XSOAR-Engineer Practice Test 2 — 10 Questions

Question 1

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 2

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

Accepted Answer

Define script arguments in the script settings and access them via demisto.args() in Python.. XSOAR automation scripts receive runtime parameters through script arguments, which are declared in the script's settings (YAML/metadata) and retrieved inside Python via demisto.args(). This allows administrators to configure values like thresholds per-task or per-playbook without editing source code. It is the standard, supported pattern for parameterizing automation.

Answer

Hardcode the threshold value directly as a global variable in every script file.

Answer

Write the value to the server's /etc/passwd configuration file.

Answer

Store the threshold inside a browser cookie on the analyst's machine.

Question 3

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Accepted Answer

Type the note in the War Room text box and use Markdown table syntax. The War Room note editor supports Markdown, which includes table syntax. By typing the note using Markdown table syntax, the analyst can create a formatted table that renders in the War Room, making the indicators easily readable. This is the most direct and standard method for adding formatted notes.

Answer

Use the 'Add Note' button and select the 'Table' option from the formatting toolbar

Answer

Attach a CSV file containing the indicators

Answer

Create a dashboard widget with the indicators and link it in the note

Question 4

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Accepted Answer

The Cortex XSOAR server. The Cortex XSOAR server is the central component that distributes incidents and tasks to engines. It manages incident state, playbook execution, and engine communication. Load balancers, message queues, and engine hierarchy do not play a role in task distribution.

Answer

The load balancer

Answer

The message queue service

Answer

The engine that was installed first

Question 5

An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?

Accepted Answer

Use the ${incident.id} and ${incident.severity} placeholders in the Slack message text.. The ${incident.id} and ${incident.severity} placeholders allow the playbook to dynamically insert the incident's ID and severity into the Slack message. This ensures each notification contains the relevant details for that specific incident, enabling effective communication without manual intervention.

Answer

Use a script task to retrieve incident details and store them in the context, then reference the context in the Slack message.

Answer

Configure the Slack integration to automatically append incident details to all messages.

Answer

Create a custom incident field that concatenates the ID and severity, then use that field in the Slack message.

Question 6

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Accepted Answer

Configure the engine to connect outbound to the server on port 443 using the engine key.. Engines connect outbound to the XSOAR server on the configured port, authenticating with an engine key. This allows deployment in restricted networks where only outbound TCP 443 is permitted. The server does not initiate connections to the engine, so no inbound rules are needed. Other options either misstate the communication direction or propose unsupported mechanisms.

Answer

Deploy the engine as a Docker container on the XSOAR server and use the loopback interface.

Answer

Set the engine to use a reverse tunnel over HTTPS to the server.

Answer

Open inbound port 443 on the firewall to allow the server to push tasks to the engine.

Question 7

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 8

An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?

Accepted Answer

Create a sub-playbook containing the tasks and call it from the parent playbooks.. Sub-playbooks are the native reuse mechanism in Cortex XSOAR. They allow a set of tasks to be defined once and called from multiple parent playbooks, ensuring consistency and simplifying updates. The other options either duplicate logic, create disconnected copies, or rely on unsupported custom scripting, none of which meet the efficiency requirement.

Answer

Export the tasks as a playbook and import them into each playbook.

Answer

Use a script to dynamically generate the tasks at runtime.

Answer

Copy and paste the tasks into each playbook manually.

Question 9

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

Accepted Answer

Prompt Task. A Prompt Task in Cortex XSOAR is designed to pause playbook execution and present a question or decision to an analyst, allowing them to review indicators and choose to block or ignore. This task type is specifically built for human-in-the-loop interactions, ensuring analyst input before proceeding. It supports customizable prompts and response options.

Answer

Loop Task

Answer

Data Enrichment Task

Answer

Command Task

Question 10

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Current reputation and score. Option C is correct because the Indicator Details view in Cortex XSOAR prominently displays the indicator's current reputation (e.g., Good, Suspicious, Bad, Unknown) along with its calculated score, which reflects the aggregated threat intelligence verdict for that IOC. Option D is correct because the Indicator Details view lists the contributing feed sources (such as threat intel feeds and integrations) that supplied or enriched the indicator, allowing analysts to trace provenance and understand which sources influenced the reputation. Options A and B are incorrect because XSOAR does not expose administrator OS login passwords or the XSOAR server's raw BIOS serial numbers within an indicator record; those are unrelated to threat intelligence data. Option E is incorrect because physical GPS coordinates of a threat actor are not a standard field shown in an Indicator Details view, as indicators are technical artifacts (IPs, hashes, domains) rather than geolocation profiles of actors.

Answer

Administrator operating system login passwords

Answer

Raw BIOS serial numbers of the XSOAR server

Answer

Physical GPS coordinates of the threat actor