Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksEasy
A security analyst is designing a playbook that needs to execute a specific set of tasks only if a critical alert is identified AND the incident priority is high. Which playbook component should be used to implement this logic?
- AA Loop task iterating through alert types
- BA Script task with conditional logic
- CA Condition task with multiple expressions
- DA manual task requiring analyst approval
Show answer & explanationAnswer & explanation
Correct answer: C. A Condition task with multiple expressions
A Condition task is specifically designed to evaluate one or more expressions and direct playbook flow based on the outcome. This allows for clear and explicit branching based on defined criteria.
Why the other options are wrong
- A. A Loop task is used for iterating over lists, not for evaluating static conditional logic for branching.
- B. While a script could implement this, a Condition task is the more idiomatic and readable solution for simple conditional branching.
- D. A manual task pauses the playbook for human intervention, which is not suitable for automated conditional logic.
Playbook Condition Task
A Playbook Condition task evaluates one or more expressions to determine the subsequent path of a playbook's execution.
- Used for branching logic based on data.
- Can combine multiple expressions with AND/OR.
- Directs flow to 'Yes' or 'No' paths.
Memory trick: Conditions branch the flow, making decisions grow.