XSOAR-Engineer Practice Test 16 — 15 Questions

Question 1

An XSOAR engineer is planning a playbook to handle malware incidents. The playbook must extract indicators from the incident, enrich them, and then decide whether to block them. The engineer wants to ensure that the playbook is modular and reusable across different incident types. Which TWO design approaches should the engineer use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a sub-playbook for indicator extraction and enrichment that can be called from multiple parent playbooks.. To achieve modularity and reusability, the engineer should create a sub-playbook for indicator extraction and enrichment that can be called from multiple parent playbooks, and define a custom incident field to store and share the list of indicators. These approaches promote code reuse, simplify maintenance, and ensure consistent data handling across different incident types.

Answer

Use the 'GenericPolling' task to wait for enrichment results before proceeding.

Answer

Use a single monolithic playbook that contains all tasks for all incident types to avoid complexity.

Answer

Hardcode the list of indicators in each playbook to ensure they are always available.

Question 2

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

Accepted Answer

Configure the SMTP settings in the Server Configuration, including the SMTP server address, port, username, and password.. To enable email notifications for incidents in Cortex XSOAR, the administrator must configure the SMTP settings in the Server Configuration. This includes the SMTP server address, port, and authentication credentials. This configuration allows the server to send notifications automatically, ensuring that incidents are communicated to the appropriate teams.

Answer

Install and configure the Mail Sender integration instance with the SMTP server details.

Answer

Create a playbook that triggers on incident creation and uses the 'send-mail' command with hardcoded SMTP details.

Answer

Modify the docker environment variables to include SMTP credentials for the notification service.

Question 3

An XSOAR engineer is planning a new playbook for automated incident response. The playbook needs to run different branches based on the severity of the incident: if severity is 'High', it should trigger a full response; if 'Medium', a partial response; and if 'Low', just a notification. Which playbook task type should be used to implement this branching logic?

Accepted Answer

Conditional task. To branch based on incident severity, a conditional task is the appropriate choice. It evaluates conditions and directs the playbook flow accordingly. Other task types serve different purposes: data collection for gathering input, manual for human interaction, and automation for executing scripts. Only conditional tasks provide the built-in branching capability needed.

Answer

Data collection task

Answer

Automation task

Answer

Manual task

Question 4

An engineer wants a playbook to dynamically decide the next task based on a severity value that is computed at runtime by a script. The playbook must branch to different tasks depending on whether the computed severity is 'High', 'Medium', or 'Low'. Which task type should be used to achieve this dynamic branching?

Accepted Answer

Conditional task. A conditional task evaluates custom conditions against the incident context at runtime, enabling the playbook to follow different paths based on computed values such as severity. This is the intended mechanism for dynamic branching in Cortex XSOAR playbooks. Other task types either execute a single action, collect input, or require manual completion, and do not provide conditional routing.

Answer

Data collection task

Answer

Standard task

Answer

Manual task

Question 5

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

Accepted Answer

Upload the identity provider's metadata XML to the Cortex XSOAR server in the SAML configuration section.. To enable SAML SSO in Cortex XSOAR, the administrator must upload the identity provider's metadata XML in the SAML configuration section. This metadata includes the necessary information for the server to trust and communicate with the identity provider, such as the SSO URL and signing certificate. This step is essential for establishing the SAML trust relationship.

Answer

Modify the server's hosts file to map the identity provider's domain to the Cortex XSOAR server IP.

Answer

Generate a self-signed certificate on the Cortex XSOAR server and provide it to the identity provider for encryption.

Answer

Install the SAML integration from the Marketplace and configure it with the identity provider details.

Question 6

An engineer is designing a playbook that includes a sub-playbook to perform IP enrichment. The sub-playbook returns a list of enriched IPs in its context under the key 'EnrichedIPs'. The engineer wants to access this list in the parent playbook to use in a subsequent task. Which syntax should be used to reference the list in the parent playbook task?

Accepted Answer

The engineer must configure the sub-playbook task's outputs to map 'EnrichedIPs' to a parent context key, then reference that key.. Sub-playbook outputs must be explicitly mapped to parent context keys in the sub-playbook task's outputs configuration. Without this mapping, the parent playbook cannot directly access the sub-playbook's internal context. Once mapped, the engineer can reference the parent key in subsequent tasks. This design enforces clear data flow between playbooks.

Answer

${subplaybook.EnrichedIPs}

Answer

${SubPlaybookName.EnrichedIPs}

Answer

${EnrichedIPs}

Question 7

You are creating a playbook that includes a task to query a threat intelligence integration. The integration command returns a list of indicators, but you only want to proceed if the list is not empty. Which playbook task configuration should you use to evaluate the result and branch accordingly?

Accepted Answer

Add a Conditional task after the integration task and set the condition to check if the indicator list is not empty.. To branch based on the output of an integration task, you need a Conditional task. It can evaluate the indicator list and route execution down the appropriate path. The integration task itself does not provide conditional branching; it only returns data. A Conditional task is the correct way to implement logic that checks for non-empty results and proceeds accordingly.

Answer

Use a Standard task with a script that checks the list and then manually routes the playbook by setting a context key.

Answer

Add a Manual task that asks the analyst to review the list and decide whether to continue.

Answer

Configure the integration task to only return results if the list is not empty by setting a filter in the command arguments.

