Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?
Dashboards > Reports
Reports are generated from Dashboards > Reports, where the analyst selects a report template and defines the timeframe. This location produces the PDF containing aggregated metrics such as incident closure rates for the last month, matching the stem's reporting requirement.
Incidents > Export > Report
Threat Intel > Indicators > Export
Settings > Advanced > Reports
An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?
Settings > About > Server Configuration
Settings > Integrations > Instances
Settings > Customization > Layouts
Incident Info section layout is governed by the incident type's layout configuration. Settings > Customization > Layouts lets the administrator assign custom fields to the section, and applying it to the phishing incident type makes those fields appear for all phishing incidents.
Incidents > War Room > Layout Configuration
An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?
Bar
Number
Line
Pie
The Pie widget renders categorical incident data as proportional slices, directly grouping incidents by severity into a circular chart. Selecting Pie during widget creation satisfies the requirement to visualise severity distribution as a pie chart.
An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?
Use the standard CSV export from the Incident WorkArea
Take screenshots of every tab in the incident view manually
Query the Elasticsearch database directly using raw SQL queries
Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections
Generating a custom Incident Report satisfies the audit's requirement for War Room notes and playbook history, since the Reports feature can be configured to include those specific sections. Unlike raw API exports or manual copying, it consolidates incident details into a single auditable document suitable for external compliance review.
An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?
Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section
Layouts can be assigned to specific incident types, ensuring tailored fields and tabs appear for specific incident categories.
Configure an integration instance to push UI updates to the active browser session
Write a custom automation script that opens a browser popup window whenever Malware is detected
Modify the global server.properties file to inject widgets into all incident screens
An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?
Export all incidents to CSV and filter them locally in Microsoft Excel
Navigate to Settings > Integrations and configure a new filter rule for active incidents
Create a new custom dashboard widget every time a personal filter is needed
Use the WorkArea search bar with the query 'owner:me and status:Investigation'
The WorkArea search bar accepts Lucene-style field queries, so 'owner:me and status:Investigation' filters incidents on both the owner and status fields simultaneously. This satisfies the analyst's need to isolate their own incidents currently in Investigation status, returning the precise subset directly rather than requiring manual sorting or separate filters.
Want more Incident Interactions And Reporting practice?
Practice this domainAn analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?
Raw Data tab
Timeline or History tab
The Timeline or History tab records each reputation score change for the indicator, with timestamps and the source that triggered the update. This directly satisfies the analyst's requirement to view historical reputation changes over time, rather than only the current score or related incidents.
Workplan tab
Related Incidents tab
When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?
It causes the indicator score to be permanently locked to 0 regardless of other feeds.
It disables feed fetching for that specific indicator value.
It automatically deletes the indicator if any other feed reports it as malicious.
It assigns a higher weight to trusted sources, potentially overriding lower-trust malicious feeds.
Trust level adjusts the weight applied when aggregating source reputations into an indicator's score. Marking a feed Good raises its contribution, so a conflicting malicious feed with lower trust may be outweighed, leaving the indicator scored as benign rather than malicious.
An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?
Standard Syslog integration parser mapping
Threat Intel Management API endpoint receiver
Generic Feed integration using the GenericFeed module
The Generic Feed integration, built on the GenericFeed module, parses arbitrary JSON structures by mapping custom indicator fields, so non-standard threat feeds can be ingested without a bespoke integration. It satisfies the stem's custom-structure requirement directly.
Custom REST API automation script executed via timer triggers
An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?
Delete the incident associated with the indicator.
Export the indicator to a CSV file for manual review.
Disable the active playbook attached to the threat intel module.
Update the indicator reputation to Benign or False Positive.
Reputation is the global scoring attribute XSOAR uses when evaluating indicators, so setting it to Benign or False Positive stops the indicator from triggering detections across all integrations and playbooks, neutralising the false positive without deleting the indicator.
An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?
Verify that the fetch indicators setting is enabled on the integration instance configuration.
Enabling fetch indicators on the TAXII integration instance is the prerequisite for scheduled ingestion; without it, XSOAR never polls the collection, so no indicators reach the Threat Intel page regardless of server connectivity. This directly satisfies the stem's requirement to verify the ingestion pipeline first, before investigating parsing, reputation, or indicator-type mapping.
Restart the entire Cortex XSOAR server container service.
Disable all pre-built indicator types to avoid parsing conflicts.
Ensure the default incident classification scheme maps TAXII records to custom layouts.
A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?
Indicator matching is disabled globally or the incident type is not configured to correlate indicators.
