Question 1
Consider a scenario where a malware alert from an EDR solution triggers an XSOAR incident. The playbook needs to dynamically determine if the malware is known and, if so, automatically block its hash on all firewalls. If it's unknown, it should submit the sample to a sandbox for analysis. Which XSOAR playbook task best facilitates this dynamic decision-making and execution flow?
Question 2
A security analyst needs to automate a daily check of all open incidents for specific keywords and then post a summary to a Microsoft Teams channel. This task needs to run consistently every morning at 9:00 AM, regardless of active incident workflows. Which XSOAR component is most appropriate for this recurring, non-workflow-dependent automation, and why?
Question 3
A global organization uses Cortex XSIAM and has stringent data residency requirements. They operate data centers in regions where XSIAM's cloud-native log ingestion endpoints are not yet available. They need to ingest logs from their on-premise infrastructure, including Windows Event Logs, Linux Syslog, and custom application logs, ensuring all data remains within specific regional boundaries before being processed and analyzed by XSIAM. What is the most appropriate and compliant ingestion architecture for this scenario, and what specific XSIAM components are critical?
Question 4
Your organization uses a highly integrated Palo Alto Networks security ecosystem, including NG Firewalls, Cortex XDR, and Cortex XSOAR. An active phishing campaign is targeting your employees, using a novel social engineering technique to bypass initial email security layers. Threat intelligence indicates the campaign uses a specific, newly registered domain ('malicious-phish.xyz') and downloads a custom payload with a unique MD5 hash ('al b2c3d4e5f6g7h8i9j0k112m3n405p6'). Which of the following automated,workflows in Cortex XSOAR, triggered by threat intelligence, would provide the most comprehensive and rapid response to contain and eradicate this threat, and enrich future intelligence?
Question 5
A Palo Alto Networks customer is using Cortex XSOAR for Security Orchestration, Automation, and Response. A new critical vulnerability (CVE-2023-XXXX) with active exploits has been published. The CISO wants to understand how 'AI' (beyond just 'ML') in XSOAR can accelerate the response, specifically in generating a comprehensive incident response plan and automatically enriching indicators of compromise (IOCs). Which of the following best describes this AI capability?