Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksHard
A security analyst is reviewing a complex incident response playbook and notices that several tasks are configured with a `timeout` value of `0`. The associated integrations themselves have varying default timeouts (e.g., 60 seconds for a SIEM query, 120 seconds for a forensic tool). What is the practical implication of setting a task `timeout` to `0` in a playbook?
- AThe playbook will automatically retry the task until it succeeds, regardless of time.
- BThe task will run indefinitely, ignoring any integration-level timeouts.
- CThe task will immediately fail if it doesn't complete within 1 second.
- DThe task will inherit and respect the timeout configured for the underlying integration command.
Show answer & explanationAnswer & explanation
Correct answer: D. The task will inherit and respect the timeout configured for the underlying integration command.
A task timeout of `0` in Cortex XSOAR means that the task itself does not impose an additional timeout. Instead, it will rely on and respect the timeout configured for the specific integration command it executes. If the integration command has a timeout (e.g., 60 seconds), the task will wait that long before failing.
Why the other options are wrong
- A. Timeout settings do not automatically trigger retries; retries are a separate configuration.
- B. The task will not run indefinitely; it will still be bound by the integration's timeout.
- C. A timeout of 0 does not mean 1 second; it means no task-level timeout is enforced.
Task Timeout (Value of 0)
In Cortex XSOAR, a task `timeout` value of `0` signifies that the task itself will not enforce an execution time limit, instead deferring to and respecting the timeout configured at the integration command level.
- Does not impose a task-level timeout.
- Respects the underlying integration's command timeout.
- Allows integrations to control their own execution limits.
Memory trick: Zero timeout means the integration takes the lead, its timer decreed.