XSOAR-Engineer Practice Test 14 — 15 Questions

Question 1

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

Accepted Answer

Type @ followed by the teammate's username.. The War Room uses the @ symbol to mention users. When an analyst types @ and selects a username, Cortex XSOAR creates a mention that notifies the user and ties the entry to their account, which is the correct way to direct an incident update to a specific teammate.

Answer

Type # followed by the teammate's username.

Answer

Type the teammate's username preceded by a forward slash.

Answer

Type the teammate's email address enclosed in square brackets.

Question 2

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

Accepted Answer

Use the War Room search box to filter entries by the command name or keyword. The War Room search box is the intended tool for locating specific entries in a long timeline. By entering the command name or a relevant keyword, the analyst can filter the closed ransomware incident's War Room to the exact execution entry, revealing the executing analyst and timestamp without manually scrolling hundreds of entries.

Answer

Rebuild the incident playbook to re-run the containment task and observe the output

Answer

Export the incident to PDF and search the document for the command name

Answer

Open the incident's Playbook tab and inspect each task's inputs and outputs

Question 3

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

Accepted Answer

Line chart. The correct widget types are line chart and bar chart. A line chart effectively shows trends in resolution times over time, while a bar chart displays analyst workload distribution. These visualizations directly address the administrator's goal of monitoring performance trends and workload. Other chart types are less suitable for these specific analytical needs.

Answer

Pie chart

Answer

Table chart

Answer

Number chart

Question 4

An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must extract indicators from email attachments and then conditionally block malicious hashes on a firewall. The engineer wants to ensure that the playbook does not fail when an attachment is missing or when the firewall integration is unreachable. Which design approach best meets these requirements?

Accepted Answer

Use a conditional task to check for the existence of attachments, and wrap the firewall block command in a task with 'continue on error' enabled and a retry mechanism.. The correct design uses conditional logic to handle missing attachments and error handling with retries for the firewall integration. This ensures the playbook remains robust and continues processing even when expected data is absent or an external system is temporarily unavailable. Other options either introduce dependencies that can cause failures or rely on manual intervention, which is not suitable for automated incident response.

Answer

Configure the playbook to run all tasks in parallel and use a single script to handle both attachment extraction and firewall blocking, with error suppression at the script level.

Answer

Create a separate playbook for attachment handling and another for firewall blocking, and trigger them sequentially from a parent playbook without error handling.

Answer

Use a manual task to review attachments and a manual approval before blocking hashes, ensuring no automated failures occur.

Question 5

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

Accepted Answer

The 'Tasks' view in the War Room filter dropdown. The War Room filter dropdown includes a Tasks view that limits the timeline to playbook task-related entries. For a phishing incident with many automated commands, this view lets the responder review task inputs, outputs, and completion status without sifting through command results and notes, which is exactly what is required here.

Answer

The 'Notes' view in the War Room filter dropdown

Answer

The 'Evidence' view in the War Room filter dropdown

Answer

The 'Chat' view in the War Room filter dropdown

Question 6

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Create the 'BusinessUnit' field in Settings > Advanced > Fields and assign it a type such as 'Short text'.. Making a custom field visible and editable for one incident type requires two actions: define the field in the Fields repository, then place it on that incident type's layout with editability enabled. Mapping rules and playbook inputs operate on values, not on layout presentation, so they cannot substitute for these two configuration steps.

Answer

Add the 'BusinessUnit' field to the default incident type layout and hide it via field-level permissions.

Answer

Enable the 'BusinessUnit' field in the Malware playbook as a task input so analysts can edit it during investigation.

Answer

Create a classification and mapping rule that maps the 'BusinessUnit' field from the integration to the incident.

Question 7

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Apply an incident filter that selects only incidents carrying the 'VIP' label within the previous week's date range. A scheduled report needs two things to satisfy this scenario: a weekly cadence set to Monday 07:00, and an incident filter that restricts content to VIP-labeled incidents from the prior week. Together these deliver the correct data at the correct time, meeting the SOC manager's recurring summary requirement.

Answer

Configure a War Room entry to trigger the report on demand from a playbook task

Answer

Set the report output format to CSV instead of PDF for easier metric parsing

Answer

Enable the 'include raw evidence' checkbox on the report template

Question 8

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

Accepted Answer

Place the custom field group in a section and mark the section as expanded by default. Incident layouts are composed of sections that can be rendered expanded or collapsed. Configuring the section containing the department, manager, and compliance tier fields to be expanded by default makes those values immediately visible when the Data Breach incident is opened, which is exactly the prominent display the engineer needs.

Answer

Add the fields to the incident's War Room as a formatted note on creation

Answer

Add the custom fields to the incident's Quick View and rely on hover tooltips

Answer

Create a new incident type for Data Breach and attach the fields to the type definition

Question 9

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

Accepted Answer

Add a War Room entry task to the Phishing playbook that uses the domain reputation command and posts formatted markdown.. Automatic, per-incident War Room content is produced by playbook tasks, not by incident fields or scheduled jobs. A War Room entry task in the Phishing playbook runs on trigger and can format command output into markdown for the analyst. Because the playbook is bound to the incident type, every new Phishing incident receives the entry without any manual step.

