In which two options can an automation script be executed? (Choose two.)

• A.Playbook
• B.Engine
• C.War room
• D.Integration

Comment: *

Name: *

Email: *

Verification: *

Can an automation script execute an integration command and an integration command execute an automation script?

• A.An automation script can execute an integration command and an integration command cannot execute an automation script
• B.An automation script can execute an integration command and an integration command can execute an automation script
• C.An automation script cannot execute an integration command and an integration command can execute an automation script
• D.An automation script cannot execute an integration command and an integration command cannot execute an automation script

Comment: *

Name: *

Email: *

Verification: *

Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.
After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

• A.Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual - Exit on yes - left:1, right 1) and perform the following tasks:
  - Active Directory User Enrichment based on the computerName
  - Create the ServiceNow Record by adding the enrichment information
  - Mark the ticket severity as Urgent
• B.Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:
  - Active Directory User Enrichment based on the computerName
  - Create the ServiceNow Record by adding the enrichment information
  - Mark the ticket severity as Urgent
• C.Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:
  - Active Directory User Enrichment based on the computerName
  - Create the ServiceNow Record by adding the enrichment information
  - Mark the ticket severity as Urgent
• D.Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
  - Increase the iterator value by one each time
  - Active Directory User Enrichment based on the computerName
  - Create the ServiceNow Record by adding the enrichment information

Comment: *

Name: *

Email: *

Verification: *

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.
Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

• A.Open a ticket with the XSOAR support team
• B.Send an email to [email protected]
• C.Create a pull request directly on Github
• D.Contribute through the XSOAR UI

Comment: *

Name: *

Email: *

Verification: *

An engineer's organization system is registered in the following manner: <SiteName-SystemID- Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?

• A.Change the reputation command for the internal system indicator type
• B.Create a new indicator type of the internal username and set a formatting script to extract only the username
• C.Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning
• D.Create a custom indicator field named 'username' and link it to the internal system indicator

Comment: *

Name: *

Email: *

Verification: *