XSOAR-Engineer Practice Test 13 — 15 Questions

Question 1

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Accepted Answer

In the Dashboard configuration settings by selecting the appropriate Roles under Sharing settings.. Dashboard permissions are managed directly within the Dashboard configuration dialog by assigning specific user roles (such as Tier-2 SOC) to control read or write visibility.

Answer

In the User Profile settings for each individual Tier-2 SOC analyst.

Answer

In the Incident Type layout editor under the Permissions tab.

Answer

In the Server Configuration (Settings > About > Configuration) by updating the 'dashboard.roles.allowed' key.

Question 2

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Accepted Answer

The custom fields were created but not added to the layout assigned to that incident type. Fields must be added to the active layout for the specific incident type to be visible in the Incident Info panel.

Answer

The user browser cache must be cleared via Settings > Server Configuration

Answer

Custom fields are restricted to administrator accounts only by default

Answer

Custom fields require a server restart before appearing in database schemas

Question 3

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

Accepted Answer

HTTP/HTTPS proxy server settings for outbound integration traffic. Option A is correct because the Cortex XSOAR server configuration file (and the Server Configuration UI) exposes proxy settings, allowing outbound integration and content traffic to be routed through an HTTP/HTTPS proxy. Option C is correct because session timeout duration for inactivity is a tunable server setting that controls how long an idle user session remains valid before re-authentication is required. Option D is correct because logging verbosity levels can be adjusted per module to increase or decrease log detail for troubleshooting purposes. Option B is not correct because physical RAM allocation is a hardware/hypervisor-level resource, not a setting in the XSOAR server configuration file or UI. Option E is not correct because CPU clock speed is determined by the underlying hypervisor or hardware and cannot be customized through the XSOAR server configuration.

Answer

The physical RAM allocation size of the host server motherboard

Answer

The CPU clock speed of the underlying hypervisor

Question 4

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Accepted Answer

Indicator matching is disabled globally or the incident type is not configured to correlate indicators.. Indicator matching against incidents requires indicator auto-extract or matching configurations to be active in incident types or server settings.

Answer

Indicators must be manually pushed to the incident war room using a CLI command.

Answer

The XSOAR server license has expired for threat intelligence modules.

Answer

The feed source uses STIX 1.x instead of STIX 2.1 format.

Question 5

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Accepted Answer

Execution schedule / frequency. Option C (Execution schedule / frequency) is correct because a scheduled report in Cortex XSOAR requires a defined recurrence—such as daily, weekly, or a cron-style interval—so the system knows when to generate and dispatch the report. Option E (Report definition/template) is correct because the schedule must reference the actual report content, i.e., the saved report template or definition that specifies which widgets, dashboards, and data are included. The remaining options do not belong: A (Elasticsearch cluster shard allocation count) is an Elasticsearch infrastructure tuning setting unrelated to XSOAR report scheduling, B (Raw SSH credentials of the target email relay) is not how XSOAR integrates with mail servers (it uses configured mail/SMTP integration instances, not raw SSH credentials), and D (Active Directory bind password for report viewers) is an authentication detail for directory lookups and is not a required parameter for defining a scheduled report.

Answer

Elasticsearch cluster shard allocation count

Answer

Raw SSH credentials of the target email relay

Answer

Active Directory bind password for report viewers

Question 6

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Accepted Answer

Incident Type playbook association settings. Option A is correct because a playbook only auto-triggers when it is explicitly associated with the incident type of the created incident, so a missing or misconfigured Incident Type playbook association would prevent execution. Option D is correct because incoming mapper rules determine how an incoming event is classified into an incident type; if the mapper assigns the wrong type, the playbook tied to the intended type will never fire. Option E is correct because a global server-level playbook automation toggle can disable automatic playbook execution across the system, blocking triggering even when associations and mappings are correct. Options B and C are incorrect because hypervisor BIOS versions and client browser cookie expiration have no bearing on server-side incident-to-playbook triggering logic.

Answer

The BIOS version of the underlying hypervisor host

Answer

Browser cookie expiration settings in client workstations

Question 7

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Accepted Answer

API Keys generated within user profile settings. Option B is correct because Cortex XSOAR allows users to generate API Keys from their user profile settings, and these keys are then used by external API clients (SIEMs, scripts) to authenticate to the REST API without interactive login. Option D is correct because the XSOAR REST API also supports authenticating with a username and password, which the client exchanges for a session token/cookie used on subsequent API calls. Option A is not supported: XSOAR does not natively implement the OAuth 2.0 client credentials grant for API client authentication without user context. Option C is incorrect because Kerberos TGT-based authentication is not a supported mechanism for the XSOAR REST API. Option E is incorrect because SSH public/private key pairs are used for secure shell access, not for authenticating to the XSOAR REST API.

Answer

OAuth 2.0 client credentials grant type natively configured without user context

Answer

Kerberos ticket-granting service tickets

Answer

Public key SSH key pairs

Question 8

An XSOAR automation engineer is planning incident classification and routing for incoming multi-source alerts. Which THREE elements must be considered when designing the mapping between incoming raw event fields and XSOAR incident fields? (Choose THREE)

Accepted Answer

Mapping raw alert JSON keys to corresponding XSOAR incident custom fields.. Option A is correct because the core of field mapping in XSOAR is translating raw alert JSON keys (e.g., from a SIEM, EDR, or email source) into the corresponding XSOAR incident custom fields so the data is usable in layouts, playbooks, and searches. Option B is correct because raw values rarely match XSOAR field formats, so field transformers such as timestamp conversion (e.g., epoch to ISO 8601) or string parsing (e.g., splitting a username from a domain) must be applied during mapping to normalize data. Option D is correct because incident type mapping rules use alert attributes to classify the incident and route it to the appropriate playbook, which is essential for automated classification and routing. Option C is incorrect because the BIOS serial number of the XSOAR host server is unrelated to incident field mapping. Option E is incorrect because manually retyping logs into a typewriter is not a technical mapping element and contradicts automation.

