QuestionQ1
Playbook DevelopmentA playbook task is configured to run an integration command that accepts no input and outputs information to the context. The integration has multiple instances configured.
Which action ensures that the integration command runs only once?
- A Specify the using- parameter to target a specific integration instance to run.
- B Click on Advanced Options Limits to specify the minimum / maximum run limits for a command.
- C Click on Performance Run Limits to specify the maximum run count before the task exits.
- D Specify the runlimit= parameter to limit the number of times a specific command will run.
QuestionQ2
Planning, Installation, and MaintenanceWhen the Only allow these dashboards checkbox is selected for a user role, what is the primary impact on users assigned to that role?
- A They are prompted to select their preferred dashboards upon login and can only modify these chosen dashboards.
- B They can only view specified dashboards and make minor modifications.
- C They will automatically have all dashboards that are shared with them added to their view.
- D They will be restricted to viewing only the specified default dashboards and cannot make any modifications.
Community Discussion
QuestionQ3
Playbook DevelopmentBased on the image shown, what is the output after Test is clicked?
- A Orange
- B Blue
- C Yellow
- D Red
Community Discussion
QuestionQ4
Incident Interactions and ReportingWhich command can add or update an incident description that may be used in widgets?
- A !setIncident description="This is an updated description."
- B !Set key="description" value="This is an updated description."
- C !Set key-"description" value-This is an updated description.
- D !setIncident description=This is an updated description.
Community Discussion
QuestionQ5
Playbook DevelopmentA playbook loop that queries Active Directory for user details, producing extensive data, is changed to extract newly acquired indicators of compromise (IOCs). This modification creates two critical issues:
- Rate limits are reached on integrated reputation services.
- Incidents are associated with hundreds of indicators.
Given the following settings, what would prevent these issues in this use case?
Incident Type: AD-Analysis -
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user -
Mark results as note: False -
Indicator Extract Mode: Inline -
Quiet Mode: False -
Task 2: ad-disable-account -
Mark results as note: True -
Indicator Extract Mode: None -
Quiet Mode: True -
Task 3: servicenow-update-Lickel.
Mark results as note: False -
Indicator Extract Mode: Use System Default
Quiet Mode: False
- A SetAD-Analysis incident creation extraction to "Extract specific indicators."
- B Set ad-get-user indicator extraction mode to None.
- C Set servicenow-update-ticket indicator extraction mode to Inline.
- D Disable the feature that allows marking task outputs as notes.
Community Discussion
That's the end of the preview
It's free
100% of the questions are free for all users.
No strings attached.
Community Discussion