XSOAR-Engineer Practice Exam 2 — 20 Questions

Question 1

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. Dashboards can be shared with specific roles or users via dashboard sharing settings.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 2

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Accepted Answer

demisto-ctl backup. The demisto-ctl script includes built-in backup routines to safely export the system state and database.

Answer

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Answer

pg_dump demisto > backup.sql

Answer

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Question 3

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role has comprehensive, unrestricted access to all settings, users, and configurations in Cortex XSOAR.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 4

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. XSOAR supports various widget types including Pie, Bar, Line, and Number/Counter widgets.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 5

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Accepted Answer

Tabs. Layouts can include custom fields, tabs, widgets, and sections to structure the incident view.

Answer

Kernel Modules

Answer

Firmware ROM flashing tools

Question 6

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Dashboards consist of customizable widgets and layout containers.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 7

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Accepted Answer

Active. Standard incident statuses in XSOAR include Pending, Active, Closed, and to some extent custom or built-in states like Assigned. Specifically, Active and Closed are core built-in statuses.

Answer

Archived

Answer

Quarantined

Answer

Locked

Question 8

Which TWO actions can an analyst perform within the Incident War Room?

Accepted Answer

Add analyst notes and comments. Analysts can execute integration commands and post notes/comments in the War Room.

Answer

Provision new cloud virtual machines

Answer

Configure physical firewall port speeds

Answer

Update XSOAR server SSL certificates

Question 9

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Administrators can configure custom tabs to organize fields logically and add custom Markdown fields or HTML sections to display instructions or contextual notes.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 10

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

Accepted Answer

/var/log/demisto/demisto.log. Server runtime logs are typically directed to the system journal via systemd or stored in standard log paths like /var/log/demisto/demisto.log.

Answer

/var/log/postgresql/postgresql.log

Answer

/var/log/messages

Answer

/var/log/nginx/access.log

Question 11

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Accepted Answer

Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.. Air-gapped installations require pre-downloading or embedding the required Python wheels or using a local PyPI mirror configured via Cortex XSOAR configuration settings.

Answer

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Answer

Configure the server to tunnel through an unauthenticated proxy.

Answer

Run 'demisto-sdk download-dependencies' from the CLI.

Question 12

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. When upgrading a high-availability Cortex XSOAR environment, the primary server must be updated first, followed by secondary servers, and finally engines.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 13

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Images. Docker image details and container management are located in Settings > Integrations > Docker Images.

Answer

Dashboards > Container Health

Answer

Incidents > Management > Containers

Answer

Settings > About > System Information

Question 14

What is the primary purpose of deploying a Cortex XSOAR Engine?

Accepted Answer

To execute integrations and playbooks in isolated network segments and reduce server load. Cortex XSOAR engines allow the platform to execute integrations and playbooks within isolated network segments (such as DMZs or internal subnets) and offload processing from the main server.

Answer

To act as a primary database replica for high availability

Answer

To handle user authentication and single sign-on (SSO) requests

Answer

To store long-term incident archives for compliance reporting

Question 15

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Registry Configuration. Private Docker registry credentials are configured in Settings > Integrations > Servers and Services or via specific Docker daemon / server configuration properties depending on the deployment architecture.

Answer

Via the demisto-sdk registry-login command

Answer

In the individual integration instance settings under API Key

Answer

Inside the demisto.conf configuration file on the Linux host file system

Question 16

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Accepted Answer

Settings > About in the Cortex XSOAR Web UI. The server version can be verified via the Web UI under Settings > About and via the server command line using demisto-ctl version or querying server status.

Answer

Settings > Integrations > Server Version

Answer

Checking the Apache HTTP server header response

Answer

The server file system path /var/lib/demisto/VERSION

Question 17

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Custom content bundles are imported via Settings > Import / Export > Import in the Cortex XSOAR web interface.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 18

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Accepted Answer

API Keys generated within user profile settings. Cortex XSOAR API authentication supports API Keys generated by users and standard user credentials (username/password) to obtain session tokens.

Answer

OAuth 2.0 client credentials grant type natively configured without user context

Answer

Kerberos ticket-granting service tickets

Answer

Public key SSH key pairs

Question 19

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. High availability and disaster recovery best practices include deploying an external replicated PostgreSQL database, utilizing active-active server clusters with a load balancer, and scheduling automated offsite backups.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 20

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. Playbook task conditions evaluate context paths and expressions to determine whether the task should execute or be skipped.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident