I85PREP
⌘ K
XSOAR Engineer study materials
XSOAR Engineer study resources

XSOAR Engineer practice questions

One question at a time. Build your XSOAR Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1XSOAR architecture and deployment

In a standard XSOAR deployment, which component is responsible for executing integration commands and automation scripts?

  1. The Elasticsearch index
  2. The NGINX reverse proxy
  3. The PostgreSQL database
  4. The Cortex XSOAR server process Correct answer.

Explanation

The Cortex XSOAR server process hosts the integrations, automations, and playbook engine that actually run commands against external systems. The database and search index store data, and the reverse proxy only forwards HTTP traffic, so none of them execute integration logic.

Question 2XSOAR architecture and deployment

Which storage backend does Cortex XSOAR use to index incidents and indicators so they can be searched quickly?

  1. Redis
  2. PostgreSQL
  3. Amazon S3
  4. Elasticsearch Correct answer.

Explanation

XSOAR pairs a relational database for durable records with Elasticsearch for full-text indexing and fast querying of incidents and indicators. PostgreSQL holds the source-of-truth data, while the index serves search operations.

Question 3XSOAR architecture and deployment

An engineer needs a highly available XSOAR deployment so that a single server failure does not stop playbook execution. Which architecture satisfies this requirement?

  1. A standalone server with an external file share for content
  2. Multiple application servers behind a load balancer sharing external database and index Correct answer.
  3. A single all-in-one server with nightly backups
  4. One server with a larger CPU allocation and more memory

Explanation

High availability requires more than one application server so that traffic and playbook work can continue if one node fails. Those servers must share external PostgreSQL and Elasticsearch instances so state is consistent across nodes.

Question 4XSOAR architecture and deployment

Which port does the Cortex XSOAR web interface listen on by default for HTTPS access?

  1. 9200
  2. 8080
  3. 5432
  4. 443 Correct answer.

Explanation

The XSOAR web UI is served over HTTPS on port 443 by default, typically through the built-in reverse proxy. Port 8080 is commonly used for plain HTTP redirects, while 5432 and 9200 belong to PostgreSQL and Elasticsearch.

Question 5XSOAR architecture and deployment

During installation planning, which external service must be reachable for XSOAR to receive content and engine updates?

  1. A syslog collector
  2. A local SMTP relay
  3. The Cortex XSOAR content update distribution service Correct answer.
  4. An internal DNS forwarder

Explanation

XSOAR pulls content packs and engine updates from the vendor's distribution service, so outbound connectivity to it is required during install and for ongoing updates. SMTP, DNS, and syslog are optional integrations rather than update sources.

Question 6XSOAR architecture and deployment

An administrator wants playbook tasks to continue running even when the primary application server is taken offline for maintenance. What must be true of the deployment?

  1. The server must be configured with a larger playbook worker pool
  2. The maintenance window must be scheduled outside business hours
  3. At least one other application server must remain active and share the same database Correct answer.
  4. Playbooks must be paused manually before maintenance

Explanation

In a multi-server deployment, work is distributed across application nodes that share the same external database and index. If one node goes down, another active node can pick up queued and running playbook work.

Question 7XSOAR architecture and deployment

Which component in a distributed XSOAR architecture stores the durable incident records and configuration settings?

  1. The Elasticsearch cluster
  2. The content repository
  3. The PostgreSQL database Correct answer.
  4. The message broker

Explanation

PostgreSQL is the relational system of record for incidents, settings, and other durable objects in XSOAR. Elasticsearch provides search indexing, while the broker handles messaging between components.

Question 8XSOAR architecture and deployment

An engineer is sizing an XSOAR deployment and expects a very high volume of indicator enrichment. Which resource should be scaled to keep indicator indexing responsive?

  1. The DNS resolver
  2. The content update service
  3. The SMTP relay
  4. The Elasticsearch cluster Correct answer.

Explanation

Indicator and incident search performance depends on the Elasticsearch index, so heavy enrichment volumes require adequate index capacity. SMTP, DNS, and update services do not participate in indexing.

Question 9XSOAR architecture and deployment

Which statement describes the role of the reverse proxy in a standard XSOAR server deployment?

  1. It executes automation scripts on behalf of the server
  2. It stores incident attachments on disk
  3. It schedules playbook tasks across workers
  4. It terminates client HTTPS sessions and forwards requests to the application Correct answer.

