XSOAR-Engineer Practice Exam 3 — 20 Questions

Question 1

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. For TAXII feed integrations in Cortex XSOAR, the integration instance has a 'Fetch indicators' toggle that must be enabled for the integration to poll the TAXII server and ingest indicators into the Threat Intel database. If it is disabled, the integration may test successfully but no indicators will populate.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 2

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Accepted Answer

The War Room. The War Room is the central interactive interface within an incident where analysts collaborate, run automation scripts, and maintain an audit trail.

Answer

The Job Scheduler

Answer

The Threat Intel page

Answer

The Incident Canvas

Question 3

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 4

An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) or Mean Time to Acknowledge (MTTA) provides the baseline efficiency metrics necessary to measure ROI and operational improvement after automation is deployed.

Answer

CPU utilization of the Demisto engine

Answer

Total number of active API integrations

Answer

Total number of ingested log sources

Question 5

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

Accepted Answer

XSOAR Dashboards and Reports with built-in widget templates for metrics and automation ROI.. XSOAR Dashboards and Reports provide native widgets and reporting templates specifically designed to visualize SOC metrics, automation ROI, and incident statistics.

Answer

The user role permissions matrix table.

Answer

The integration instance health status indicator.

Answer

Linux system kernel logs viewable via SSH.

Question 6

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Accepted Answer

Engines communicate with the Cortex XSOAR server over HTTPS on port 443 by default.. Cortex XSOAR engines are remote execution components that connect to the server over HTTPS on port 443. They enable integration execution in remote network segments, providing local access to resources. They do not store the incident database and require server connectivity to function, so the true statements are about remote deployment and secure communication.

Answer

Engines store a copy of the Cortex XSOAR incident database for offline access.

Answer

Engines can only run Docker-based integrations and cannot execute scripts directly on the host.

Answer

Engines automatically synchronize playbooks and integrations from the server and can execute them without server connectivity.

Question 7

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Accepted Answer

The 'TAXII2 Server' integration, which exposes a TAXII endpoint for consumers to pull indicators.. Sharing indicators outward is accomplished with the TAXII2 Server integration, which exposes a pull endpoint for external consumers, and with the Export Indicators command, which writes indicators to STIX, CSV, or JSON files for downstream systems. Both are supported export capabilities. The Get, Add, and Delete Indicators commands operate inward or on lifecycle management and do not deliver indicator data to external systems, so they do not meet the sharing requirement.

Answer

The 'Add Indicators' command, which inserts new indicators into the database from external sources.

Answer

The 'Delete Indicators' command, which removes indicators after they are shared.

Answer

The 'Get Indicators' command, which retrieves indicators from the database for review.

Question 8

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. In Cortex XSOAR, PDF reports containing aggregated metrics such as incident closure rates are generated from the Dashboards section, where the Reports tab lets analysts schedule or run on-demand reports based on widgets and saved queries. This is the built-in reporting surface designed for management-level summaries.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 9

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget performance in XSOAR dashboards is dominated by the underlying Elasticsearch query — its time range, filter specificity, and aggregation complexity. Narrowing the time range reduces the number of indices and documents scanned, and tightening filters lets Elasticsearch use indexed fields instead of full scans. This directly reduces query latency and dashboard render time without altering the widget's purpose.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 10

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. In Cortex XSOAR, incident layouts are configured under Settings > Customization > Layouts, where administrators can define which fields appear in the Incident Info section, their order, and their visibility. This is the central location for customizing how incident details are displayed for different incident types, including phishing. Changes made here apply to all incidents of the associated type.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration

Question 11

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role in Cortex XSOAR holds full administrative privileges across the entire platform, including user management, system settings, integrations, and content. It is the highest-privilege built-in role and is the only one that can modify global configuration and manage other users. This makes it the correct answer for a question about full platform-wide administrative control.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 12

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Accepted Answer

To package related integrations, playbooks, scripts, and dashboards into a single installable unit. A Cortex XSOAR Content Pack is a versioned, installable bundle that packages related integrations, playbooks, scripts, dashboards, incident types, fields, and layouts into a single unit. It enables one-click installation and dependency management from the Marketplace. This is the primary mechanism for distributing and deploying XSOAR content.

Answer

To compile raw source code into executable binary binaries

Answer

To manage Docker container images for offline deployment

Answer

To store encrypted user passwords and API keys securely

Question 13

An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?

Accepted Answer

Process items in efficient batches and utilize native XSOAR demistomock/demisto execution patterns without infinite loops.. Python scripts in XSOAR should execute efficiently, handle pagination or batching, and avoid blocking operations that consume excessive engine resources.

Answer

Write all intermediate data to local hard disk files instead of the XSOAR context.

Answer

Use an infinite 'while True' loop with zero sleep time to poll the API continuously.

Answer

Execute OS-level shell commands using 'subprocess' to bypass XSOAR API restrictions.

Question 14

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Accepted Answer

Incident type playbook with an initial 'addWarRoomEntry' task. Because the link must appear automatically inside each new Phishing incident's War Room, the mechanism has to write a War Room entry during incident creation. Attaching a playbook to the incident type and including a task that calls addWarRoomEntry accomplishes exactly that, runs without analyst intervention, and keeps the runbook link consistent across every Phishing incident.

Answer

Incident field 'Details' populated by a classification mapping

Answer

Incident type layout with a War Room entry template

Answer

Custom dashboard widget filtered on incident type

Question 15

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Accepted Answer

Typing the remark into the War Room input box and pressing Enter to post a note. Posting free text in the War Room input box creates an analyst-attributed, timestamped note in the shared incident conversation, which is immediately visible to the whole team. It requires no command execution and preserves the analyst's rationale alongside the rest of the incident timeline, making it the appropriate action for this scenario.

Answer

Editing the incident's Details field from the incident summary panel

Answer

Adding a tag to the incident from the incident header

Answer

Running the '!setIncident' command with a custom field for the remark

Question 16

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 17

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Option B is correct because Cortex XSOAR incident layouts support custom tabs, which let administrators group related fields into logical sections such as Triage or Containment, reducing scrolling and making it faster for analysts to find and enter the data relevant to each phase of an investigation. Option D is correct because Markdown fields are a supported layout element that renders formatted text, so administrators can embed analyst instructions, response checklists, or contextual details directly in the incident form to guide data entry and standardize workflows. The remaining options do not belong: Active Directory domain controller synchronization schedules (A) are configured through integrations and jobs rather than incident layouts, kernel-level memory dump inspectors (C) are forensic tooling outside the layout editor, and embedded firewall policy modification wizards (E) are not a Cortex XSOAR layout component.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 18

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task in Cortex XSOAR is designed to pause the playbook and present instructions or a form to a human analyst for manual review or decision. This is ideal for phishing email review where an analyst must inspect the email and determine if it is malicious. Data Collection tasks gather data, Sub-playbooks run other playbooks, and Automation tasks execute scripts without human intervention.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 19

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. When Cortex XSOAR exports indicators to an external TAXII server, the STIX/TAXII server configuration includes mapping rules that determine which indicator properties are serialized into STIX objects. If custom fields are missing on the recipient side, the outgoing mapping is the first place to verify that those fields are included in the STIX pattern and object properties. The other options relate to unrelated subsystems (proxy, layouts, Syslog parsing) that do not affect TAXII export content.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 20

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.