XSOAR-Engineer Practice Test 17 — 15 Questions

Question 1

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the built-in backup and restore mechanism in Cortex XSOAR to create a backup file that includes the database and configuration.. The built-in backup and restore mechanism is designed to create a consistent backup of the Cortex XSOAR database and configuration, including incidents, playbooks, and settings. Other methods either capture only partial data, risk inconsistency, or are not supported for full-system recovery. Using the native tool ensures a reliable and restorable backup.

Answer

Perform a file-level backup of the /var/lib/docker directory to capture all containers and volumes.

Answer

Take a snapshot of the virtual machine hosting Cortex XSOAR using the hypervisor's snapshot feature.

Answer

Export each playbook and integration individually through the Cortex XSOAR UI and save the JSON files.

Question 2

An engineer wants to test a playbook that is still in development. The playbook should only be triggered for incidents with the type 'Phishing' and severity 'High'. Which configuration ensures the playbook runs only under these conditions?

Accepted Answer

Configure the playbook's trigger to 'Automatic' and set the incident type and severity conditions in the playbook's trigger settings.. To ensure a playbook runs automatically only for incidents matching specific criteria, the engineer should use the playbook's trigger settings. Setting the trigger to 'Automatic' and adding conditions for incident type and severity restricts execution to incidents that meet both criteria. Other options either require manual triggering, run the playbook unnecessarily, or do not properly filter by severity.

Answer

In the playbook settings, set 'Run on' to 'All incidents' and add a filter in the first task.

Answer

Create a new incident type 'Phishing' and set the playbook as the default for that type, then configure the playbook to run only on severity 'High'.

Answer

Set the playbook's trigger to 'Manual' and add a conditional task at the beginning to check incident type and severity.

Question 3

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

Accepted Answer

Enable SSL on the PostgreSQL server and configure the Cortex XSOAR server to connect using the sslmode=require parameter in the database connection string.. The correct approach is to enable SSL on the PostgreSQL server and configure the Cortex XSOAR connection string with sslmode=require. This ensures that all database traffic is encrypted using TLS. The other options either do not provide transport encryption, introduce unsupported components, or would prevent the application from connecting to the database.

Answer

Set the PostgreSQL listen_addresses parameter to localhost and rely on the operating system's loopback interface for security.

Answer

Install a reverse proxy between the Cortex XSOAR server and PostgreSQL to terminate TLS and forward unencrypted traffic to the database.

Answer

Configure the Cortex XSOAR server to use the PostgreSQL native pgcrypto extension for column-level encryption.

Question 4

An engineer is debugging a playbook that occasionally fails when a task calls an automation script. The script expects a JSON string as input, but the engineer is passing a context object directly. The playbook sometimes works and sometimes fails, depending on the data. Which action should the engineer take to ensure the automation receives the correct input type?

Accepted Answer

In the task's 'Inputs' section, wrap the context object with the 'Stringify' transformer before passing it to the automation.. The Stringify transformer serializes a JSON object into a string, which is exactly what the automation expects. By applying it in the task's Inputs section, the engineer ensures the automation always receives a valid JSON string, eliminating intermittent failures caused by passing an object directly. This is the correct, non-invasive fix that preserves the automation's interface.

Answer

Change the automation script to accept a dictionary instead of a string, and update all calls accordingly.

Answer

Enable 'Pretty print' in the task settings so the object is formatted as a readable string.

Answer

Use the 'Set' task to assign the context object to a new key and then reference that key in the automation input.

Question 5

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

Accepted Answer

Check the engine's log files for errors related to authentication or certificate validation.. The engine's log files are the best source of information for diagnosing connection issues. Errors related to authentication, certificates, or configuration will be recorded there. Since network connectivity is already verified, the next step is to examine logs for specific failure reasons. Other actions like restarting the server or checking inbound access are not appropriate for this scenario.

Answer

Verify that the engine has inbound access from the server on port 443.

Answer

Restart the Cortex XSOAR server to re-establish the connection.

Answer

Increase the engine's allocated memory and CPU resources.

Question 6

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

Accepted Answer

The host must have a supported container runtime installed and configured.. Docker-based integrations in XSOAR require a supported container runtime on the host. Without it, the server cannot execute containerized content. Other options list unnecessary or unrelated requirements such as GPU, Active Directory, or excessive RAM, which are not needed for this purpose.

Answer

The host must have a minimum of 1 TB of RAM.

Answer

The host must have a GPU available for accelerated computing.

Answer

The host must be joined to an Active Directory domain.

Question 7

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

Accepted Answer

Export all custom playbooks, automations, and integrations using the server's backup and restore mechanism.. A robust backup strategy for XSOAR includes both the built-in backup and restore mechanism, which captures custom content and configuration, and a full VM or volume snapshot for complete system recovery. These two together ensure that all necessary components can be restored after a failed upgrade. Other options are either partial or unrelated to backup and restore.