Question 8

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the engine to use a direct connection to the main server over port 443 with a valid SSL certificate.. To deploy an engine for high-volume ingestion, secure and reliable communication with the main server is essential, typically via port 443 with SSL. Additionally, adequate CPU and memory must be allocated to handle the load, and monitoring ensures ongoing performance. These two actions address connectivity and processing capacity, which are critical for the engine's role.

Answer

Enable the engine to act as a standalone server to reduce dependency on the main server.

Answer

Configure the engine to use a proxy server for all outbound communication to the main server.

Answer

Install the engine on a Windows server instead of Linux to improve performance.

Question 9

An engineer is designing a playbook that must iterate over a list of IP addresses stored in the incident context under the key 'IPs'. For each IP, the playbook should run a reputation check and then add a note to the incident. Which playbook task type should be used to loop over the list and execute the sub-tasks for each item?

Accepted Answer

For-each task. The For-each task is specifically designed to iterate over a list and execute a set of sub-tasks for each element. In this scenario, it will loop through the 'IPs' list, run the reputation check, and add a note for each IP. This provides a clean, maintainable way to handle repetitive actions without manual intervention or custom scripting.

Answer

Conditional task

Answer

Manual task to select each IP and trigger the sub-tasks

Answer

Standard task with a script that loops internally

Question 10

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

Accepted Answer

The server must have outbound HTTPS access to the Cortex XSOAR update servers on port 443.. Automatic updates for Cortex XSOAR content packs and system components are fetched over HTTPS on port 443. The server must have outbound access to the update servers to download these updates. Other protocols like SSH, FTP, or DNS alone do not support the update mechanism and would fail to deliver the necessary files.

Answer

The server must have outbound SSH access on port 22 to the update servers.

Answer

The server must have outbound DNS access on port 53 only; updates are pulled via DNS queries.

Answer

The server must have outbound FTP access on port 21 to download update packages.

Question 11

An engineer is creating a playbook that needs to send an email notification to the security team when a high-severity incident is detected. The engineer wants to include the incident ID and severity in the email body. Which task type should be used to compose and send the email?

Accepted Answer

A standard task that calls the 'send-mail' integration command with the necessary arguments.. The 'send-mail' integration command is designed for sending emails from playbooks. By using a standard task that calls this command, the engineer can automatically compose and send an email with dynamic content from the incident context, such as ID and severity. Other task types are not intended for sending emails or would require manual intervention.

Answer

A manual task that prompts the analyst to send an email manually.

Answer

A condition task that evaluates the severity and then uses a transformer to send an email.

Answer

A data collection task that gathers email content from the analyst before sending.

Question 12

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

Accepted Answer

Use the built-in backup and restore mechanism available in the Cortex XSOAR settings, which creates a full backup file. The built-in backup and restore mechanism in Cortex XSOAR is specifically designed to create a comprehensive backup that includes incidents, playbooks, integrations, and system settings. It produces a restorable file that can be used to recover the server or migrate to a different server, ensuring all critical data is preserved.

Answer

Perform a file-level backup of the /var/lib/docker directory and the Cortex XSOAR installation directory

Answer

Use a third-party database backup tool to back up the MongoDB database only

Answer

Export each playbook and integration individually via the Cortex XSOAR UI and manually recreate incidents

Question 13

A playbook task is configured to run a command that returns a large JSON object. The engineer wants to store only a specific nested field from the command result into the incident context for later use. Which task configuration should be used?

Accepted Answer

In the task's 'Outputs' section, map a new context key to the nested field using the command's context path.. The Outputs section of a task is designed to map values from the command result to context keys. By specifying the correct context path for the nested field, the engineer can store just that value. This keeps the context concise and ensures later tasks can reference the specific data without parsing large JSON objects or requiring manual intervention.

Answer

Add a 'Data Collection' task that asks the analyst to manually copy the nested field from the command result.

Answer

Enable 'Store raw output' and then use a 'Set' task to copy the entire JSON object into a new key.

Answer

Use a 'Transform' task with a JSONPath expression to extract the field and write it directly to the incident context.

Question 14

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

Accepted Answer

Check the engine's logs for connection errors or authentication failures.. When an engine is disconnected despite basic network connectivity, the engine's logs are the best source of information. They can reveal authentication failures, TLS errors, or misconfigured server addresses. Other actions, such as restarting the server or checking hostname resolution, are either disruptive or redundant given the scenario.

Answer

Verify that the engine's hostname resolves correctly from the server.

Answer

Restart the XSOAR server to clear any temporary glitches.

Answer

Increase the engine's memory allocation to improve performance.

Question 15

An XSOAR Engineer is designing a playbook that must handle multiple branches based on indicator reputation. The engineer wants to ensure that certain tasks only execute when the indicator's reputation is 'Bad' or 'Suspicious'. Which TWO methods can be used to implement this conditional logic in the playbook? (Choose two.)

Accepted Answer

Configure the tasks' 'Run if' condition to check the indicator reputation directly in the task settings.. Condition tasks and 'Run if' conditions are both valid ways to implement conditional logic based on indicator reputation. A condition task provides branching, allowing different paths for different reputations. 'Run if' conditions allow individual tasks to execute only when the reputation matches specified criteria. Both methods are supported and commonly used in playbook design.

Answer

Create a sub-playbook that filters indicators by reputation and call it from the parent playbook.

Answer

Use a loop task to iterate over indicators and set a 'continue on error' condition based on reputation.

Answer

Use a data collection task to ask the analyst to manually select the reputation and then branch accordingly.