Exam XSIAM-Engineer Topic 1 Question 50 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 50
Topic #: 1

A complex XSOAR playbook integrating with multiple external security tools (EDR, Firewall, IAM) is failing intermittently with a generic 'NoneType' object has no attribute 'get" error in a Python script task. The script processes data returned from a previous EDR query command. You've confirmed the EDR query command sometimes returns valid data and sometimes returns 'null' or an empty list. The script snippet causing the error is as follows:

Which of the following approaches will most effectively debug and resolve this issue while making the playbook more robust?

A. Before Line X, add a check 'if demisto.incidents() and len(demisto.incidents()) > 0:' to ensure an incident object exists, and handle the case where it doesn't. B. Modify Line Y to 'host_name = alert_details and alert_details.get('host_info', to use short-circuiting for NoneType checks. C. Implement an explicit 'try-except AttributeError' block around Line Y to catch the 'NoneType' error and log the state of 'alert_details'. D. Analyze the EDR query command's output for cases where it returns 'null' or an empty list, and modify the playbook logic to proactively handle these specific outputs before passing them to the script. E. Ensure that the 'details' field in the incident context is always populated by an earlier playbook task, potentially using a 'Set' command with a default empty dictionary.

Suggested Answer: D Vote an answer

The error 'NoneType' object has no attribute 'get" at Line Y implies 'alert_details' is 'None'. The current 'if alert_details:' check should handle this if becomes *None' at that point. The problem is likely that 'details')' (Line X) itself is returning 'None' due to the EDR query's intermittent 'null' or empty list output. Option D directly addresses the root cause: the inconsistent output from the EDR query. By proactively handling these 'no data' scenarios before the script, the playbook becomes robust. Options A and B address potential 'NoneType' issues but don't solve the underlying data inconsistency. Option C is a reactive error handling, not a proactive solution. Option E attempts to force a default, but the EDR output itself needs robust handling.

by Ulysses at Aug 25, 2026, 10:16 AM

Limited Time Offer

15%

Off

Get Premium XSIAM-Engineer Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business