XSOAR-Engineer Practice Exam 2 — 20 Questions

Question 1

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. In Cortex XSOAR, when configuring a data collection task, the user's response is mapped to an incident field via the task's 'Assign to Incident Field' configuration setting. This setting explicitly binds the response to a chosen incident field, making it available for downstream playbook logic and incident context. Other tabs handle inputs, scripts, or display, not incident field assignment.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 2

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Accepted Answer

Identifying correct JSONPath expressions for indicator fields. Option D is correct because a non-standard JSON threat feed has no predefined parser, so you must determine the exact JSONPath expressions (e.g., $.data[].attributes.value) that locate each indicator field such as IP, domain, or hash within the nested JSON structure. Option E is correct because once values are extracted, they must be mapped to the standard XSOAR indicator schema attributes (e.g., ip, domain, filehash, or the relevant indicator type fields) so the platform can normalize, deduplicate, and enrich them correctly. Option A is incorrect because custom C++ kernel modules are unnecessary and inappropriate for parsing JSON feed data in XSOAR. Option B is incorrect because modifying the XSOAR source code repository is not required and would break supportability; custom mapping is done through configuration and integration code, not core source edits. Option C is incorrect because hardware load balancers address traffic distribution and availability, not indicator field extraction or schema mapping.

Answer

Writing custom C++ kernel modules for memory parsing

Answer

Modifying the XSOAR source code repository

Answer

Configuring hardware load balancers for the feed server

Question 3

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. Cortex XSOAR automatically normalizes and merges indicator entries based on type-specific normalization rules. For example, domains are lowercased, IP addresses are canonicalized, and hashes are standardized. This deduplication ensures that the same indicator from different feeds is represented as a single record, with aggregated data and reputation.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 4

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

Accepted Answer

Set the chart type to Bar and group the data by the appropriate incident field representing the source.. When creating a custom chart widget in XSOAR, the analyst specifies the chart type (e.g., Bar) and groups the results by a specific incident field (such as 'brand' or source integration).

Answer

Configure a War Room script automation that injects HTML directly into the server header.

Answer

Create a dynamic playbook task that exports PNG screenshots to the dashboard folder.

Answer

Enable raw syslog streaming to an external SIEM for visualization.

Question 5

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

Accepted Answer

Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.. By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Answer

Sub-playbooks share the exact same global context without any isolation or scoping.

Answer

All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.

Answer

Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.

Question 6

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Accepted Answer

Navigate to Threat Intel > Indicators > New Indicator.. Indicators can be created manually directly from the Threat Intel workspace using the 'New Indicator' button.

Answer

Modify the server configuration file via SSH.

Answer

Create a dummy incident and run a War Room command.

Answer

Import a full STIX 2.1 bundle via API.

Question 7

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Option B (Widgets) is correct because a standard Cortex XSOAR dashboard is composed of configurable widgets that display security metrics, incident counts, SLA status, and other operational data pulled from the Cortex XSOAR data model. Option E (Dashboard title) is correct because each dashboard in Cortex XSOAR has a title/name that identifies it in the dashboard selector and appears at the top of the dashboard view. The unmarked options do not belong: kernel panic crash dumps (A) are OS-level diagnostics unrelated to the Cortex XSOAR web UI, raw Docker container logs (C) are infrastructure logs accessed outside the dashboard, and BIOS configuration utilities (D) are firmware-level tools with no role in the Cortex XSOAR dashboard.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 8

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Accepted Answer

Reference the context path using the ${Email.Body} syntax in the argument field. Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Answer

Hardcode the expected string value directly into the task argument field

Answer

Store the value in a server-wide environment variable and call os.environ

Answer

Write a custom integration instance configuration for that specific email

Question 9

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Accepted Answer

Toggle the 'Fetch indicators' or active status switch off on the integration instance.. Cortex XSOAR integration instances have a 'Fetch indicators' toggle (and an active/enabled state) that stops ingestion without deleting the instance or its configuration. This preserves all feed settings, credentials, and mappings so the feed can be re-enabled later. Deleting the instance or its indicators is destructive and unnecessary for a temporary pause.

Answer

Delete the integration instance entirely.

Answer

Delete all indicators associated with the feed.

