XSOAR-Engineer Practice Test 21 — 15 Questions

Question 1

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Accepted Answer

Clone out-of-the-box content pack playbooks before making custom modifications to prevent loss during updates.. Best practices include cloning content pack items before editing, utilizing descriptive naming conventions, and exporting playbooks in JSON format for source control.

Answer

Directly edit the production server's internal SQLite database files while playbooks are running.

Answer

Store plaintext administrator passwords inside playbook task description fields for easy reference.

Question 2

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

Accepted Answer

It passes the list as a comma-separated string or array to the script argument based on argument definitions.. XSOAR automatically flattens or serializes list context outputs into comma-separated strings or passes them as array structures depending on argument definitions when referenced in task inputs.

Answer

It throws a validation error unless wrapped in a string transformer.

Answer

It passes only the first item in the list and discards the rest.

Answer

It converts the list into a JSON object and stores it in a temporary file.

Question 3

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Accepted Answer

Excel (XLSX). Option B (Excel/XLSX) is correct because the Incident WorkArea natively exports incident data into XLSX spreadsheets, allowing analysts to filter, pivot, and share structured tabular data for external reporting. Option D (CSV) is correct because CSV is a native, plain-text delimited export format that preserves incident fields for ingestion into SIEMs, ticketing systems, or archival stores. Option E (PDF via Incident Report generation) is correct because the WorkArea can generate an Incident Report and render it as a PDF, which is the standard format for immutable, human-readable archival and external distribution. Option A (.HIV) does not belong because a Windows Registry hive is an OS registry artifact, not an incident data export format. Option C (.DMP) does not belong because a binary memory dump is a forensic memory capture, not a supported incident data export from the WorkArea.

Answer

Windows Registry hive file (.HIV)

Answer

Direct binary memory dump (.DMP)

Question 4

A Cortex XSOAR engineer configures a TAXII 2.1 feed integration and confirms the server connection succeeds, but the Threat Intel page shows no indicators. The collection browser returns STIX 2.1 objects with type 'indicator' and 'observed-data'. The engineer then runs the fetch command manually and sees objects returned in the raw response. Which configuration element most likely prevents the indicators from being created in the Threat Intel database?

Accepted Answer

The 'Fetch indicators' checkbox is not enabled, so fetched objects are retrieved but not written to the database.. The symptom is a successful connection and a manual fetch that returns raw STIX objects, yet no indicators exist. That combination points to a parameter that gates writing to the database rather than one that gates retrieval. The 'Fetch indicators' setting controls whether fetched objects are converted into indicators and stored, so leaving it disabled produces exactly this outcome.

Answer

The 'Indicator Type' mapping does not resolve the STIX pattern fields to a supported Cortex XSOAR indicator type.

Answer

The TAXII collection's 'First Fetch Time' is set to a future date, so no objects fall in the fetch window.

Answer

The feed's 'Indicator Reputation' parameter is set to 'None', so ingestion is skipped.

Question 5

An analyst is reviewing a closed phishing incident and wants to see, in the War Room, which playbook tasks executed and in what order, including the inputs and outputs of each task. Which War Room tab should the analyst use to review this structured, step-by-step record of the playbook run?

Accepted Answer

The War Room's Work Plan tab. The Work Plan tab is the War Room view purpose-built for inspecting a playbook's execution structure. It displays each task with its status, timestamps, and captured inputs and outputs, letting an analyst reconstruct exactly which steps ran and in what order. Manual collaboration tabs and evidence storage do not carry that execution metadata, so they cannot substitute for this structured record.

Answer

The War Room's Notes tab

Answer

The War Room's Evidence tab

Answer

The War Room's Chat tab

Question 6

An XSOAR engineer is planning a playbook for a new use case that must process incidents arriving from a third-party SIEM. The SIEM sends incidents with a severity value as a string ('low', 'medium', 'high') and the SOC wants the playbook to route incidents to different sub-playbooks based on that value, but also wants to be able to change the mapping later without editing the playbook. Which design approach best meets these requirements?