Explanation

The reverse proxy sits in front of the application, handling TLS termination and routing incoming HTTP requests to the XSOAR server. It does not run automations, store files, or schedule tasks.

Question 10XSOAR architecture and deployment

A security team requires that all XSOAR traffic be encrypted and that clients never connect directly to backend services. Which deployment practice meets this?

  1. Route all traffic through the content update service
  2. Expose PostgreSQL and Elasticsearch ports to clients and skip the proxy
  3. Terminate TLS at the reverse proxy and keep backend services on a private network Correct answer.
  4. Disable HTTPS and rely on network segmentation

Explanation

Best practice is to terminate TLS at the reverse proxy and keep database and index services on a private, non-client-facing network. Clients then only reach the proxy over HTTPS, reducing exposure of backend services.

Question 11XSOAR architecture and deployment

Which XSOAR capability allows a single deployment to separate data and configuration for different business units while sharing infrastructure?

  1. Multiple tenants Correct answer.
  2. Multiple worker pools
  3. Multiple API keys
  4. Multiple content packs

Explanation

Multi-tenant deployments let one XSOAR installation host separate tenants, each with isolated data and configuration, on shared infrastructure. Worker pools, content packs, and API keys are features within a tenant rather than isolation boundaries.

Question 12XSOAR architecture and deployment

An engineer must back up XSOAR so it can be restored to a consistent state. Which combination captures the required data?

  1. Only the content repository export
  2. Only the Elasticsearch snapshot
  3. Only the PostgreSQL dump
  4. PostgreSQL data plus configuration and content, with Elasticsearch rebuildable Correct answer.

Explanation

PostgreSQL and configuration hold the durable state, so a backup must include them; the Elasticsearch index can be rebuilt from that data. Backing up only one store risks losing configuration or incident records.

Question 13XSOAR architecture and deployment

Which file system location on a standard XSOAR server typically holds installed content packs and custom content?

  1. The Elasticsearch data directory
  2. The PostgreSQL data directory
  3. The operating system temp directory
  4. The content directory under the installation path Correct answer.

Explanation

Installed and custom content such as integrations, scripts, and playbooks resides in the content directory under the XSOAR installation path. The database and index directories hold runtime data, and temp storage is transient.

Question 14XSOAR architecture and deployment

A deployment must survive the loss of the PostgreSQL primary. Which configuration addresses this?

  1. A single PostgreSQL instance with frequent dumps
  2. A PostgreSQL cluster with a standby replica Correct answer.
  3. A second reverse proxy
  4. A larger Elasticsearch cluster

Explanation

Database-level redundancy requires a PostgreSQL cluster with a standby that can take over if the primary fails. Dumps help recovery but not continuity, and index or proxy scaling does not protect the database.

Question 15XSOAR architecture and deployment

Which XSOAR component is primarily responsible for storing and serving playbook and integration content to application servers?

  1. The content repository Correct answer.
  2. The load balancer
  3. The message broker
  4. The syslog server

Explanation

The content repository holds playbook, integration, and script content and distributes it to application servers. The broker handles messaging, syslog collects logs, and the load balancer distributes traffic.

Question 16XSOAR architecture and deployment

An engineer is preparing firewall rules for a new XSOAR deployment. Which outbound destination is required for the server to fetch content and engine updates?

  1. The internal DNS server over port 53
  2. The SIEM collector over port 514
  3. The vendor content distribution endpoint over HTTPS Correct answer.
  4. The internal SMTP relay over port 25

Explanation

Content and engine updates are fetched over HTTPS from the vendor distribution endpoint, so outbound access to it is mandatory. SMTP, DNS, and syslog destinations support optional features rather than updates.

Question 17XSOAR architecture and deployment

Which statement best describes how XSOAR application servers in a cluster coordinate playbook execution?

  1. Each server runs an independent database and syncs by email
  2. Servers share external database and index services and distribute work Correct answer.
  3. Playbook execution is disabled in clustered deployments
  4. Only the first server ever executes playbooks

Explanation

Clustered application servers share the external PostgreSQL and Elasticsearch services, which lets work be distributed and state remain consistent. They do not maintain independent databases or restrict execution to one node.

Question 18XSOAR architecture and deployment

Which XSOAR feature lets an administrator distribute processing load by assigning specific integrations or workloads to designated servers?