Answer

Change the server license to basic mode.

Question 10

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

Accepted Answer

Tenant management features (or RBAC combined with incident query filters and role-based permissions).. RBAC roles combined with tenant accounts or query filters ensure that users only see incidents and data relevant to their specific department or tenant context.

Answer

Modifying the default CSS stylesheet to hide sensitive UI elements.

Answer

Configuring distinct API keys for every individual playbook task.

Answer

Running multiple separate Linux virtual machines on the same physical server without XSOAR tenant settings.

Question 11

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Accepted Answer

Assign the incident to the shift lead using the Owner field. Ownership transfer in Cortex XSOAR is performed through the Owner field on the incident. Setting the Owner to the shift lead makes that analyst the acknowledged owner, sends an in-app notification, and records the change in the incident audit trail, satisfying the handoff requirement for the malware containment incident.

Answer

Add the shift lead as a collaborator on the incident

Answer

Move the incident to a different investigation queue

Answer

Mention the shift lead with @ in a War Room note

Question 12

An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?

Accepted Answer

A conditional task that checks indicator reputation or confidence scores before executing the block command.. A conditional task evaluating indicator reputation or confidence scores prevents low-confidence indicators from reaching downstream blocking actions.

Answer

By increasing the server thread pool size.

Answer

Within the user account management settings.

Answer

By modifying the default system clock synchronization settings.

Question 13

Which TWO pieces of information are displayed prominently in the incident header by default?

Accepted Answer

Incident ID. The incident header typically displays key metadata such as Incident Name/ID, Status, Owner, and Severity.

Answer

Active database connection pool size

Answer

CPU temperature of the XSOAR server

Answer

SSL certificate expiration date of the remote mail server

Question 14

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 15

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Option B is correct because Cortex XSOAR playbooks execute automated workflows that handle repetitive SOC tasks such as enrichment, triage, and containment actions, which directly reduces Mean Time to Respond (MTTR). Option D is correct because playbooks encode a defined, repeatable sequence of steps so that every analyst handles the same incident type consistently, standardizing incident response across the team. Option A is incorrect because playbooks do not permanently disable all external network connections during any alert; containment actions are typically scoped, conditional, and reversible. Option C is incorrect because XSOAR is designed to augment analysts, not eliminate human oversight; human-in-the-loop approvals and analyst judgment remain essential. Option E is incorrect because XSOAR does not replace SIEM databases with flat text files; it integrates with SIEMs and other tools rather than substituting their data stores.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 16

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 17

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Accepted Answer

The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.. Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Answer

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Answer

The user's email address contains uppercase characters.

Answer

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Question 18

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Accepted Answer

Related incidents list. Option C (Related incidents list) is correct because Cortex XSOAR correlates indicators from threat feeds with existing incidents, letting analysts pivot from an indicator to all incidents that reference it and quickly assess prior investigations and impact. Option D (Indicator relationship graphs and mappings) is correct because XSOAR builds relationships between indicators (for example, domain-to-IP, file-to-C2) and renders them as graphs, and its indicator type mappings normalize feed data so analysts can visualize and traverse these connections during an investigation. The other options do not belong: A (HTML email template designer) is a phishing/notification formatting feature unrelated to indicator investigation, B (Global LDAP user directory sync) only provisions users and roles for authentication, and E (Automatic hypervisor backup scheduling) is not a Cortex XSOAR capability at all.

Answer

HTML email template designer

Answer

Global LDAP user directory sync

Answer

Automatic hypervisor backup scheduling

Question 19

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. In a playbook Conditional Task, option B is correct because you can configure custom branch labels that name each possible outcome, allowing subsequent tasks to be routed based on which branch is taken. Option C is correct because the core of a Conditional Task is defining conditional expressions that evaluate incident fields or context data to determine which branch executes. Option E is correct because a Conditional Task supports a default (else) fallback path that runs when none of the specified conditions evaluate to true. Option A is not a playbook Conditional Task setting; compiling Python source into bytecode is a Python runtime/build operation, not a playbook configuration. Option D is not a Conditional Task setting either, since directly modifying firewall ACLs without commands is not a supported configuration mechanism in a Conditional Task.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 20

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens