XSOAR-Engineer Practice Test 15 — 15 Questions

Question 1

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the built-in backup and restore utility to create a full backup on the old server and restore it on the new cloud instance.. Migrating Cortex XSOAR requires preserving all data, configurations, and custom content. The built-in backup and restore utility is designed for this purpose, capturing the PostgreSQL database, Elasticsearch indices, and system settings. Restoring the backup on the new cloud instance ensures a complete and consistent migration with minimal downtime when done during a maintenance window.

Answer

Export all incidents and playbooks via the API, then import them on the new server after a fresh installation.

Answer

Manually copy the PostgreSQL database files and Elasticsearch data directory to the new server, then start the services.

Answer

Set up database replication between the old and new servers, then switch over after replication is complete.

Question 2

An analyst is investigating a live incident and needs to share a set of indicators with an external partner without exposing internal notes or the full incident timeline. The analyst must produce a file that the partner can import into their own Cortex XSOAR instance. What should the analyst do?

Accepted Answer

Select the indicators in the Indicators page and use the 'Export indicators' action to generate a STIX or CSV file for the partner.. Sharing only indicators with an external partner requires exporting from the Indicators page rather than exporting the incident. STIX and CSV are importable indicator formats that exclude incident notes and timeline entries. Exporting the incident or sending a report or transcript would either expose internal content or produce a file the partner cannot import.

Answer

Run the '!send-mail' command with the incident ID and attach the War Room transcript for the partner to process.

Answer

Generate a PDF report from the incident's Report tab and send it to the partner for manual re-entry.

Answer

Use the 'Export incident to file' option and send the resulting JSON, which includes only indicators.

Question 3

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

Accepted Answer

The engine must have outbound access to the Cortex XSOAR server on port 443.. The Cortex XSOAR engine initiates connections to both the Cortex XSOAR server and the SIEM. It requires outbound access to the server on port 443 to receive tasks and send results. It also requires outbound access to the SIEM on the appropriate port to fetch incidents. Inbound access to the engine is not needed for these communications, as the engine acts as a client in both cases.

Answer

The engine must have inbound access from the Cortex XSOAR server on port 22.

Answer

The engine must have inbound access from the SIEM on the required port.

Answer

The engine must have inbound access from the Cortex XSOAR server on port 443.

Question 4

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

Accepted Answer

The indicator's score is recalculated each time a feed updates it, and the last feed to report wins, so the score alternates based on feed execution order.. Cortex XSOAR recalculates an indicator's score whenever a feed updates it, and with multiple feeds reporting conflicting reputations, the score reflects whichever feed last wrote to the indicator. If feed execution order varies, the reputation oscillates between the values associated with each feed. The fix is to use indicator scoring rules or feed precedence rather than relying on last-write-wins behavior.

Answer

The Threat Intel database is corrupted, causing score recalculation failures that randomly reset the indicator's reputation.

Answer

Expiration settings for the two feeds differ, so the indicator expires and is recreated with a default score on each cycle.

Answer

The indicator has been added to a manual allow list, which overrides feed scores intermittently when the allow list sync runs.

Question 5

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

Accepted Answer

The 'Source' parameter, which defines the source name used when ingesting indicators and associates them with this feed.. The Source parameter on a feed instance determines the source label applied to indicators ingested by that feed. When an indicator already exists in the Threat Intel database, the feed's source is added to the indicator's source list, creating the association. Without the correct Source value, existing indicators will not be linked to the new feed, even though the feed fetches successfully.

Answer

The 'Fetch indicators' checkbox, which enables or disables the periodic fetching of indicators from the TAXII server.

Answer

The 'Update existing indicators' checkbox, which controls whether fetched indicators update existing database entries.

Answer

The 'Indicator Reputation' parameter, which assigns a reputation score to newly ingested indicators.

Question 6

An XSOAR engineer is designing a playbook that integrates with a ticketing system to create tickets for high-severity incidents. The playbook must avoid creating duplicate tickets if the incident is updated multiple times. Which method should the engineer use to track whether a ticket has already been created?

Accepted Answer

Store the ticket ID in a custom incident field and check if the field is populated before creating a new ticket.. Storing the ticket ID in a custom incident field allows the playbook to check for its existence before creating a new ticket. This ensures idempotency and prevents duplicates even if the playbook runs multiple times. Other methods like timestamps or external deduplication are less reliable and do not provide deterministic control.

Answer

Rely on the ticketing system's deduplication feature to prevent duplicate tickets.

Answer

Use the incident's 'occurred' timestamp to determine if a ticket was created in the last hour.

Answer

Create a new incident for each update to ensure a fresh ticket is generated.

Question 7

An engineer is building a playbook that must run a set of enrichment tasks only when the incident severity is at least 'High'. The severity field is already populated in the incident context. The engineer wants to avoid duplicating tasks for each possible severity value. Which approach is most appropriate?

Accepted Answer

Add a condition task that evaluates the severity field and routes to a single branch for High and Critical severities.. A condition task is the native mechanism for branching on incident fields such as severity. By grouping High and Critical into a single branch with a logical condition, the engineer avoids duplicating enrichment tasks and enforces the severity threshold automatically. The other approaches either require manual effort, create unnecessary playbook sprawl, or do not evaluate the severity field at all.

Answer

Use a data collection task to read the severity value and then continue unconditionally.

Answer

Create four separate playbooks, one per severity level, and trigger each via a separate incident type.

Answer

Add a manual task that asks the analyst to confirm the severity before enrichment runs.

Question 8

An XSOAR engineer is designing a playbook to automate phishing email triage using the Phishing incident type. The team wants each incoming phishing report to automatically trigger a sub-playbook that extracts indicators and checks reputation across configured threat intel integrations. Which XSOAR component should be configured to launch this sub-playbook automatically for every new phishing incident?

Accepted Answer

Incident Type settings with a playbook association. The correct approach is to link the Phishing incident type to the desired playbook in the Incident Type configuration. This ensures that every incident of that type starts the playbook automatically, enabling immediate indicator extraction and reputation checks. Other mechanisms such as classifiers or pre-processing rules handle data mapping and filtering but do not trigger playbook execution, so they cannot fulfill the automation requirement on their own.

Answer

A pre-processing rule in the integration instance settings

Answer

A scheduled job in the Playbook editor

Answer

A classifier rule that maps email fields to incident fields

Question 9

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

Accepted Answer

The indicators are also reported by another feed with a longer expiration, so the platform retains them until all sources expire.. Indicator expiration in Cortex XSOAR is calculated per source, and the indicator's overall expiration is the latest expiration among all sources. If another feed reports the same indicator with a longer or no expiration, the indicator persists until that source expires. This multi-source expiration model explains why setting 30 days on one feed may not remove the indicator.

Answer

The 'Expiration' parameter requires a restart of the feed integration to take effect.

Answer

The 'Expiration' parameter on the feed instance only applies to indicators that are no longer in the feed, but the feed still reports them.

Answer

The feed's 'Expiration' parameter is overridden by the global indicator expiration policy in Settings > Threat Intel.

Question 10

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

Accepted Answer

A custom integration or script that calls the SIEM's REST API to push indicators on a schedule.. Outbound indicator sharing requires mechanisms that transmit data externally. Acting as a TAXII 2.1 server lets a partner poll selected indicators in a standard format, while a custom integration or script that calls the SIEM's REST API delivers indicators to that system on a schedule. Inbound creation toggles, expiration rules, and Playground execution do not export indicators, so they cannot fulfill either leg of the requirement.

Answer

Enabling the 'Create indicators' parameter on the internal feed instances to broadcast indicators outward.

Answer

Using the Playground to manually run enrichment commands that forward indicators to external APIs.

Answer

Configuring indicator expiration rules to push expired indicators to external consumers.