Answer

Export only the integration instances and their credentials.

Answer

Manually copy the /var/log/demisto directory to a remote share.

Answer

Schedule a daily report of all incidents to be emailed to the administrator.

Question 8

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

Accepted Answer

Create a threat intel management rule with higher priority that tags these indicators and excludes tagged indicators from expiration rules.. Threat intel management rules evaluate conditions and apply actions, and expiration rules can be scoped to exclude tagged indicators. A high-priority rule that tags the trusted internal feed's indicators, combined with an expiration rule that skips tagged indicators, explicitly prevents automatic expiry while leaving other feeds governed normally. Feed settings and global period changes cannot guarantee exemption, and disabling the engine is too broad.

Answer

Disable the threat intel management rule engine entirely so no expiration rules run.

Answer

Set the feed's indicator expiration to 'never' in the feed integration instance settings.

Answer

Increase the indicator expiration period to a very large value in the global indicator settings.

Question 9

An XSOAR engineer is planning a new playbook for malware analysis. The playbook should run a series of tasks, and the engineer wants to ensure that if any task fails, the playbook continues to the next task without stopping. Which playbook setting should be configured to achieve this behavior?

Accepted Answer

Set the task to 'Continue on error'. The 'Continue on error' setting on individual tasks is the correct way to ensure that a task failure does not stop the playbook. This setting allows the playbook to proceed to subsequent tasks, which is essential for workflows where some steps may fail without invalidating the entire process. Other options either do not exist or serve different purposes, such as debugging or manual approval.

Answer

Set the task to 'Manual approval required'

Answer

Set the playbook to 'Run in debug mode'

Answer

Set the playbook to 'Ignore errors'

Question 10

A large enterprise is using XSOAR to manage security incidents. The SOC manager wants to ensure that when a critical incident is created, an email notification is sent to the on-call team, and a Slack message is posted to the security channel. The notifications should include a link to the incident in XSOAR. The engineer needs to choose the most efficient way to implement this in a playbook. Which approach should the engineer take?

Accepted Answer

Use two separate tasks: one with the 'send-mail' command for email and one with the 'slack-send-message' command for Slack, both including a link to the incident.. The most efficient and reliable way is to use separate tasks for each notification method, leveraging the specific integrations. The email task uses the 'send-mail' command, and the Slack task uses the 'slack-send-message' command. Both can include a link to the incident, ensuring the on-call team and security channel receive the necessary information.

Answer

Use a single task with the 'send-notification' command that supports multiple channels, including email and Slack.

Answer

Create a single task that uses the 'send-mail' command and include the Slack channel email address as a recipient.

Answer

Configure a server-wide notification rule that triggers on incident creation and sends both email and Slack messages automatically.

Question 11

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

Accepted Answer

Inputs. Task property drawers include tabs for Task Details, Inputs, Outputs, and Conditions.

Answer

Kernel

Answer

Compiler

Answer

Bios

Question 12

An XSOAR administrator is planning security and access controls for a multi-team SOC deployment. Which THREE components are essential when configuring Role-Based Access Control (RBAC) and data permissions? (Choose THREE)

Accepted Answer

Assigning users to specific Roles that define permissions for incident types, war room access, and settings.. RBAC roles, incident query filters (incident restriction queries), and role-based permissions on playbooks/integrations ensure secure multi-team segregation.

Answer

Sharing a single Administrator account credentials among all seventy SOC analysts.

Answer

Disabling authentication entirely on the XSOAR server API endpoints.

Question 13

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

Accepted Answer

Task. A Regular task (or Task) in an XSOAR playbook is used to run integration commands, automation scripts, or built-in actions directly.

Answer

Condition

Answer

Data Collection

Answer

Parallel

Question 14

An XSOAR architect is designing an automated incident lifecycle where incidents that remain unresolved after 72 hours must be automatically escalated to senior management and assigned a specific tag. Which XSOAR feature is designed to execute logic based on time-based triggers or SLAs?

Accepted Answer

Incident SLAs and timer/scheduled automation rules configured for SLA breach actions.. SLAs (Service Level Agreements) and timer tasks or automated scheduled scripts/rules can track incident duration and trigger escalation workflows when time thresholds are breached.

Answer

Integration instance polling frequency parameters.

Answer

Standard browser session timeout settings.

Answer

The daily database backup cron schedule.

Question 15

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Accepted Answer

The Owner dropdown field in the incident header. In Cortex XSOAR, the incident header displays an Owner field as a dropdown that lists available users and allows the current analyst to assign the incident to themselves or others. Selecting your own username from that dropdown assigns ownership directly from the incident view.

Answer

The Close Incident button

Answer

The Playbook graph zoom button

Answer

The War Room attachment paperclip icon