Correlation depends on indicator matching being enabled and the incident type being configured to correlate indicators. If matching is disabled globally, or the incident type lacks that configuration, fetched indicators exist but never trigger correlation when matching observables appear in new incidents.
Indicators must be manually pushed to the incident war room using a CLI command.
The XSOAR server license has expired for threat intelligence modules.
The feed source uses STIX 1.x instead of STIX 2.1 format.
Want more Threat Intelligence Management practice?
Practice this domainAn organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?
Use cases that involve zero existing documentation or standard operating procedures.
High event volume and low operational complexity.
Prioritising high-volume, low-complexity use cases delivers rapid automation wins, reducing analyst workload early. This satisfies the best-practice constraint of demonstrating value quickly during a first XSOAR rollout, building stakeholder confidence before tackling intricate playbooks that demand more engineering effort.
Use cases requiring brand-new custom integrations with unsupported legacy APIs.
Extremely low event frequency and high procedural ambiguity.
An XSOAR engineer is designing a SOC workflow that ingests thousands of alerts per hour from a cloud security posture management tool. Many alerts represent duplicate or recurring findings for the same asset within a short window. How should the engineer design the ingestion and processing flow to prevent incident fatigue?
Increase the fetch limit per interval to batch all alerts into a single massive payload.
Configure incident matching and deduplication rules in the integration instance settings or pre-processing rules to aggregate alerts into existing open incidents.
Incident deduplication and matching rules compare incoming alerts against existing open incidents using defined fields, merging recurring findings for the same asset into the original incident rather than creating new ones. This directly prevents the incident fatigue described, where thousands of hourly alerts would otherwise flood analysts.
Write a post-processing cron job that deletes duplicate incidents after they are closed.
Disable fetch incidents and rely solely on email notifications sent to the SOC team.
During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?
A manual task configured with prompt options and assigned to the relevant analyst role.
A manual task halts playbook execution and presents prompt options to the assigned analyst role, requiring explicit approval before the isolation command proceeds. This enforces the human-in-the-loop gate the workflow demands, unlike automated or conditional tasks that continue without intervention.
An integration instance fetch-incidents polling interval adjustment.
A pre-processing rule that drops incoming JSON payloads lacking approval metadata.
A transformer function applied to incident field mapping.
An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?
Use a scheduled job instead of a playbook to poll all three platforms periodically.
Place the three integration tasks sequentially in a straight vertical line.
Combine all three TIP calls into a single monolithic Python script inside one automation task.
Configure the playbook tasks with parallel branching paths coming out of a single parent task.
Parallel branching from a single parent task dispatches all three threat intelligence enrichment tasks concurrently rather than sequentially. This removes cumulative wait time, since each TIP query runs independently, cutting total playbook execution time to the duration of the slowest enrichment instead of the sum.
When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?
Disabling an Active Directory user account associated with confirmed malicious activity outside business hours.
Disabling a confirmed-malicious Active Directory account outside business hours suits full automation because the action is deterministic, reversible and time-critical, and no analyst is available to approve it. The confirmed-malicious constraint removes ambiguity, so the playbook can act immediately without human judgement.
Terminating employment status of a suspected insider threat.
Deleting primary database backups on suspicion of data exfiltration.
Revoking executive internet access during an ongoing ransomware outbreak.
An automation engineer is designing a complex incident investigation workflow where sub-playbooks are invoked dynamically based on asset criticality extracted during enrichment. Which XSOAR playbook feature allows calling another playbook conditionally based on incident context?
Custom DBot score thresholds configured in system settings.
Incident layout tab visibility rules.
A conditional task evaluating context paths to execute specific sub-playbooks.
A conditional task evaluates context paths populated during enrichment, then routes execution to the appropriate sub-playbook based on asset criticality. This satisfies the dynamic invocation requirement, since the branch decision depends on incident context rather than a fixed sequence. Nested sub-playbooks alone cannot select themselves conditionally.
Global server environment variables evaluated at startup.
Want more Use Case Planning And Development practice?
Practice this domainWhere do you go in the Cortex XSOAR UI to create and modify playbooks visually?
Dashboards -> Widgets -> Playbook Designer
Automation -> Playbooks
The Automation section's Playbooks page is where Cortex XSOAR engineers create, edit, and manage playbooks through the visual drag-and-drop editor, including tasks, conditions, and sub-playbooks. Other areas such as Incidents or Settings do not host the playbook builder.
Settings -> Integrations -> Playbooks
Incidents -> Analysis -> Playbooks
When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?