  1. Layout rules
  2. Incident types
  3. Worker groups Correct answer.
  4. Indicator expiration policies

Explanation

Worker groups allow administrators to dedicate specific servers to particular workloads or integrations, balancing processing across the deployment. Incident types, layouts, and expiration policies are data-model settings, not workload distribution controls.

Question 19XSOAR architecture and deployment

A team wants a single XSOAR server to handle more concurrent playbook tasks without adding hardware. Which adjustment is most directly relevant?

  1. Enabling more content packs
  2. Increasing the indicator retention period
  3. Adding more incident types
  4. Increasing the playbook worker process count Correct answer.

Explanation

The number of playbook worker processes governs how many tasks the server can execute concurrently, so increasing it raises throughput on existing hardware. Retention, incident types, and content packs do not directly control concurrency.

Question 20XSOAR architecture and deployment

Which practice best protects a distributed XSOAR deployment's database credentials?

  1. Share them over email with the team
  2. Store them in plain text in playbook comments
  3. Use a secrets management mechanism and restrict database network access Correct answer.
  4. Embed them in every integration script

Explanation

Credentials should be held in a secrets management mechanism and the database should only accept connections from authorized XSOAR hosts. Hardcoding or sharing credentials in plain text exposes them broadly.

Question 21XSOAR architecture and deployment

An engineer observes that incident searches are slow while playbook execution remains normal. Which component should be investigated first?

  1. The SMTP relay
  2. The content repository
  3. The reverse proxy
  4. The Elasticsearch cluster Correct answer.

Explanation

Incident and indicator searches are served by Elasticsearch, so search latency points to index health, sizing, or shard issues. Playbook execution and notifications depend on other components.

Question 22XSOAR architecture and deployment

Which XSOAR deployment model is appropriate for a small team that wants minimal infrastructure and accepts a single point of failure?

  1. A multi-tenant cluster across regions
  2. A multi-server cluster with external database and index
  3. A distributed deployment with standby database
  4. A single all-in-one server with external database Correct answer.

Explanation

A single all-in-one server minimizes infrastructure for small teams, at the cost of a single point of failure. Clustered, multi-tenant, and standby-database models add redundancy and complexity beyond what is required.

Question 23XSOAR architecture and deployment

Which statement about the relationship between the XSOAR application and its external database is accurate?

  1. The application can run without any database
  2. The database is optional when Elasticsearch is present
  3. The application requires a reachable database to start and operate Correct answer.
  4. The database runs only during business hours

Explanation

XSOAR depends on its PostgreSQL database for configuration and incident data, so it must be reachable for the application to start and function. Elasticsearch complements but does not replace the database.

Question 24XSOAR architecture and deployment

An organization plans to upgrade XSOAR with minimal downtime. Which approach best supports this goal?

  1. Upgrade a single all-in-one server during peak hours
  2. Disable all integrations permanently before upgrading
  3. Perform a rolling upgrade across clustered application servers Correct answer.
  4. Delete the Elasticsearch index before upgrading

Explanation

In a clustered deployment, a rolling upgrade lets nodes be updated one at a time while others continue serving, minimizing downtime. Upgrading a single server at peak time or destroying the index causes disruption.

Question 25XSOAR architecture and deployment

Which item is a prerequisite for installing Cortex XSOAR on a supported Linux host?

  1. A supported operating system version with required resources Correct answer.
  2. An external SMTP server
  3. A Windows domain controller
  4. A dedicated GPU

Explanation

Installation requires a supported Linux operating system version with adequate CPU, memory, and disk per sizing guidance. A domain controller, GPU, and SMTP server are not installation prerequisites.

Question 26XSOAR architecture and deployment

In a standard Cortex XSOAR server deployment, which service handles authentication and role assignment for users logging into the web interface?

  1. The reverse proxy's client certificate store
  2. The content repository's permission manifest
  3. The PostgreSQL database's native user table with direct login
  4. The application server's built-in user management with role-based access control Correct answer.

Explanation

Cortex XSOAR ships with its own user management layer where administrators create users and assign roles that determine which features and data they can access. The database is a backend persistence layer and is not the authentication authority for the UI, and the reverse proxy and content repository do not grant XSOAR roles.

Question 27XSOAR architecture and deployment

An engineer is planning capacity for a Cortex XSOAR deployment and needs to know which component executes integration commands and playbook tasks.

  1. The PostgreSQL database
  2. The application server Correct answer.
  3. The reverse proxy
  4. The content delivery repository

Explanation

The XSOAR application server runs the playbook engine and executes integration commands, so CPU and memory sizing on that server drives task throughput. The database persists data, the content repository distributes content, and the reverse proxy only forwards traffic.