Answer

Changing the BIOS serial number of the XSOAR host server.

Answer

Manually retyping every incoming log into a physical typewriter.

Question 9

When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)

Accepted Answer

The steps are well-defined, repeatable, and follow a standard operating procedure.. Option D is correct because XSOAR playbooks and automation tasks depend on deterministic, documented workflows: well-defined, repeatable steps that follow a standard operating procedure can be translated into tasks, conditional branches, and scripts, whereas ambiguous or ad hoc processes cannot be reliably automated. Option E is correct because high execution frequency maximizes the return on automation investment, as XSOAR can execute the playbook consistently at scale, reducing analyst workload and MTTR for frequently recurring incidents. Options A, B, and C are not appropriate: a task performed once every five years (A) offers negligible ROI and would likely become stale before reuse; processes requiring constant creative intuition and subjective executive judgment (B) are not deterministic and should remain human-driven; and systems with completely undocumented, unsupported proprietary APIs (C) lack the integration surface XSOAR needs to reliably execute automated actions.

Answer

The task is performed exactly once every five years.

Answer

The process requires constant creative intuition and subjective executive judgment.

Answer

The underlying systems have completely undocumented and unsupported proprietary APIs.

Question 10

When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)

Accepted Answer

Incident Fields and Layouts that structure and display data attributes in the UI.. Option A is correct because Incident Fields define the individual data attributes captured on an incident (such as severity, source IP, or detection time), and Layouts determine how those fields are grouped, ordered, and displayed in the analyst UI, making them the fundamental constructs for structuring and presenting incident information. Option B is correct because Incident Types classify the category of security event (for example, Phishing, Malware, or Brute Force) and drive the associated playbook, field set, and layout, so they are essential for organizing incidents into meaningful categories. Options C, D, and E are incorrect because physical rack elevations, browser extension manifests, and Linux kernel module parameters are unrelated to XSOAR's incident data model and play no role in organizing or displaying incident information to analysts.

Answer

Physical server rack elevation diagrams.

Answer

Browser extension plugin manifests.

Answer

Linux kernel module compilation parameters.

Question 11

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Accepted Answer

It assigns a higher weight to trusted sources, potentially overriding lower-trust malicious feeds.. Trust levels in XSOAR determine how indicator scores from various sources are weighed and resolved during reputation calculation.

Answer

It causes the indicator score to be permanently locked to 0 regardless of other feeds.

Answer

It disables feed fetching for that specific indicator value.

Answer

It automatically deletes the indicator if any other feed reports it as malicious.

Question 12

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

Accepted Answer

The user role viewing the dashboard lacks permissions to access the underlying data or indices.. Option A is correct because XSOAR dashboard widgets execute queries against underlying data (incidents, indicators, or Elasticsearch indices) under the permissions of the viewing user's role; if that role lacks the required RBAC permissions to those data sources, the widget query is rejected and the widget fails to render. Option D is correct because custom widgets are driven by incident or indicator queries (often written in XSOAR's Lucene-style query syntax), and a malformed query with syntax errors will cause the widget's data fetch to fail and return an error. Option B is not relevant because SMTP port blocking only affects email notifications and mail integrations, not dashboard widget data retrieval. Option C is not relevant because swap space sizing affects general server performance/stability, not the specific failure of a widget query. Option E is not relevant because an expired SSL certificate on a firewall integration would break that integration's connectivity, not the dashboard widget's query execution.

Answer

The SMTP server port is blocked by a local firewall.

Answer

The Linux kernel swap space on the XSOAR server is configured below 512MB.

Answer

The SSL certificate of the active firewall integration has expired.

Question 13

An automation engineer is designing a complex incident investigation workflow where sub-playbooks are invoked dynamically based on asset criticality extracted during enrichment. Which XSOAR playbook feature allows calling another playbook conditionally based on incident context?

Accepted Answer

A conditional task evaluating context paths to execute specific sub-playbooks.. A conditional task or a playbook task executing a sub-playbook with conditional entry criteria allows dynamic routing to specialized sub-playbooks.

Answer

Custom DBot score thresholds configured in system settings.

Answer

Incident layout tab visibility rules.

Answer

Global server environment variables evaluated at startup.

Question 14

An administrator wants to ensure that when an incident is closed in Cortex XSOAR, a summary report is automatically generated and attached to the incident as a text file. Which feature should the administrator configure to achieve this?

Accepted Answer

Playbook with a task triggered on incident closure. To automatically generate and attach a summary report when an incident is closed, the administrator should configure a playbook that includes a task triggered by the incident closure. This task can run a script to compile the report and use the 'FileCreate' or similar command to attach it. Playbooks are the primary automation mechanism for such event-driven actions.

Answer

Scheduled report in the Reports section

Answer

Incident field with a default value

Answer

Incident Type field configuration

Question 15

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

Accepted Answer

Right-click context menu on the field value. The right-click context menu on a field value in the incident details pane provides a quick way to search for other incidents sharing that value. This is an interactive feature that enables analysts to pivot from a specific incident to related ones without leaving the incident view or manually crafting a query.

Answer

Dashboard widget filtered by incident type

Answer

Incident search bar with a free-text query

Answer

Playbook task to query incidents