XSOAR-Engineer Practice Test 2 — 25 Questions

Question 1

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Accepted Answer

Navigate to Threat Intel > Indicators > New Indicator.. Indicators can be created manually directly from the Threat Intel workspace using the 'New Indicator' button.

Answer

Modify the server configuration file via SSH.

Answer

Create a dummy incident and run a War Room command.

Answer

Import a full STIX 2.1 bundle via API.

Question 2

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Option B (Widgets) is correct because a standard Cortex XSOAR dashboard is composed of configurable widgets that display security metrics, incident counts, SLA status, and other operational data pulled from the Cortex XSOAR data model. Option E (Dashboard title) is correct because each dashboard in Cortex XSOAR has a title/name that identifies it in the dashboard selector and appears at the top of the dashboard view. The unmarked options do not belong: kernel panic crash dumps (A) are OS-level diagnostics unrelated to the Cortex XSOAR web UI, raw Docker container logs (C) are infrastructure logs accessed outside the dashboard, and BIOS configuration utilities (D) are firmware-level tools with no role in the Cortex XSOAR dashboard.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 3

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Accepted Answer

Reference the context path using the ${Email.Body} syntax in the argument field. Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Answer

Hardcode the expected string value directly into the task argument field

Answer

Store the value in a server-wide environment variable and call os.environ

Answer

Write a custom integration instance configuration for that specific email

Question 4

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Accepted Answer

Toggle the 'Fetch indicators' or active status switch off on the integration instance.. Cortex XSOAR integration instances have a 'Fetch indicators' toggle (and an active/enabled state) that stops ingestion without deleting the instance or its configuration. This preserves all feed settings, credentials, and mappings so the feed can be re-enabled later. Deleting the instance or its indicators is destructive and unnecessary for a temporary pause.

Answer

Delete the integration instance entirely.

Answer

Delete all indicators associated with the feed.

Answer

Change the server license to basic mode.

Question 5

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

Accepted Answer

Tenant management features (or RBAC combined with incident query filters and role-based permissions).. RBAC roles combined with tenant accounts or query filters ensure that users only see incidents and data relevant to their specific department or tenant context.

Answer

Modifying the default CSS stylesheet to hide sensitive UI elements.

Answer

Configuring distinct API keys for every individual playbook task.

Answer

Running multiple separate Linux virtual machines on the same physical server without XSOAR tenant settings.

Question 6

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Accepted Answer

Assign the incident to the shift lead using the Owner field. Ownership transfer in Cortex XSOAR is performed through the Owner field on the incident. Setting the Owner to the shift lead makes that analyst the acknowledged owner, sends an in-app notification, and records the change in the incident audit trail, satisfying the handoff requirement for the malware containment incident.

Answer

Add the shift lead as a collaborator on the incident

Answer

Move the incident to a different investigation queue

Answer

Mention the shift lead with @ in a War Room note

Question 7

An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?

Accepted Answer

A conditional task that checks indicator reputation or confidence scores before executing the block command.. A conditional task evaluating indicator reputation or confidence scores prevents low-confidence indicators from reaching downstream blocking actions.

Answer

By increasing the server thread pool size.

Answer

Within the user account management settings.

Answer

By modifying the default system clock synchronization settings.

Question 8

Which TWO pieces of information are displayed prominently in the incident header by default?

Accepted Answer

Incident ID. The incident header typically displays key metadata such as Incident Name/ID, Status, Owner, and Severity.

Answer

Active database connection pool size

Answer

CPU temperature of the XSOAR server

Answer

SSL certificate expiration date of the remote mail server

Question 9

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 10

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Option B is correct because Cortex XSOAR playbooks execute automated workflows that handle repetitive SOC tasks such as enrichment, triage, and containment actions, which directly reduces Mean Time to Respond (MTTR). Option D is correct because playbooks encode a defined, repeatable sequence of steps so that every analyst handles the same incident type consistently, standardizing incident response across the team. Option A is incorrect because playbooks do not permanently disable all external network connections during any alert; containment actions are typically scoped, conditional, and reversible. Option C is incorrect because XSOAR is designed to augment analysts, not eliminate human oversight; human-in-the-loop approvals and analyst judgment remain essential. Option E is incorrect because XSOAR does not replace SIEM databases with flat text files; it integrates with SIEMs and other tools rather than substituting their data stores.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 11

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 12

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Accepted Answer

The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.. Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Answer

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Answer

The user's email address contains uppercase characters.

Answer

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Question 13

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Accepted Answer

Related incidents list. Option C (Related incidents list) is correct because Cortex XSOAR correlates indicators from threat feeds with existing incidents, letting analysts pivot from an indicator to all incidents that reference it and quickly assess prior investigations and impact. Option D (Indicator relationship graphs and mappings) is correct because XSOAR builds relationships between indicators (for example, domain-to-IP, file-to-C2) and renders them as graphs, and its indicator type mappings normalize feed data so analysts can visualize and traverse these connections during an investigation. The other options do not belong: A (HTML email template designer) is a phishing/notification formatting feature unrelated to indicator investigation, B (Global LDAP user directory sync) only provisions users and roles for authentication, and E (Automatic hypervisor backup scheduling) is not a Cortex XSOAR capability at all.

Answer

HTML email template designer

Answer

Global LDAP user directory sync

Answer

Automatic hypervisor backup scheduling

Question 14

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. In a playbook Conditional Task, option B is correct because you can configure custom branch labels that name each possible outcome, allowing subsequent tasks to be routed based on which branch is taken. Option C is correct because the core of a Conditional Task is defining conditional expressions that evaluate incident fields or context data to determine which branch executes. Option E is correct because a Conditional Task supports a default (else) fallback path that runs when none of the specified conditions evaluate to true. Option A is not a playbook Conditional Task setting; compiling Python source into bytecode is a Python runtime/build operation, not a playbook configuration. Option D is not a Conditional Task setting either, since directly modifying firewall ACLs without commands is not a supported configuration mechanism in a Conditional Task.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 15

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens

Question 16

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. For TAXII feed integrations in Cortex XSOAR, the integration instance has a 'Fetch indicators' toggle that must be enabled for the integration to poll the TAXII server and ingest indicators into the Threat Intel database. If it is disabled, the integration may test successfully but no indicators will populate.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 17

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Accepted Answer

The War Room. The War Room is the central interactive interface within an incident where analysts collaborate, run automation scripts, and maintain an audit trail.

Answer

The Job Scheduler

Answer

The Threat Intel page

Answer

The Incident Canvas

Question 18

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 19

An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) or Mean Time to Acknowledge (MTTA) provides the baseline efficiency metrics necessary to measure ROI and operational improvement after automation is deployed.

Answer

CPU utilization of the Demisto engine

Answer

Total number of active API integrations

Answer

Total number of ingested log sources

Question 20

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

Accepted Answer

XSOAR Dashboards and Reports with built-in widget templates for metrics and automation ROI.. XSOAR Dashboards and Reports provide native widgets and reporting templates specifically designed to visualize SOC metrics, automation ROI, and incident statistics.

Answer

The user role permissions matrix table.

Answer

The integration instance health status indicator.

Answer

Linux system kernel logs viewable via SSH.