EMT Practice Test

1. Question Content...

---

Question1: Which two statements describe how timers are configured to start and stop automatically in a playbook?
(Choose two.)

Question2: Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

Question3: What are three different loop types in a playbook? (Choose three.)

Question4: An Engineer wants to filter a csvList value according to a dynamic value saved under the test context key.
Which three values would save the test context key? (Choose three.)

Question5: What can be used as integration parameters?

Question6: Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

Question7: An engineer notices that playbooks only start once the user clicks the 'investigate' button and he/she would like the playbook to start automatically.
How can this be implemented?

Question8: Match the appropriate action to the layout type.

Question9: What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Question10: Match the operations with the appropriate context.

Question11: When creating an incident layout section, it is best to place long field values within which of the following?

Question12: Which content type cannot be managed using remote repositories?

Question13: At what stage during the incident lifecycle is an incident type assigned?

Question14: Which three actions can an engineer take on the troubleshooting page? (Choose three.)

Question15: What does Script helper contain?

Question16: Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

Question17: Which method accesses a field called 'User Mail' in a playbook?

Question18: An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.
Which command will accomplish this?

Question19: Given an incident with three files, how could the name of the second file be referenced?

Question20: Which two options may be added when a content pack is being installed? (Choose two.)

Question21: When uploading content, which two options could the upload include? (Choose two.)

Question22: After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.
How can the engineer save the data so it will be accessible?

Question23: An engineer would like to change an incident's SLA according to the severity field changes. How can the engineer achieve this task?

Question24: In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

Question25: An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?

Question26: Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

Question27: A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

Question28: What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

Question29: Which three support types are included in the Marketplace Content Packs? (Choose three.)

Question30: Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

Question31: Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

Question32: Which three statements are true about the Marketplace? (Choose three.)

Question33: A large number of incidents were deleted by mistake.
Which two architecture components can be used to recover the lost data? (Choose two.)

Question34: What is the default configuration for indicator auto-extraction when incidents are created?

Question35: When mapping incoming data to incident fields, which statement is correct?

Question36: An automation returned an output called: csvReport.
What filter would be used to check if the automation returned results?

Question37: Arrange these steps in the order that they occur during an incident fetch.

Question38: To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?

Question39: When mapping incoming data to incident fields, which statement is correct?

Question40: An analyst runs the following command in a playbook task:
!ip ip=1.1.1.1
Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

Question41: Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

Question42: Which built-in automation/command cab be used to change an incident's type?

Question43: A playbook task generates a report as HTML in the context data.
An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

Question44: Match the corresponding action with the appropriate playbook tasks.

Question45: Who is permitted to create and submit content to the Marketplace?

Question46: During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.
Which of the following set of steps can help to resolve the issue?

Question47: What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Question48: Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

Question49: What is the function of timer SLA fields in Cortex XSOAR?

Question50: Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

Question51: A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

Question52: What is the correct definition regarding integration parameters and command arguments?

Question53: Match the action with the most appropriate playbook task type.

Question54: Match the operations with the appropriate context.

Question55: In Cortex XSOAR multi tenant setup, when content from a development server is pushed to the remote repository, where in the production server can the updates be found?

Question56: Which two incident search queries are valid? (Choose two.)

Question57: By default, automation written in which language will be executed in a Docker container?

Question58: What is the default task type when creating an empty task?

Question59: What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

Question60: Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

Question61: What is a primary use case of data collection tasks?

Question62: An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.
Which command will accomplish this?

Question63: An administrator wants to send an email via the Mail Sender integration. Which of the following out of the box methods would be used for that?

Question64: Which three types of information are displayed on the incident Quick View? (Choose three.)

Question65: An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?