Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksEasy
A security orchestration engineer is designing a playbook to handle phishing incidents. After an initial enrichment task, the playbook needs to decide whether to automatically block the sender or require manual approval based on the sender's reputation. Which playbook component should be used to implement this decision logic?
- AA while loop
- BA script task
- CA condition
- DA sub-playbook
Show answer & explanationAnswer & explanation
Correct answer: C. A condition
Conditions are specifically designed in Cortex XSOAR playbooks to evaluate expressions and direct the playbook's flow based on the outcome, making them ideal for decision-making points.
Why the other options are wrong
- A. Loops are for repetitive execution, not for single decision points to branch logic.
- B. Scripts perform actions or calculations, but conditions are for directing flow.
- D. Sub-playbooks encapsulate complex logic, but a condition is used to decide whether to call a specific sub-playbook or not.
Playbook Condition
A playbook condition is a task type that evaluates an expression (often based on context data) and directs the playbook's execution flow down different paths based on whether the expression evaluates to true or false.
- Enables branching logic in playbooks.
- Uses JQ or Demisto Query Language for expressions.
- Crucial for dynamic incident response workflows.
Memory trick: Conditions Craft Clear Choices.