XSOAR-Engineer Practice Test 12 — 15 Questions

Question 1

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

Accepted Answer

Loop Task. A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Answer

Data Collection Task

Answer

Parallel Task Group

Answer

Conditional Task

Question 2

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Accepted Answer

Review the integration instance execution logs for raw response errors.. Option A is correct because the integration instance execution logs capture the raw HTTP response and error details returned by the feed, which is the fastest way to see whether the failure is an authentication, timeout, or malformed-payload issue during parsing. Option E is correct because running the feed query in a standalone test script or inspecting the raw JSON payload lets the administrator validate the response structure against the integration's expected schema and parser logic, isolating whether the problem is in the data or the parsing code. Options B, C, and D are not appropriate: hypervisor upgrades, reinstalling the Cortex XSOAR Linux OS, and changing the network gateway address are infrastructure-level actions unrelated to a feed parsing failure, and they would not diagnose or resolve a malformed or unexpected data payload.

Answer

Upgrade the hypervisor running the virtual machine.

Answer

Reinstall the entire Cortex XSOAR Linux operating system.

Answer

Change the server's primary network gateway IP address.

Question 3

An XSOAR architect is designing an automated incident response workflow that requires human approval before executing destructive remediation actions. Which THREE design patterns or features should be incorporated to handle human interaction securely and effectively? (Choose THREE)

Accepted Answer

Manual playbook tasks configured with specific prompt options (e.g., Approve / Deny).. Manual tasks with prompt options, role-based task assignments, and ChatOps (Slack/Teams) interactive buttons are standard patterns for human approval workflows.

Answer

Terminates the entire XSOAR server instance immediately upon hitting a manual task.

Answer

Relying on anonymous public web forms accessible without authentication.

Question 4

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. The XSOAR Incident WorkArea includes a search bar that accepts Lucene-style queries against incident fields. The query 'owner:me and status:Investigation' filters incidents where the current user is the owner and the status is Investigation, returning exactly the desired set without leaving the WorkArea.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 5

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

Accepted Answer

Use the search bar in the Incidents page with a query filtering by owner and status.. The Incident List view provides a query search bar where analysts can enter query syntax like `owner:current_user and status:"In Progress"` to filter incidents.

Answer

Create a completely new custom Report and export it to Excel.

Answer

Modify the default Playbook definitions to restrict visibility.

Answer

Build a new Dashboard widget and restart the XSOAR service.

Question 6

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

Accepted Answer

JSON. Playbooks and other content items in XSOAR are exported and packaged in JSON format.

Answer

XML

Answer

CSV

Answer

YAML

Question 7

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Accepted Answer

Severity. Severity (B) is a standard incident attribute used to filter and categorize incidents in dashboard widget queries, since incidents are classified by urgency levels such as critical, high, medium, and low. Owner (C) is also a valid incident attribute, allowing queries to group or filter incidents by the assigned user or team responsible for resolution. Status (D) is likewise a core incident field, enabling filtering by lifecycle states such as open, acknowledged, or resolved. Ethernet MAC address (A) is a network-layer hardware identifier, not an incident metadata attribute, so it cannot be used to query incidents. CPU cache size (E) is a hardware performance specification, unrelated to incident categorization or filtering.

Answer

Ethernet MAC address

Answer

CPU cache size

Question 8

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Accepted Answer

PostgreSQL. Cortex XSOAR utilizes an external PostgreSQL database for server clustering and state management to ensure high availability across multiple engine and server instances.

Answer

MySQL

Answer

Microsoft SQL Server

Answer

MongoDB

Question 9

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

Accepted Answer

Archiving the report inside the built-in XSOAR Report repository for download.. Option A is correct because the Cortex XSOAR reporting engine natively stores generated scheduled reports in the built-in Report repository, where they can be archived and downloaded later. Option B is correct because scheduled reports can be delivered by email to specified internal or external recipients using the configured mail integration. Option D is correct because the reporting engine can save report output directly to a designated incident's War Room, making it available as an attachment or entry in that incident. Option C is not supported natively, as XSOAR does not include CUPS-based physical printing as a report distribution method. Option E is also not supported natively, since real-time SMS broadcast to an administrator mobile gateway is not a built-in scheduled report delivery option.

