XSOAR-Engineer Practice Test 19 — 15 Questions

Question 1

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Conditional Task. A Conditional Task allows an XSOAR engineer to evaluate conditions and route the playbook execution path to different branches based on the results.

Answer

A Data Collection Task

Answer

A Loop Task with an exit filter

Answer

A standard task with a Post-processing script

Question 2

An XSOAR engineer is building a playbook for a new use case: automatically enriching IP addresses from a SIEM alert using a threat intelligence integration. The engineer wants to ensure that the playbook can be easily reused for different incident types. Which approach should the engineer take?

Accepted Answer

Create a sub-playbook that takes an IP address as input and returns enrichment results, then call it from the main playbook.. A sub-playbook is the most appropriate for reusability because it encapsulates the enrichment logic and can be called from any playbook with different inputs. This modular approach reduces duplication, simplifies updates, and aligns with XSOAR best practices for playbook design. Other options either duplicate logic, lack reusability, or apply enrichment indiscriminately.

Answer

Use a script to perform IP enrichment and store the script in the incident's context for later use.

Answer

Hardcode the threat intelligence integration commands directly into the main playbook for each incident type.

Answer

Configure the threat intelligence integration to automatically enrich all incidents, regardless of playbook.

Question 3

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

Accepted Answer

In the War Room entry's three-dot menu, choose 'Add Tag' and enter the label.. War Room entries support per-entry tags applied through the entry's context menu. This lets analysts classify individual notes, command outputs, or playbook actions so they can be filtered or referenced later without altering incident-level fields or playbook logic.

Answer

In the incident's Settings, enable 'Entry Tagging' and select the label from the predefined list.

Answer

In the incident's Details tab, edit the 'Tags' field and add the label.

Answer

In the playbook editor, add a 'Tag Entry' task immediately after the relevant automation task.

Question 4

An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)

Accepted Answer

demisto.args() for retrieving argument values passed into the script or command.. Option A is correct because demisto.args() is a standard Demisto Python API method that returns a dictionary of the arguments passed into the automation or integration command, allowing the script to read input parameters such as command arguments. Option D is correct because demisto.results() is the canonical method for returning outputs from a script, including human-readable entries, context data, and errors, back to the Cortex XSOAR war room. The remaining options are not part of the Demisto API: os.format_disk() (B) is not a real Python os function and would be destructive host-level behavior irrelevant to XSOAR scripting, demisto.shutdown_server() (C) does not exist in the API and would be an inappropriate destructive action, and sys.reboot_engine() (E) is not a Demisto method and does not relate to network switch management.

Answer

os.format_disk() for repartitioning the host server's root drive.

Answer

demisto.shutdown_server() to permanently kill the production database.

Answer

sys.reboot_engine() for restarting physical network switches.

Question 5

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

Accepted Answer

By passing the context path containing the file entry ID, such as ${File.EntryID}. In Cortex XSOAR, files stored in the incident context are referenced by their entry ID, which is a unique identifier for the file in the incident's file store. To attach such a file to an email, you use the context path containing the file entry ID, such as ${File.EntryID}. This allows the email task to retrieve the file from the incident's attachment store. The other options are invalid: there is no 'AttachFile' system variable, specifying a server filesystem path is not how XSOAR manages files, and hardcoding binary content is impractical.

Answer

By using the 'AttachFile' system-wide environment variable

Answer

By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt

Answer

By hardcoding the binary content of the file directly into the argument field

Question 6

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks are built as directed graphs that support Loop Tasks and conditional branches, which allow execution to return to an earlier task node. This is the supported mechanism for implementing backward transitions such as re-running a cleanup task after an analyst marks a phishing alert as a false positive.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 7

An XSOAR architect is planning automated reporting and stakeholder notification workflows. Which THREE methods are supported for distributing reports or alert summaries to stakeholders outside the SOC? (Choose THREE)

Accepted Answer

Automated ticketing integration tasks (e.g., ServiceNow or Jira) creating summary tickets for management review.. Option B is correct because XSOAR supports automated ticketing integration tasks, such as ServiceNow or Jira, which can create summary tickets that management reviews outside the SOC. Option C is correct because XSOAR can generate scheduled PDF or HTML reports and distribute them via email to external stakeholders. Option D is correct because XSOAR supports messaging integration tasks, such as Slack or Teams webhooks, to post executive summaries to designated channels. Option A is not supported because XSOAR does not broadcast audio alerts over FM radio frequencies. Option E is not supported because XSOAR does not print physical paper reports through interconnected dot-matrix receipt printers in a lobby.

Answer

Broadcasting audio alerts over the local FM radio frequency spectrum.

Answer

Printing physical paper reports via interconnected dot-matrix receipt printers in the lobby.

Question 8

An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must automatically extract all indicators from the incident, enrich them using multiple threat intelligence integrations, and then calculate a severity score based on the enrichment results. The engineer wants to ensure that the playbook can be reused across different phishing incident types without modification. Which approach best meets these requirements?

Accepted Answer

Develop a sub-playbook that performs indicator extraction, enrichment, and scoring, and call it from each phishing incident playbook.. The requirement is to reuse logic across different phishing incident types without modification. A sub-playbook encapsulates the extraction, enrichment, and scoring steps, and can be called from any parent playbook. This promotes modularity, simplifies updates, and ensures consistency. Other options either duplicate logic, create monolithic playbooks, or rely on scripts that are less maintainable and integrated.