Accepted Answer

Create a lookup dataset (list) that maps severity strings to sub-playbook names, and use a playbook task that reads the dataset to determine which sub-playbook to execute.. The requirement is to route incidents based on severity while allowing the mapping to change without editing the playbook. A lookup dataset (list) externalizes the mapping, and a playbook task can read it at runtime to select the appropriate sub-playbook dynamically. Hardcoded conditional tasks or classifier-based mapping still embed the routing logic in the playbook, so they fail the maintainability requirement.

Answer

Configure the SIEM integration to send a numeric severity directly, and use a playbook task with a series of conditional branches for each severity level.

Answer

Create a custom incident field named 'routingseverity' and use a conditional task in the playbook that checks the raw severity string against hardcoded values.

Answer

Use a classifier to map the incoming severity string to a numeric severity field, then use a playbook task with a dynamic decision based on that field.

Question 7

A Cortex XSOAR engineer needs a recurring report that delivers a PDF summarizing incident metrics to an external distribution list every Monday at 08:00. The engineer creates a scheduled report and must now ensure the recipient addresses, format, and recurrence are all honored. Which configuration element in the scheduled report definition controls the recurring schedule?

Accepted Answer

The report's cron-style schedule setting. Recurrence in a scheduled report is governed by its cron-style schedule field, which encodes the exact days and times the report is generated and sent. The distribution list, output format, and dashboard template affect recipients, file type, and content respectively, but none of them controls timing. Configuring the schedule correctly is what yields a reliable Monday 08:00 delivery to the external list.

Answer

The report's output format selector

Answer

The report's dashboard template binding

Answer

The report's distribution list field

Question 8

A SOC is designing a new use case for XSOAR that must automatically enrich every newly created incident with data from an internal CMDB. The CMDB integration can only be queried by hostname, and the hostname is stored in a custom incident field named 'affectedhost'. The enrichment must run exactly once per incident and must not block the rest of the playbook if the CMDB is unreachable. Which XSOAR design element should the engineer use to meet these requirements?

Accepted Answer

A task in the playbook that calls the CMDB integration command with ${incident.affectedhost} as an argument, configured with 'continueonerror' set to true.. The requirement is a single, non-blocking CMDB lookup per incident using a custom field. A playbook task that invokes the integration command with the ${incident.affectedhost} placeholder and continueonerror enabled achieves this without stopping the playbook on failure. Classifiers, indicator extraction rules, and pre-processing rules operate earlier in the incident lifecycle and cannot perform live API enrichment, so they cannot meet the design goal.

Answer

An indicator extraction rule configured to query the CMDB for any hostname indicator in the incident.

Answer

An incident classifier rule that maps the CMDB response into the incident fields before the playbook starts.

Answer

A pre-processing rule that runs the CMDB command and writes the result into the incident before playbook execution.

Question 9

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

Accepted Answer

Use the Backup and Restore page in the Settings section of the Cortex XSOAR UI.. The Backup and Restore page in the Cortex XSOAR Settings provides a supported way to export a complete configuration snapshot, including playbooks, integrations, and system settings. This snapshot can be downloaded and used to restore the system if a content update introduces problems. Other methods either target development workflows or produce incomplete or inconsistent backups.

Answer

Copy the /usr/local/demisto directory to an external drive.

Answer

Run the demisto-sdk backup command on the server.

Answer

Execute the pg_dump utility against the PostgreSQL database.

Question 10

An XSOAR engineer is scoping a new use case that ingests alerts from a SIEM into XSOAR for automated triage. The SOC lead wants to know which native mechanism should be used to define how many alerts per minute XSOAR accepts and how the ingestion source is authenticated, without writing custom polling logic. Which XSOAR component should the engineer configure to meet this requirement?

Accepted Answer

An integration instance of the SIEM integration with a fetch query, first fetch timestamp, and maximum number of incidents per fetch configured on the instance.. The native way to ingest alerts from a SIEM into XSOAR is through an integration instance configured with a fetch query, first fetch time, and per-cycle incident limit. This handles authentication, scheduling, and volume control out of the box. Building a custom polling script or relying on classifiers/mappers alone fails to meet the requirement of limiting throughput and authenticating to the source without custom code.

Answer

A server configuration entry that sets the maximum incidents per tenant under Settings > Server Configuration.

Answer

A classifier and mapper attached to the SIEM incident type that transforms raw alerts into XSOAR incidents.

Answer

A custom Python automation script scheduled via a job that polls the SIEM REST API and calls demisto.createIncidents().