Answer

Configure a scheduled job that queries the Phishing incidents and posts a note via the API every hour.

Answer

Create a custom incident field with type 'HTML' and set its default value to the reputation data.

Answer

Enable the 'Auto-extract indicators' setting on the Phishing integration instance so indicators are enriched and shown in the War Room.

Question 10

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

Accepted Answer

The War Room with the 'Commands and Results' filter applied. The War Room conversation is the chronological record of everything happening in an incident, including automation command executions and their returned data. Filtering that conversation to Commands and Results isolates the technical entries, giving the analyst both the command that ran and the raw JSON response from the integration in one continuous timeline.

Answer

The Playbook task list, which enumerates every task and its status

Answer

The Notes tab, which lists analyst annotations in creation order

Answer

The incident's Context Data tab, which shows the unified context tree

Question 11

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

Accepted Answer

Configure a report template that selects incident fields, task summaries, and notes sections. A curated post-incident artifact requires both a report template that defines which sections appear and the act of generating that report from the incident itself. The template controls inclusion of incident fields, playbook task summaries, and analyst notes while excluding raw JSON, and report generation turns that template into a shareable document for stakeholders.

Answer

Use the War Room 'Download as PDF' option on the unfiltered conversation

Answer

Create a dashboard widget showing incident severity distribution for the month

Answer

Export the incident context to a JSON file and email it to stakeholders

Question 12

A security team is planning an XSOAR playbook that must dynamically route incidents to different sub-playbooks based on the severity of the incident, which is stored in a custom incident field named 'incidentseverity'. The playbook should evaluate this field and then call the appropriate sub-playbook. Which XSOAR feature should the engineer use to implement this conditional branching?

Accepted Answer

Use a condition task that evaluates the 'incidentseverity' field and branches to the appropriate sub-playbook.. The condition task is specifically designed for conditional branching in XSOAR playbooks. It allows the engineer to define criteria using incident fields, context keys, or task results. By evaluating the custom field 'incidentseverity', the playbook can automatically direct the incident to the correct sub-playbook, ensuring consistent and efficient handling based on severity.

Answer

Use a manual task and instruct the analyst to select the sub-playbook.

Answer

Use a data collection task to gather the severity from the analyst and then branch.

Answer

Use a script task that runs a Python script to set a new field, then use a manual task to route.

Question 13

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

Accepted Answer

Add the indicator type to the 'Indicator Extraction' rules with a regex and associate the reputation command in the indicator type settings.. Automatic identification of a custom indicator type requires an extraction rule that maps a regex pattern to the CryptocurrencyAddress indicator type, plus associating the reputation command with that type. Extraction rules scan incident evidence at creation time and tag matching values as indicators, while the linked reputation command provides enrichment. Configuring both makes the platform detect and enrich the values automatically, rather than relying on manual analyst action or unrelated playbook steps.

Answer

Create a new playbook that calls the reputation command and set it as the default incident playbook.

Answer

Add the indicator type to the 'Reputation' settings and enable 'Auto-extract indicators' in the integration parameters.

Answer

Define the indicator type in the 'Indicator Types' page and enable 'Automatic enrichment' on the type, which alone triggers extraction.

Question 14

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

Accepted Answer

The TAXII2 integration only ingests STIX objects whose pattern type is mapped to a supported indicator type; unsupported pattern types such as network-traffic are skipped during parsing.. The TAXII2 integration converts STIX patterns into Cortex XSOAR indicators by mapping recognized pattern types. Objects whose pattern type has no mapping, such as network-traffic, are skipped without error, so the feed reports success while those indicators never appear. The other explanations would affect either the entire fetch or the UI, neither of which matches a type-specific gap.

Answer

The TAXII2 server is rate-limiting the collection, so only the first N objects per poll are returned.

Answer

The partner's collection uses a TAXII 2.0 endpoint, and the integration instance is configured for TAXII 2.1, which cannot read 2.0 objects.

Answer

The Threat Intel page requires a manual refresh after each fetch and hides newly added indicator types until the next scheduled run.

Question 15

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

Accepted Answer

In the Indicator Details page, under the Sources section, which lists each contributing feed along with its individual score contribution.. The Sources section of an indicator's details page is the authoritative place to see every feed and integration that contributed to the indicator's aggregated reputation, including each source's individual score. Reviewing it lets the analyst attribute the Bad score to a specific feed and judge whether that source's intelligence justifies the malicious classification.

Answer

In the Audit Log, by filtering events for the indicator value and reviewing which integration wrote the reputation field.

Answer

In the Feed Integration instance configuration page, where each feed lists the scores it has assigned to indicators it ingested.

Answer

In the Playground war room, by running the !findIndicators command with the domain as an argument and reading the raw JSON output.