XSOAR-Engineer Practice Test 1 — 10 Questions

Question 1

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.. The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder. Minimizing downtime is achieved by the sequential approach.

Answer

Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.

Answer

Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.

Answer

Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.

Question 2

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Accepted Answer

In indicator extraction settings or playbook conditional filters that check for private IP ranges (RFC 1918) before querying external APIs.. Indicator filters or classifier rules can be configured to ignore private, reserved, or internal IP ranges before sending queries to external commercial threat intel feeds.

Answer

By increasing the timeout value of the HTTP client.

Answer

By disabling all threat intelligence integrations entirely.

Answer

Within the user permission role definitions.

Question 3

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Accepted Answer

Open the indicator's details page and review the 'Sources' field, which lists all feeds and manual entries that reported the indicator.. The Sources field on an indicator's details page is the authoritative place to see all feeds and manual entries that have reported the indicator. It aggregates every source that contributed to the indicator's presence and reputation, enabling analysts to assess which threat intelligence sources consider the IP malicious. This is the most direct and accurate method.

Answer

Run the '!ip' command in the CLI to query the indicator and view its reputation score.

Answer

Navigate to the Threat Intel page and apply a filter by the indicator's value to see all related incidents.

Answer

Check the incident's War Room entries for any feed integration logs that mention the indicator.

Question 4

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?

Accepted Answer

In the integration instance configuration settings under mapper parameters.. Integration instance configuration settings provide the mapping interface between XSOAR incident fields and external ticketing system fields.

Answer

As part of the role-based access control (RBAC) permissions matrix.

Answer

Inside the Demisto system log file (/var/log/demisto/server.log).

Answer

Within the server health-check dashboard.

Question 5

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. In Cortex XSOAR, the widget creation wizard exposes a 'Widget Type' selector that includes Bar, Line, Pie, Number, Text, and others. A pie chart visualization is produced by selecting the Pie widget type, which renders incident counts grouped by a chosen field such as severity. This is the direct mapping between the desired visualization and the widget type option.

Answer

Bar

Answer

Number

Answer

Line

Question 6

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. The playbook design interface in Cortex XSOAR provides a task properties drawer where engineers can add Notes and Task Descriptions to document business logic, conditional branches, and expected outcomes. These fields are stored with the task definition and are visible to anyone editing or reviewing the playbook, making them the correct place for inline documentation. This keeps documentation versioned alongside the playbook itself rather than in external channels.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 7

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 8

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Accepted Answer

Incident closure layout with a required 'Close Notes' field for the relevant classification.. Closure layouts control the fields presented when closing an incident and can mark specific fields as required. Configuring the closure layout so Close Notes is mandatory for the False Positive classification ensures the rationale is captured before closure completes.

Answer

Incident field of type 'Long Text' with a validation regex that rejects empty values.

Answer

Playbook task that sends an email to the manager whenever an incident is closed.

Answer

Dashboard widget that counts incidents closed without notes and alerts the SOC manager.

Question 9

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Option A is correct because a clear, descriptive name that reflects the playbook's workflow purpose is essential for discoverability and for users to understand at a glance what the playbook does when browsing the organization-wide library. Option C is correct because documentation or a description explaining input requirements and expected outcomes ensures other analysts can correctly supply required inputs and understand what the playbook will produce, which is critical for reusable, organization-wide content. Option E is correct because associating the playbook with the appropriate Incident Types enables it to trigger automatically when relevant cases are created, which is the standard mechanism for mapping playbooks to case categories in platforms like Cortex XSOAR. Option B is not required because playbooks are defined as declarative workflows (YAML/JSON), not compiled binaries, and Windows execution is handled by integrations or scripts rather than an attached binary. Option D is incorrect and actively discouraged because hardcoding plain-text passwords violates security best practices; credentials should be stored in a secrets manager or credential store and referenced securely.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 10

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. In Cortex XSOAR, dashboards are shared via the built-in sharing mechanism. Clicking the share icon on a dashboard opens a dialog where you can assign view or edit permissions to specific roles, users, or everyone. Selecting the 'Tier2-SOC' role restricts visibility to only members of that role. This is the standard, supported method for role-based dashboard sharing.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings