Exam SecOps-Pro Topic 1 Question 62 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 62
Topic #: 1

A SOC needs to implement a 'kill chain stage' update mechanism for incidents. Whenever an incident's severity changes to 'Critical', a custom 'Kill Chain Stage' field should be updated from 'Reconnaissance' to 'Exploitation', and an internal Slack channel notified. This update needs to be instantaneous and integrated directly into the incident's lifecycle. Which XSOAR component(s) should be used, and how would they be triggered?

A. A Job, configured to run every 5 minutes, which iterates through all 'Critical' incidents and updates the field and sends the Slack notification. B. A Python Script, configured as an Automation Rule, triggered 'on incident update' when 'Severity' changes to 'Critical'. The script would update the field and send the Slack message. C. An Automation Rule triggered 'on incident update' where 'Severity' changes to 'Critical', which then executes a Playbook. This Playbook contains tasks to update the custom field and send the Slack message. D. A JavaScript Script embedded directly into the incident layout, which automatically runs when the 'Severity' field is modified to 'Critical'. E. A custom Webhook integration that listens for incident updates and triggers an external lambda function for the field update and notification.

Suggested Answer: C Vote an answer

For instantaneous, event-driven automation directly tied to incident lifecycle changes, an Automation Rule triggering a Playbook is the most robust and maintainable solution. Automation Rules are designed to react to specific incident events (like a field change). Playbooks provide a visual, structured way to define the logic (update field, send notification) and leverage existing integrations (Slack). Option A is not instantaneous. Option B is viable but a Playbook offers better visual representation, modularity, and error handling for multi-step processes. Option D is not how XSOAR's UI scripting works for backend logic. Option E is externalizing core XSOAR automation, which is unnecessary here.

by Taylor at Apr 01, 2026, 01:17 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business