XSOAR-Engineer Exam Questions in PDF and Online

QUESTION: 17

After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.

How can the engineer save the data so it will be accessible?

Mark ignore output = true
Use extend-context
Use raw-response = save
Mark ignore input = true

Answer(s): B

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/extend- context/extend-context-using-the-command-line.html

Reveal Solution Next Question

QUESTION: 18

Where can engineers add the post-processing scripts to incidents?

The post-processing tag must be added to the automation
Post-processing scripts must be added at the end of playbooks
Post-processing scripts must be added from the Incident Type editor
Post-processing scripts must be added from the Post-Process Rules editor

Answer(s): C

Reveal Solution Next Question

QUESTION: 19

An engineer would like to present a trend using widgets to compare to a previous week's dat

Which two methods will allow the engineer to meet the requirement? (Choose two.)
Create widget of type Line, check `Display Trend' and define as 7 days ago
Create a custom widget using a new incident query
Create widget of type Number, check `Display Trend' and define as 7 days ago
Create a custom widget using a script

Answer(s): A,D

Reveal Solution Next Question

QUESTION: 20

What happens when an integration is deprecated?

The integration commands in a playbook can no longer be used
The integration commands can be used, but it is recommended to update to the latest content pack
The configuration settings will be lost and the integration will no longer function
The integration commands in a playbook can be used, but it will fail at runtime

Answer(s): B

Reveal Solution Next Question