Data Collection Task
Sub-playbook Task
Manual Task
A Manual Task pauses the playbook and presents instructions, form fields and a decision prompt to the assigned analyst, so the human review step is explicit and auditable. Automated tasks would execute without waiting, breaking the required manual phishing assessment.
Automation Task
You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?
Hardcode the expected string value directly into the task argument field
Store the value in a server-wide environment variable and call os.environ
Reference the context path using the ${Email.Body} syntax in the argument field
Cortex XSOAR resolves ${Email.Body} at runtime by reading the value from the incident context, substituting it into the argument field when the task executes. This passes the dynamic email body content into the integration command without hard-coding values.
Write a custom integration instance configuration for that specific email
You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?
A Conditional Task
A Conditional Task evaluates the severity value returned in context and routes execution down the matching branch, letting the playbook invoke different sub-playbooks per severity level. It is the built-in component designed for exactly this branching logic.
A Data Collection Task
A Loop Task with an exit filter
A standard task with a Post-processing script
When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?
In the task's 'Assign to Incident Field' configuration setting
The 'Assign to Incident Field' setting binds the task's collected response directly to a chosen incident field, so the user's answer persists on the incident record rather than only in task context. This satisfies the requirement to map the response to a specific incident field.
In the 'Details' tab using custom markdown syntax
In the task's 'Inputs' tab under context mapping
In the 'Script arguments' section under the 'Key' parameter
You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?
It throws a validation error unless wrapped in a string transformer.
It passes only the first item in the list and discards the rest.
It converts the list into a JSON object and stores it in a temporary file.
It passes the list as a comma-separated string or array to the script argument based on argument definitions.
XSOAR evaluates the ${IP.Address} context path and, when it resolves to multiple values, passes them to the script argument as either a comma-separated string or an array, depending on how that argument is defined in the automation's argument definitions.
Want more Playbook Development practice?
Practice this domainYou are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?
Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.
Configure the server to tunnel through an unauthenticated proxy.
Run 'demisto-sdk download-dependencies' from the CLI.
Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.
The offline installation bundle ships pre-packaged Python dependencies and local wheels, letting pip resolve and install integrations without reaching PyPI. This satisfies the air-gapped RHEL constraint, since no internet access is available for dependency downloads.
You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?
TCP 443
TCP 443 carries the HTTPS traffic the engine requires to reach the Cortex XSOAR server, satisfying the strict-firewall constraint in the stem. Because the engine initiates all communication outbound over TLS on this single port, no additional inbound rules are needed, and firewall policy can remain restrictive.
TCP 8443
TCP 22
TCP 6222
Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?
systemctl restart demisto
On RHEL, Cortex XSOAR runs as the demisto systemd unit, so systemctl restart demisto stops and starts the server service cleanly. Alternatives such as service commands or direct binary invocation bypass systemd's dependency and restart handling, and the unit name is demisto, not xsoar.
demisto-ctl restart
systemctl restart cortex-xsoar
service xsoar-server restart
An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?
MySQL
PostgreSQL
Cortex XSOAR server clustering natively requires PostgreSQL, which stores the shared configuration and tenant data that cluster nodes must access consistently. This satisfies the high-availability constraint, since the database tier must be reachable by every node rather than tied to one server.
Microsoft SQL Server
MongoDB
What is the primary purpose of deploying a Cortex XSOAR Engine?
To act as a primary database replica for high availability
To handle user authentication and single sign-on (SSO) requests
To execute integrations and playbooks in isolated network segments and reduce server load
An Engine runs integrations and playbook tasks inside remote network segments, so it reaches isolated or restricted assets without exposing the main server. It also distributes execution load away from the central server, satisfying both the segmentation and load-reduction constraints in the scenario.
To store long-term incident archives for compliance reporting
During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?
Delete the content pack folder from the file system and restart the server.
Run 'demisto-sdk downgrade' from the CLI.
Restore the entire server from the last nightly database backup.
Use the Marketplace interface to select the specific content pack and downgrade to the previous stable version.
The Marketplace retains prior pack versions, so selecting the pack and downgrading restores the previous schema immediately without rebuilding scripts or playbooks. This directly satisfies the stem's fastest-revert constraint, since the breaking schema change is undone at source rather than patched downstream.
Want more Planning Installation And Maintenance practice?
Practice this domainThe vendor does not publish an exact question count for the XSOAR-Engineer. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Incident Interactions And Reporting, Threat Intelligence Management, Use Case Planning And Development, Playbook Development, Planning Installation And Maintenance. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks XSOAR-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.