XSOAR-Engineer Practice Test — Free Certified XSOAR Engineer (XSOAR-Engineer) Questions with Explanations

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?