Question 28XSOAR architecture and deployment

Which Cortex XSOAR component is the system of record that persists incidents, indicators, and system configuration?

  1. The content pack repository
  2. The application server's in-memory cache
  3. The load balancer
  4. The PostgreSQL database Correct answer.

Explanation

Cortex XSOAR persists durable data such as incidents, indicators, and configuration in its PostgreSQL database, which is why database availability and backup are critical. Application memory, content packs, and the load balancer do not hold the authoritative records.

Question 29XSOAR architecture and deployment

An organization wants high availability for Cortex XSOAR and asks which statement about multi-server deployments is accurate.

  1. Multiple application servers require a shared NFS mount for the database files
  2. Multiple application servers can share a single external PostgreSQL database to provide redundancy Correct answer.
  3. Each application server must run its own embedded database that is synchronized peer to peer
  4. Only one application server may ever be active, and the others must remain powered off

Explanation

In a distributed deployment, several XSOAR application servers connect to a shared external PostgreSQL database, so if one application server fails the others continue serving users. The database is external rather than embedded per server, database files are not served over NFS, and standby servers can be online behind a load balancer.

Question 30XSOAR architecture and deployment

A security architect requires that Cortex XSOAR integration traffic to external SaaS APIs be inspected and logged by the corporate egress proxy. Which configuration accomplishes this?

  1. Install the egress proxy certificate only on the PostgreSQL host
  2. Disable TLS verification on the integrations so the egress proxy can read plaintext
  3. Configure the server's HTTP and HTTPS proxy settings so integration traffic is routed through the proxy Correct answer.
  4. Route integration traffic through the reverse proxy that fronts the XSOAR UI

Explanation

Cortex XSOAR supports configuring an HTTP/HTTPS proxy at the server level so outbound integration traffic is sent through the corporate egress proxy for inspection and logging. Disabling TLS verification weakens security rather than enabling inspection, and the reverse proxy in front of the UI handles inbound traffic, not outbound integration calls.

Question 31XSOAR architecture and deployment

An engineer must confirm that a Cortex XSOAR application server can reach its external database. Which default PostgreSQL port should be permitted between them?

  1. 5432 Correct answer.
  2. 1433
  3. 27017
  4. 3306

Explanation

PostgreSQL listens on TCP 5432 by default, so firewall rules between XSOAR application servers and the database host must allow that port. Port 1433 is Microsoft SQL Server, 3306 is MySQL, and 27017 is MongoDB, none of which XSOAR uses for its primary datastore.

Question 32XSOAR architecture and deployment

A team wants to run Cortex XSOAR in Docker containers on a supported Linux host. Which statement describes the supported containerized deployment?

  1. The deployment uses containerized application and database services on a single Docker host for small environments Correct answer.
  2. Containers may run only the reverse proxy while the application runs on a separate physical server
  3. Each container runs a full copy of the database and the containers replicate to each other
  4. Containerized deployments require a Kubernetes cluster with at least three worker nodes

Explanation

Cortex XSOAR offers a Docker-based deployment intended for smaller environments, where the application and database run as containers on a single Docker host. It does not replicate full databases between containers, does not require a multi-node Kubernetes cluster, and is not limited to running only the reverse proxy.

Question 33XSOAR architecture and deployment

An administrator needs Cortex XSOAR to send email notifications and Syslog messages to internal systems. Which statement about the required network flows is accurate?

  1. Outbound SMTP and Syslog flows must be allowed from the application server to the destination hosts Correct answer.
  2. Syslog is delivered over the reverse proxy's inbound listener
  3. Only inbound flows matter because XSOAR never initiates outbound connections
  4. Email notifications are sent by the PostgreSQL database host

Explanation

Cortex XSOAR initiates outbound connections for notifications, so the application server needs egress to the SMTP relay and to Syslog collectors. XSOAR does make outbound connections, Syslog is not handled by the inbound reverse proxy listener, and the database does not send notifications.

Question 34XSOAR architecture and deployment

An engineer must place the Cortex XSOAR reverse proxy and application server correctly in a hardened topology. Which arrangement matches the intended design?