Answer

Automatic physical printing via networked CUPS printer drivers.

Answer

Real-time SMS broadcast to an administrator mobile gateway.

Question 10

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Accepted Answer

Modify the report section layout dimensions, orientation (Portrait/Landscape), and page break configurations.. Report layouts are structured using customized JSON or built-in orientation and section sizing properties to control PDF rendering margins and element arrangement.

Answer

Increase the server-wide 'report.render.timeout' configuration variable.

Answer

Export the report as a CSV format instead of PDF to bypass layout constraints.

Answer

Update the browser zoom settings of the user who created the scheduled report.

Question 11

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Accepted Answer

systemctl restart demisto. Cortex XSOAR runs as a systemd service named 'demisto' on RHEL systems.

Answer

demisto-ctl restart

Answer

systemctl restart cortex-xsoar

Answer

service xsoar-server restart

Question 12

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Accepted Answer

Account-based segregation with role-based access control (RBAC) on the central server. In Cortex XSOAR multi-tenancy, accounts and roles manage data segregation between tenants on a single central server.

Answer

Individual PostgreSQL database instances per tenant schema

Answer

Dedicated Docker containers per tenant

Answer

Physical server separation linked via API gateways

Question 13

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Accepted Answer

Conditional Task. In the Cortex XSOAR playbook visual designer, a Conditional Task (B) is a valid task type that evaluates a set of conditions against the playbook context and routes execution down different branches based on whether the conditions evaluate to true or false. An Automation Task (E) is also valid: it runs a selected automation script (or command) and stores its output in the playbook context for later tasks to consume. These two are standard built-in task types in the XSOAR playbook editor. By contrast, Firewall Task (A), Database Task (C), and Router Task (D) are not task types offered by the XSOAR visual designer; firewall and database operations would be performed through integrations/commands inside an Automation or standard task, and 'Router Task' is not an XSOAR construct (branching is handled by Conditional Tasks).

Answer

Firewall Task

Answer

Database Task

Answer

Router Task

Question 14

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Accepted Answer

How role-based access control (RBAC) restricts users to their specific tenant accounts.. Option B is correct because in a multi-tenant Cortex XSOAR deployment, RBAC is the mechanism that scopes users to their own tenant account, ensuring that analysts in one child tenant cannot view or act on incidents, playbooks, or data belonging to another tenant. Option D is correct because content packs are managed and distributed from the root (parent) tenant down to child tenants, so the administrator must plan how packs are pushed and which tenants receive them. Option E is correct because a key design decision is whether integrations (and their instances) are configured once at the root level and shared, or configured individually within each tenant account, which affects credential isolation and management overhead. Option A is not correct because tenants are logical partitions within the XSOAR application, not separate containers each requiring their own Linux kernel. Option C is not correct because multi-tenancy is a logical separation feature and does not require a dedicated physical server per child tenant.

Answer

Configuring independent Linux kernels for each tenant container.

Answer

Allocating a separate physical server for each child tenant.

Question 15

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Accepted Answer

Auto-extract indicator settings. In a SOAR/incident-management platform, a custom incident type can carry its own auto-extract indicator settings (B), which define the regexes and fields used to automatically pull indicators such as IPs, hashes, and domains out of incident data as it is ingested. It can also define a Layout (D), which controls which fields, tabs, and sections are displayed when viewing incidents of that type. And it can specify a Default Playbook (E), the playbook automatically attached or suggested for incidents of that type. Motherboard BIOS serial number (A) is hardware inventory data, not an incident-type configuration, and RAID array stripe size (C) is a storage-controller setting, so neither belongs here.

Answer

Motherboard BIOS serial number

Answer

RAID array stripe size