
Which of the following set of steps can help to resolve the issue?
An engineer would like to change an incident’s SLA according to the severity field changes. How can the engineer achieve this task?
A playbook task generates a report as HTML in the context data.
An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?
When using the playbook debugger, what may be the cause of a starred incident missing from the Test Data selections?.
What is the primary effect on a new file hash when it is added to the indicator exclusion list?.
Which XSOAR architecture would be recommended for Managed Security Service Providers (MSSP)?
In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)
Which two reasons would lead an engineer to create a custom widget? (Choose two.)
What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)
Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)
An engineer’s organization system is registered in the following manner:
What is the most efficient way for the engineer to achieve this?
What is the correct way to install different engines on the same Ubuntu machine for a Dev/Prod setup?.
An automation returned an output called: csvReport.
What filter would be used to check if the automation returned results?
What is the default configuration for indicator auto-extraction when incidents are created?
When using the playbook debugger, what may be the cause of a starred incident missing from the Test Data selections?.
Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?
Can an automation script execute an integration command and an integration command execute an automation script?
An engineer would like to present a trend using widgets to compare to a previous week’s data. Which two methods will allow the engineer to meet the requirement? (Choose two.)
Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)
An engineer adds a new "Forensics" tab that includes several sections for detailed artifact analysis to the "Malware Incident" layout. However, junior analysts report they cannot see this tab, while senior analysts can.
Which configuration setting is the most likely reason for this discrepancy?.
A playbook task is set up to run an integration command that takes no input and which outputs information to the context. The integration has several instances configured.
Which action will ensure the integration command only runs once?.
Which three authentication methods are supported when logging into XSOAR? (Choose three.)
Based on the images below,
what will be the result of the Filters and Transformers?.
An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critical issues:
• Rate limits being hit on integrated reputation services
• Incidents associated with hundreds of indicators
Given the settings below, what would prevent the issues in this use case?
Incident Type: AD-Analysis –
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user –
Mark results as note: False –
Indicator Extract Mode: Inline –
Quiet Mode: False –
Task 2: ad-disable-account –
Mark results as note: True –
Indicator Extract Mode: None –
Quiet Mode: True –
Task 3: servicenow-update-ticket –
Mark results as note: False –
Indicator Extract Mode: Use System Default
Quiet Mode: False
In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?
An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:
The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?
Threat Intel search queries can be shared with which of the following? (Select 1)
In which two locations can filters and transformers be used in XSOAR? (Choose two.)
When creating an incident layout section, it is best to place long field values within which of the following?
To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?
On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 14 Dec 2025