Question 11

An XSOAR engineer is planning a playbook to handle phishing incidents. The playbook must send an email notification to the SOC manager only when the incident severity is 'High' and the phishing email contains at least one malicious attachment. Which approach should the engineer use to implement this conditional notification?

Accepted Answer

Add a task with the condition 'severity == High and maliciousAttachments > 0' using the built-in conditional task type.. The conditional task in XSOAR is designed to evaluate complex conditions using incident fields and custom fields. By combining severity and attachment analysis into a single condition, the engineer ensures the notification is sent only when both criteria are satisfied. This method is efficient, maintainable, and leverages built-in functionality without unnecessary complexity.

Answer

Create a separate playbook that triggers on severity High, and within it use a script to check for malicious attachments before sending the email.

Answer

Configure the email integration to send notifications for all high-severity incidents, and rely on the analyst to ignore irrelevant ones.

Answer

Use a manual task that prompts the analyst to review the incident and decide whether to send the notification.

Question 12

A security team is planning a new use case in XSOAR to automate the response to malware detections from an endpoint protection platform. The playbook must isolate the infected endpoint, collect forensic data, and notify the incident response team. Which initial step should the engineer take to ensure the playbook can execute these actions?

Accepted Answer

Verify that the endpoint protection integration is configured with the necessary API permissions for isolation and data collection.. The engineer must first ensure the endpoint protection integration is properly configured with API permissions for isolation and forensic data collection. This is a prerequisite for the playbook to execute its response actions successfully. Other steps like incident type creation or dashboards are secondary and do not directly enable the required actions.

Answer

Design a custom dashboard to monitor malware incidents and track response times.

Answer

Create a new incident type specifically for malware detections to categorize the incidents.

Answer

Schedule a recurring job to fetch malware detections from the endpoint platform every hour.

Question 13

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

Accepted Answer

Expiration resets each time the feed returns the indicator, and the final reputation is the combined DBotScore from all contributing sources.. Feed-based expiration counts from the last time the feed observed the indicator, so each sighting resets the 30-day timer and indicators persist while the feed keeps returning them. Reputation is the combined DBotScore from all contributing sources, so a Good score from another integration can result in a Good displayed reputation even though this feed assigns Bad. The other choices misstate expiration scope or reputation aggregation and therefore do not match the observed behavior.

Answer

Expiration only applies to indicators with a reputation of 'Unknown', and reputation is set by the most recently updated feed.

Answer

Expiration is a global setting that overrides feed-level values, and reputation is locked to the first source that reported the indicator.

Answer

Expiration is measured from when the indicator was first created, and reputation is always the feed's configured value regardless of other sources.

Question 14

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

Accepted Answer

Click the indicator value in the incident's Indicators tab to open its details page.. From an incident, the Indicators tab lists the extracted indicators, and clicking an indicator's value opens its full Indicator Details page. That page consolidates the reputation, per-integration DBotScore contributions, related incidents, and timestamps like last seen. The other choices either print tabular CLI output, navigate to a different global area, or re-run enrichment without showing stored details, so they do not open the details view for the IP.

Answer

Open the Threat Intel page and use the global search to find the IP.

Answer

Run the '!ip' reputation command directly in the war room CLI.

Answer

Run the '!getIndicators' command in the CLI and read the output table.

Question 15

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

Accepted Answer

The Threat Intel page, by searching for the hash and opening its indicator details.. The Threat Intel page is the repository for ingested indicators and provides a details view consolidating reputation, feed sources, and timestamps for a given value. Searching the hash there yields exactly the feed provenance and scoring information the analyst needs. The Playground, Incidents page, and Marketplace serve execution, case management, and content installation respectively, none of which present a unified indicator record.

Answer

The Marketplace, by locating the feed pack that likely contains the hash.

Answer

The Incidents page, by searching for incidents that contain the hash in their details.

Answer

The Playground, by running a command against the hash and reading the raw output.