AFields can be used in playbooks and labels cannot
BFields are indexed in the database and labels are not
CLabels can be used in queries and fields cannot
DLabels are indexed in the database and fields are not
DRAG DROP -
Match the operations with the appropriate context.
Select and Place:
How would context data be filtered to receive only malicious indicator values with DBotScore?
AGet DBotScore.value where DBotScore.Score (Larger or equals) 4
BGet DBotScore.value where DBotScore.Score (equals (int)) 3
CGet DBotScore where DBotScore.Score (Larger than) 1
DGet DBotScore where DBotScore.Score (Larger or equals) 2
You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?
Atype:File reputation:Malicious sourcetimestamp:"30 days ago"
Btype:File verdict:Malicious sourcetimestamp:<="30 days ago"
Ctype:File reputation:Malicious sourcetimestamp:="30 days ago"
Dtype:File verdict:Malicious sourcetimestamp:>="30 days ago"
What is the default landing page for a new user in XSOAR?
ADashboards
BThreat Intel
CSettings
DMarketplace
Threat Intel search queries can be shared with which of the following? (Select 1)
AUsers defined in the platform (email or username)
BOther organizations via the Marketplace
CUsers outside XSOAR via email invite
DRoles defined in the platform
What is an example of a generic reputation command?
A!ip
B!getReputation
C!reputation
D!enrichIndicator
What is the function of timer SLA fields in Cortex XSOAR?
ATo track SLA breaches per playbook
BTo run a script that executes on SLA assignment
CTo automatically alert the analyst on SLA breach
DTo count the time between one or more tasks
What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)
ADownload content for offline installation
BUninstall content pack
CUpdate to x version
DRevert to x version
Which of the following is a basic setting that can be configured in an automation?
ASummary
BCompiler
CSchedule
DRun On
What happens if both a Classifier and Incident Type are configured in an integration instance's settings?
AThe administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.
BThe Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.
CThe Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.
DBoth the Classifier and Incident Type will classify incoming incidents.
When creating an incident layout section, it is best to place long field values within which of the following?
ASection headers
BRows
CCanvas
DCards
While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?
ADefine the Incident Fetch Interval when running the integration’s commands.
BDuplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.
CConfigure the application to send incidents on the required interval.
DDuplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.
When is the post-processing script executed in XSOAR?
AJust after the incident is created
BJust after the pre-processing is executed
CJust after the playbook is executed
DJust after the Close Incident button is clicked
Which option is available in XSOAR to create the body of a Threat Intel Report?
AMarkdown
BGrid Fields
CDOC format
DJavascript
Which two input requirements are needed to train a machine learning model? (Choose two.)
A3000 Incidents
BIncident Field
CVerdict Label
DIncident Type
An engineer is developing a playbook that will be run multiple times for testing purposes.
What is the recommended first task to be used in the playbook?
ADeleteContext
BGenerateTest
CPrintContext
DSetContext
What does Script helper contain?
AAvailable commands
BPermission settings
CAutomation version history
DAutomation timeout configuration
Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)
APython
BPerl
CGo
DJavaScript
EPowershell
What are three different loop types in a playbook? (Choose three.)
AAutomation
BBuilt-in
CData collection
DConditional
EFor-each
What is the default task type when creating an empty task?
AStandard (Manual)
BConditional
CSection header
DStandard (Automated)
By default, automation written in which language will be executed in a Docker container?
APython
BGo
CJavaScript
DPerl
Which investigation element is best suited for collaboration among users?
AWork Plan
BRelated Incidents
CWar Room
DContext Data
Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)
AAdd a distributed database server
BAdd an indexing server
CAdd a live backup server (disaster recovery)
DAdd an engine
Management would like to get an incident report automatically following an incident's closure.
How would this be accomplished?
ADefine a task in a playbook to generate an incident report before the closure occurs
BManually create an 'Incident Report'
CConfigure post-processing using a script
DCreate an 'Incident Report' from the Reports page