Question 11

A Cortex XSOAR administrator wants to provide analysts with a quick way to view all open incidents that are assigned to them and have a severity of 'High' or 'Critical'. Which built-in feature should the administrator configure?

Accepted Answer

Create a custom dashboard with a table widget filtered by assignee and severity.. A custom dashboard with a table widget is the most efficient built-in feature to provide a persistent, real-time view of incidents filtered by assignee and severity. Dashboards can be customized and shared, allowing analysts to quickly access the information without manual filtering. Scheduled reports and playbook notifications are not interactive or real-time, and manual filtering is not a configured solution.

Answer

Set up a playbook that triggers on incident creation and sends a notification to the assigned analyst.

Answer

Use the Incidents page and manually apply filters each time.

Answer

Configure a scheduled report that lists incidents with the specified filters and email it to analysts daily.

Question 12

A SOC team wants XSOAR to automatically create a case in their case management system whenever a high-severity incident is opened, and to close that case when the XSOAR incident is closed. The engineer is planning the use case and needs to identify the two lifecycle events that must be mapped. Which pair of XSOAR incident lifecycle events should the engineer plan for?

Accepted Answer

Incident creation and incident closure.. Automating case creation and closure in an external system requires mapping the XSOAR incident creation event to the case-open action and the incident closure event to the case-close action. Assignment, severity change, and SLA breach are intermediate signals that do not represent the start or end of the incident lifecycle, so they cannot synchronize the external case correctly.

Answer

Incident creation and incident assignment.

Answer

Incident severity change and incident closure.

Answer

Incident creation and incident SLA breach.

Question 13

An XSOAR engineer is designing a playbook that must decide whether to auto-remediate or escalate based on a risk score returned by an external scoring API. The API occasionally returns HTTP 500 errors, and the playbook must not silently proceed with a default branch when that happens. Which playbook design approach best satisfies this requirement?

Accepted Answer

Call the scoring integration task, then use a conditional task that checks both the task error state and the returned score before branching.. To prevent silent progression when an external API returns HTTP 500, the playbook must explicitly inspect the task error state in a conditional task before branching on the risk score. Continue-on-error, error-suppressing sub-playbooks, and retry loops alone all allow the flow to continue with invalid data. Only a conditional that considers both the error state and the returned value guarantees the playbook escalates or retries instead of auto-remediating on a failed call.

Answer

Set the integration task to continue on error and rely on the default branch to handle any unexpected condition.

Answer

Add a retry loop around the API task and let the task's built-in retry counter eventually resolve the failure without explicit branching.

Answer

Wrap the API call in a sub-playbook and configure the parent to ignore sub-playbook errors so the main flow is not interrupted.

Question 14

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

Accepted Answer

Back up the Cortex XSOAR database and configuration using the built-in backup mechanism or a supported snapshot.. Before upgrading a production Cortex XSOAR server, a verified backup of the database and configuration protects against data loss and enables rollback. Reviewing release notes and confirming a supported upgrade path prevents issues caused by skipping required intermediate versions. Deleting incidents, uninstalling content packs, or disabling all integrations are not prerequisites and can cause harm or operational gaps.

Answer

Delete all old incidents to reduce database size and speed up the upgrade process.

Answer

Disable all integration instances to stop inbound alert ingestion during the maintenance window.

Answer

Uninstall all content packs to prevent version conflicts during the upgrade.

Question 15

An XSOAR engineer is planning a use case that must deduplicate alerts arriving from a cloud workload protection platform before they become incidents, so that repeated alerts about the same resource within a short window are merged. Which TWO design elements should the engineer include in the plan? (Choose two.)

Accepted Answer

A deduplication rule that keys on a stable field such as the resource identifier and a time window.. Deduplicating repeated alerts requires a deduplication rule with a stable key and a time window, plus a pre-processing rule that routes matching alerts to the existing incident instead of creating a new one. Severity filtering, unique renaming, and payload copying do not consolidate duplicates, so they leave the SOC with multiple incidents for the same resource.

Answer

A field mapping that copies the raw alert payload into a custom incident field for later analysis.

Answer

A playbook that renames each incident to include a UUID so records remain distinct.

Answer

A pre-processing rule that drops every alert whose severity is below a fixed threshold.