Paloalto Networks XSOAR-Engineer Questions Answers

The SSO (SAML) configuration is performed inside each Cortex XSOAR tenant, under the Authentication settings.

Group mapping (SAML group → XSOAR role/group) is managed at the tenant level, not in the Hub, Gateway, or Support Portal.

The XSOAR Playbook Editor allows engineers to manipulate and transform context data dynamically. According to the XSOAR Admin and Playbook Development Guides,“Extend Context”is the dedicated mechanism that enables a task to save output values into new or existing context keys, including keys that correspond to incident fields. By defining a key under the “Extend Context” section, the playbook task can map specific outputs—such as JSON fields, strings, arrays, or nested objects—to a structured location within the incident context. These keys can then be used to populate incident fields through further playbook tasks, field mappings, or automated incident field updates.

Classification (option A) applies only during ingestion and cannot assign task outputs to incident fields. Inputs (option B) define what data a task receives, not how it is stored afterward. Mapping (option D) belongs to the ingestion pipeline and determines how event fields become incident fields during creation, not during playbook execution.

Therefore,Extend Contextis the correct feature that allows a task to associate its output with incident fields, making optionCthe correct answer based on documentation.