  1. Clients connect to the content repository, which proxies requests to the application server
  2. Clients connect to the reverse proxy, which forwards requests to the application server Correct answer.
  3. Clients connect to the application server, which forwards requests to the reverse proxy
  4. Clients connect directly to the PostgreSQL database, which serves the UI

Explanation

In the standard topology, clients reach the reverse proxy, which terminates TLS and forwards requests to the backend application server. The application server does not front the proxy, and neither the database nor the content repository serves the UI to clients.

Question 35XSOAR architecture and deployment

A Cortex XSOAR administrator must verify that the server has enough entropy for TLS operations and integration authentication. Which host prerequisite addresses this?

  1. Ensuring adequate available entropy or a hardware random number generator Correct answer.
  2. Configuring a large swap partition
  3. Adding additional content packs
  4. Increasing the PostgreSQL shared_buffers setting

Explanation

TLS handshakes and cryptographic operations consume entropy, so a supported host should have sufficient entropy available, often through a hardware random number generator or entropy daemon. Swap size, database buffer settings, and content packs do not supply cryptographic randomness.

Question 36XSOAR architecture and deployment

An organization must keep Cortex XSOAR operational if an entire application server is lost. Which deployment characteristic provides this resilience?

  1. A single application server with a larger CPU allocation
  2. A standby reverse proxy only
  3. A nightly export of incidents to a file share
  4. Multiple application servers behind a load balancer sharing one external database Correct answer.

Explanation

Resilience to the loss of an application server comes from running multiple application servers behind a load balancer against a shared external database, so remaining servers continue serving users. A bigger single server, file exports, and a standby proxy alone do not keep the application available.

Question 37XSOAR architecture and deployment

An engineer is troubleshooting why a newly added application server in a cluster does not appear to serve requests. Which configuration element most directly determines whether clients are routed to it?

  1. The size of the PostgreSQL WAL directory
  2. The number of content packs installed on the server
  3. The load balancer's backend pool and health check configuration Correct answer.
  4. The TLS cipher suite used by the reverse proxy

Explanation

Clients reach application servers through the load balancer, so the server must be a member of the backend pool and must pass the configured health check before traffic is sent to it. Content pack count, WAL size, and cipher selection do not control client routing.

Question 38XSOAR architecture and deployment

An administrator wants to limit which networks can reach the Cortex XSOAR web interface. Which control point is most appropriate in the standard deployment?

  1. Restrict access at the reverse proxy or upstream firewall that fronts the application server Correct answer.
  2. Restrict access by disabling the application server's loopback interface
  3. Restrict access by uninstalling unused content packs
  4. Restrict access using PostgreSQL pg_hba.conf entries for browser clients

Explanation

Inbound client access is controlled at the edge, meaning the reverse proxy or the firewall in front of it, so only approved networks reach the XSOAR UI. PostgreSQL host-based rules govern database connections rather than browser clients, and content packs or loopback settings do not restrict web access.

Question 39XSOAR architecture and deployment

A deployment team is deciding between a single-server and a distributed Cortex XSOAR architecture. Which requirement most strongly justifies the distributed model?

  1. The organization needs the application tier to remain available during maintenance of one application server Correct answer.
  2. The organization wants to reduce the number of open outbound ports
  3. The team prefers to run the database on the same host as the application
  4. The team wants the simplest possible installation for a handful of analysts

Explanation

The distributed model separates the application tier from the database and allows multiple application servers, so maintenance or failure of one application server does not take the service down. Simplicity and co-locating the database describe the single-server model, and reducing outbound ports is unrelated to the architecture choice.

Question 40XSOAR architecture and deployment

An engineer must confirm that the Cortex XSOAR application server clock is accurate before enabling integrations that rely on time-based one-time passwords. Which practice addresses this?

  1. Configure the host to synchronize time with NTP servers Correct answer.
  2. Increase the reverse proxy's session timeout
  3. Install the latest content pack release
  4. Set the PostgreSQL timezone to UTC only

Explanation

Time-based authentication and signed requests depend on accurate clocks, so the application server host should synchronize with reliable NTP sources. Setting the database timezone, adjusting proxy session timeouts, and installing content packs do not correct clock drift on the application server.

Question 41Content development (playbooks, scripts, integrations)

In a Cortex XSOAR playbook, which task type is used to branch execution based on the value of a context key or a conditional expression?

  1. A section header task
  2. A manual task
  3. A conditional task Correct answer.
  4. A standard task

Explanation

A conditional task evaluates one or more conditions against context or script output and routes execution down the matching branch. It is the standard mechanism for decision logic inside a playbook rather than for collecting human input or running a single automation.

