EMT Practice Test

1. Question Content...

---

Question1: What are two main uses of context data? (Choose two.)

Question2: An automation returned an output called: csvReport.
What filter would be used to check if the automation returned results?

Question3: What can be added to offload integration instance processing from the main server?

Question4: In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

Question5: What can be used as integration parameters?

Question6: Can an automation script execute an integration command and an integration command execute an automation script?

Question7: An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed.
How would the engineer implement this?

Question8: Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882.
This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.
After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

Question9: What is the default task type when creating an empty task?

Question10: An engineer's organization system is registered in the following manner: <SiteName-SystemID- Username>.
The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?

Question11: An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?

Question12: How would context data be filtered to receive only malicious indicator values with DBotScore?

Question13: Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

Question14: Which two incident search queries are valid? (Choose two.)

Question15: Which two statements describe how timers are configured to start and stop automatically in a playbook?
(Choose two.)

Question16: What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Question17: Match the appropriate action to the layout type.

Question18: Which method accesses a field called 'User Mail' in a playbook?

Question19: Which two statements accurately describe layouts? (Choose two.)

Question20: Which component can be part of a load balancing group?

Question21: Which two reasons would lead an engineer to create a custom widget? (Choose two.)

Question22: Where can engineers add the post-processing scripts to incidents?

Question23: What are two common use cases for conditional tasks? (Choose two.)

Question24: Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

Question25: Which two options may be added when a content pack is being installed? (Choose two.)

Question26: Match the operations with the appropriate context.

Question27: Can an automation script execute an integration command and an integration command execute an automation script?

Question28: An engineer notices that playbooks only start once the user clicks the 'investigate' button and he/she would like the playbook to start automatically.
How can this be implemented?

Question29: What is a primary use case of data collection tasks?