XSOAR-Engineer Practice Test 10 — 10 Questions

Question 1

When planning the deployment of XSOAR integrations, which TWO configuration steps are typically required to connect an integration instance to an external product (e.g., a firewall or SIEM)? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Providing valid authentication credentials such as API keys, tokens, or username/password.. Configuring authentication credentials (API keys/tokens) and setting the target server URL/endpoint are required to establish an integration connection.

Answer

Modifying the client-side web browser theme color.

Answer

Rewriting the external vendor's proprietary firmware source code.

Answer

Installing physical fiber-optic cables into the XSOAR appliance chassis.

Question 2

An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?

Accepted Answer

Sanitize or mask sensitive data within the automation script before writing outputs to the XSOAR context.. The recommended strategy is to sanitize or mask sensitive data within the automation script before writing outputs to the XSOAR context. This ensures that PII is not stored in context or incident fields, complying with data protection requirements. Masking can be done using built-in XSOAR transformations or custom Python scripts that redact or hash sensitive values before they are persisted.

Answer

Store the PII in plain text inside incident custom fields and restrict access using incident layout roles.

Answer

Rely on the browser's local cache to encrypt the sensitive fields on the analyst's workstation.

Answer

Disable the XSOAR server audit log entirely.

Question 3

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Accepted Answer

In the task's Conditions tab using pre-conditions or filtering rules. Task-level conditional filtering (such as checking previous task results or verdicts) is configured in the Conditions tab of the task properties.

Answer

In the Incident Fields configuration menu

Answer

In the playbook Details tab under Script arguments

Answer

By writing a separate Condition task before every single integration task

Question 4

An XSOAR architect is designing custom incident layouts for a new ransomware response use case. The SOC team needs to see critical file hashes, affected machine names, and containment status immediately upon opening an incident. Where should the architect configure these visual elements?

Accepted Answer

In Incident Layouts and custom fields configuration.. Incident Layouts in XSOAR (configured under Settings > Object Fields > Layouts) define the tabs, fields, and visual widgets presented to analysts in the incident war room.

Answer

As part of the database backup retention schedule.

Answer

Inside the server's crontab configuration file.

Answer

Within the integration instance YAML manifest file.

Question 5

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

Accepted Answer

UDP, TCP, and TLS (Encrypted TCP). Cortex XSOAR Syslog integration supports UDP, TCP, and TLS-secured TCP connections for log forwarding.

Answer

UDP only

Answer

UDP and TCP (Plaintext only)

Answer

HTTPS REST API only

Question 6

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

Accepted Answer

Native Syslog forwarding (TCP/UDP) configured in Server Configuration. Cortex XSOAR supports forwarding audit logs via Syslog (TCP/UDP) natively through server configuration settings.

Answer

SNMP v3 Traps

Answer

NetFlow v9 streaming

Answer

WMI event subscription

Question 7

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

Accepted Answer

Check server log files (e.g., demisto.log) for Python tracebacks and error messages.. Troubleshooting script arguments involves inspecting task inputs in the playbook UI, checking the War Room for exact command execution syntax, and reviewing server log files for Python tracebacks.

Answer

Reinstall the underlying operating system and format all storage volumes.

Answer

Replace the server's network interface card to fix context serialization errors.

Question 8

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Accepted Answer

Fetch interval frequency. Option B (Fetch interval frequency) is correct because a generic REST API feed integration must define how often Cortex XSOAR polls the external source for new indicators, typically configured as a fetch interval parameter (e.g., in minutes) that drives the scheduled fetch command. Option C (Feed URL or API endpoint) is correct because the integration needs the base URL or specific REST endpoint to send HTTP/HTTPS requests to and retrieve the indicator data. Option D (Indicator type mapping) is correct because the raw JSON/XML response must be mapped to Cortex XSOAR indicator types (such as IP, Domain, URL, File hash) so the fetched data is stored correctly in the indicators database. Option A (Active directory domain controller IP address) is not required, since a REST API feed integration does not authenticate against AD domain controllers; it uses API keys, tokens, or basic auth configured separately. Option E (Syslog server forwarding port) is not required, as syslog forwarding is a logging/output configuration unrelated to fetching indicators from a REST API feed.

Answer

Active directory domain controller IP address

Answer

Syslog server forwarding port

Question 9

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

Accepted Answer

Reviewing system audit logs and health check dashboards for anomalies. Option A is correct because routine Cortex XSOAR maintenance includes monitoring system audit logs and health check dashboards (e.g., the System Health and Audit Logs views) to detect anomalies such as failed playbook runs, integration errors, or resource exhaustion before they impact incident response. Option E is correct because keeping content packs and integrations current via the Cortex XSOAR Marketplace is a standard maintenance task that delivers bug fixes, new commands, and updated detection logic, and is typically managed through the Marketplace or the Content Management interface. Option B is not a maintenance task because the Python interpreter ships with the platform and is upgraded through official Cortex XSOAR releases, not by manually recompiling binaries. Option C is not performed because disk formatting is destructive and only done during initial deployment or disaster recovery, not weekly. Option D is not routine because SSL certificates are replaced on a scheduled expiration cycle (typically annually or per organizational policy), not daily.

Answer

Manually recompiling the Python interpreter binary

Answer

Formatting the server storage disks weekly

Answer

Replacing the SSL certificate daily

Question 10

When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)

Accepted Answer

Implement error handling and alternative paths (such as timeout or failure branches) for critical integration tasks.. Option A is correct because implementing error handling and alternative paths (timeout or failure branches) for critical integration tasks makes playbooks resilient and easier to maintain, since failures are handled explicitly rather than causing silent or cascading errors. Option C is correct because utilizing sub-playbooks to modularize complex or repeated workflow logic reduces duplication, isolates changes to one place, and improves readability of the parent playbook. Option E is correct because giving playbook tasks clear, descriptive names instead of leaving default integration command names makes the workflow self-documenting and far easier for other analysts and architects to understand and maintain. Option B is not appropriate because hardcoding API authentication tokens into task descriptions exposes credentials and creates a maintenance burden whenever tokens rotate; credentials should be stored in XSOAR credentials or integration instances. Option D is not appropriate because combining all enrichment, containment, and reporting steps into a single massive, unbranched task destroys modularity, makes troubleshooting and reuse difficult, and violates the maintainability and readability goals of the scenario.

Answer

Hardcode all API authentication tokens directly into every playbook task description.

Answer

Combine all enrichment, containment, and reporting steps into a single massive, unbranched task.