Answer

Implement the logic as a custom automation script that is executed directly from each phishing incident playbook.

Answer

Use a single playbook with conditional tasks that branch based on the incident type, embedding all logic within that playbook.

Answer

Create a dedicated playbook for each phishing incident type, duplicating the enrichment and scoring logic in each.

Question 9

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Accepted Answer

Lookback period or First fetch parameter. The 'First fetch' (also called lookback period or 'fetch from') parameter controls how far back in time the integration retrieves indicators on its very first run, e.g., '7 days' or a specific date. Subsequent runs use the fetch interval to pull only new indicators since the last fetch.

Answer

Fetch Interval frequency

Answer

Maximum Indicator Limit

Answer

Indicator Expiration Timer

Question 10

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

Accepted Answer

Perform bulk actions such as tagging or updating reputation. Option B is correct because the Cortex XSOAR Threat Intel workspace supports bulk operations on indicators, allowing an administrator to select multiple indicators and apply actions such as adding tags or updating their reputation score in a single operation. Option C is correct because administrators can manually create new threat indicators directly in the Threat Intel workspace, specifying values, indicator types, and associated metadata rather than relying solely on ingested feeds. Option A is incorrect because firewall routing tables are configured on the firewall or network device itself, not within the XSOAR Threat Intel workspace. Option D is incorrect because core system database storage paths are managed at the operating system or deployment/infrastructure level, not through the Threat Intel indicator management interface. Option E is incorrect because the workspace does not provide a facility to author and execute arbitrary raw Linux shell scripts on remote feed servers; feed integration is handled through configured integrations and scripts within the platform's framework.

Answer

Configure firewall routing tables

Answer

Modify core system database storage paths

Answer

Write raw Linux shell scripts to execute on remote feed servers

Question 11

You are building a playbook that must run a series of tasks in parallel to save time. After all parallel branches complete, you need to consolidate their outputs and continue with a single task. Which task type should you use to wait for all parallel branches to finish before proceeding?

Accepted Answer

Join task. When parallel branches are used, a Join task acts as a synchronization point. It waits for all incoming branches to finish before allowing the playbook to continue. This ensures that all parallel tasks have completed and their outputs are available before the next task runs. Other task types do not provide this built-in waiting behavior for multiple branches.

Answer

Manual task

Answer

Conditional task

Answer

Standard task

Question 12

An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?

Accepted Answer

Configure the playbook tasks with parallel branching paths coming out of a single parent task.. To run three TIP enrichment tasks simultaneously, the playbook should use parallel branching — multiple tasks stemming from a single parent task, each executing independently and concurrently. This reduces total execution time because the tasks do not wait for each other. XSOAR supports parallel task execution when tasks share the same parent and have no dependency between them.

Answer

Use a scheduled job instead of a playbook to poll all three platforms periodically.

Answer

Place the three integration tasks sequentially in a straight vertical line.

Answer

Combine all three TIP calls into a single monolithic Python script inside one automation task.

Question 13

An XSOAR engineer is designing a SOC workflow that ingests thousands of alerts per hour from a cloud security posture management tool. Many alerts represent duplicate or recurring findings for the same asset within a short window. How should the engineer design the ingestion and processing flow to prevent incident fatigue?

Accepted Answer

Configure incident matching and deduplication rules in the integration instance settings or pre-processing rules to aggregate alerts into existing open incidents.. Incident type pre-processing rules or duplicate matching settings allow XSOAR to aggregate incoming alerts into existing open incidents rather than creating redundant standalone incidents.

Answer

Increase the fetch limit per interval to batch all alerts into a single massive payload.

Answer

Write a post-processing cron job that deletes duplicate incidents after they are closed.

Answer

Disable fetch incidents and rely solely on email notifications sent to the SOC team.

Question 14

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Accepted Answer

Source trust levels and weights. Option A (Source trust levels and weights) is correct because in Cortex XSOAR's indicator scoring, each feed or source is assigned a trust level/weight, and when feeds conflict, the weighted contributions of the higher-trust sources dominate the aggregated reputation calculation. Option C (Indicator scoring rules) is correct because the configured scoring rules (e.g., the reputation calculation logic and thresholds defined in the indicator type's scoring configuration) determine how the individual source scores are combined and normalized into the final reputation value. Option B is incorrect because browser screen resolution is a client display property and has no bearing on server-side reputation computation. Option D is incorrect because the count of open incidents in a War Room is an operational metric, not an input to indicator scoring. Option E is incorrect because the XSOAR server's physical geographic location does not affect how feed data is weighted or scored.

Answer

The resolution of the user's browser screen

Answer

The total number of open incidents in the War Room

Answer

The physical geographic location of the XSOAR server

Question 15

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

Accepted Answer

Use a context transformer or custom mapper in the task's Edit Outputs section to map 'IPAddress' to 'IP'.. XSOAR allows the use of built-in context transformers and custom mappers in playbook task settings to rename and restructure output keys.

Answer

Run a command to delete the context and recreate it using standard Python scripts.

Answer

Modify the global incident type schema to automatically alias IPAddress as IP.

Answer

Rename the integration instance name to match the desired output key.