Question 42Content development (playbooks, scripts, integrations)

When you edit a Python automation in Cortex XSOAR, which statement about the code entry point is correct?

  1. The script is executed by a separate worker that requires an explicit shebang and entry-point declaration
  2. Only the first function defined in the file is executed, regardless of its name
  3. The main() function is invoked automatically and its return value is written to the war room and context Correct answer.
  4. The script must call demisto.results() at module import time because main() is never executed

Explanation

Cortex XSOAR automation scripts conventionally define a main() function that the runtime calls, and whatever main() returns becomes the script result available in context and the war room. Inside main() you typically use return_results or demisto.results to emit output.

Question 43Content development (playbooks, scripts, integrations)

Which command is the recommended way to return a CommandResults object from a Cortex XSOAR Python integration command?

  1. sys.stdout.write(str(CommandResults(...)))
  2. return_results(CommandResults(...)) Correct answer.
  3. print(CommandResults(...))
  4. demisto.results(CommandResults(...))

Explanation

return_results accepts CommandResults objects and handles converting them into entries, context, and indicators. It is the modern replacement for the older demisto.results pattern and is required for outputs such as readable outputs and indicator extraction.

Question 44Content development (playbooks, scripts, integrations)

What is the primary purpose of an integration instance configuration in Cortex XSOAR?

  1. To map incident fields to integration outputs
  2. To schedule playbooks that call the integration
  3. To define the YAML schema of the integration commands
  4. To store connection parameters and credentials that the integration uses at runtime Correct answer.

Explanation

An instance holds the concrete configuration, such as server URL, API key, and proxy settings, that a specific integration uses when it runs. Multiple instances of the same integration can exist with different parameters.

Question 45Content development (playbooks, scripts, integrations)

In the Cortex XSOAR integration YAML, which key declares the arguments a command accepts?

  1. params
  2. outputs
  3. args Correct answer.
  4. inputs

Explanation

Each command in the integration YAML lists its accepted arguments under the args key, including name, description, and whether each is required. Outputs are declared separately under outputs.

Question 46Content development (playbooks, scripts, integrations)

Which file in a Cortex XSOAR content pack defines pack-level metadata such as name, description, and current version?

  1. metadata.yaml
  2. manifest.json
  3. pack_metadata.json Correct answer.
  4. pack_info.yml

Explanation

pack_metadata.json holds the pack's name, description, support level, and version fields used when building and uploading the pack. Other files such as the integration YAML describe individual content items.

Question 47Content development (playbooks, scripts, integrations)

What does the dbotFindSimilarIncidents automation help a playbook accomplish?

  1. It reruns the current playbook on every open incident
  2. It deletes duplicate incidents from the incident table automatically
  3. It converts an incident into a case management ticket
  4. It retrieves incidents similar to the current one so they can be linked or deduplicated Correct answer.

Explanation

dbotFindSimilarIncidents searches existing incidents for similarity to the current incident, which supports deduplication and linking related activity. The playbook can then decide how to handle the returned matches.

Question 48Content development (playbooks, scripts, integrations)

A playbook task needs a value that is only known after an earlier task returns its output. Which approach correctly passes that value forward?

  1. Hardcode the value in the later task's input at design time
  2. Reference the earlier task's output context key in the later task's input Correct answer.
  3. Copy the value into the playbook description and read it from there
  4. Rely on the value being globally available as a built-in context key

Explanation

Task outputs are written to context under keys declared by the task, and later tasks reference those keys to consume the value dynamically. This keeps the playbook data-driven rather than depending on fixed literals.

Question 49Content development (playbooks, scripts, integrations)

In a Python integration command, what does demisto.args() return?

  1. The integration instance configuration parameters
  2. The raw HTTP response from the last API call
  3. A dictionary of the arguments supplied to the current command Correct answer.
  4. A list of all commands the integration exposes

Explanation

demisto.args() returns the arguments for the currently executing command as a dictionary keyed by argument name. Instance configuration values are accessed separately through demisto.params().

Question 50Content development (playbooks, scripts, integrations)

Which demisto method retrieves the configuration parameters of the integration instance that is currently running?

  1. demisto.incident()
  2. demisto.params() Correct answer.
  3. demisto.args()
  4. demisto.context()

Explanation

demisto.params() returns the instance configuration, including credentials and endpoint settings, for the running integration. It is distinct from per-command arguments and from incident context.