XSOAR-Engineer Practice Test 4 — 25 Questions

Question 1

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Indicator Type Name. Custom indicator types require a unique name and matching regular expression or validation pattern to identify the indicator format.

Answer

Active Directory SSL certificate

Answer

Syslog facility level

Answer

Incident SLA escalation timer

Question 2

A security architect is designing an incident classification taxonomy in XSOAR for a multi-tenant MSSP environment. Different clients require different playbook execution paths based on their subscription tier. Where should the architect configure this logic?

Accepted Answer

In Incident Types and Classifiers, mapping incoming tags to specific incident types and default playbooks.. Classifiers and incident type mapping rules evaluate incoming event fields (such as tenant ID or client tag) to route incidents to the correct Incident Type and associated default playbook.

Answer

Inside the server configuration (Settings > About > Troubleshooting) using global JSON overrides.

Answer

Within the integration instance configuration parameter list as static environment variables.

Answer

By hardcoding tenant checks into every individual task script using Python sys.argv.

Question 3

An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?

Accepted Answer

Database replication (PostgreSQL) and Elasticsearch synchronization across all engine/server nodes.. XSOAR utilizes an active-active or active-passive architecture where the underlying PostgreSQL database and Elasticsearch stores must be synchronized or clustered.

Answer

Duplicating integration API keys in plain text within the system welcome banner.

Answer

Synchronizing browser cookies across all analyst workstations.

Answer

Manual copying of log files via FTP every week.

Question 4

An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?

Accepted Answer

Write outputs to standardized XSOAR context keys (such as Account or Endpoint) so subsequent tasks can reference unified data.. XSOAR context paths allow storing and referencing structured JSON data under unified keys (e.g., Account.Username), enabling correlation across multiple integration outputs.

Answer

Save each source's data into a separate hardcoded local text file on the Linux host.

Answer

Manually email raw log dumps to all SOC analysts.

Answer

Delete previous task context before running the next integration.

Question 5

An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?

Accepted Answer

Sanitize or mask sensitive data within the automation script before writing outputs to the XSOAR context.. Engineers should avoid writing raw PII to the incident context, instead masking the data, storing only non-sensitive reference hashes, or referencing external secure vaults.

Answer

Store the PII in plain text inside incident custom fields and restrict access using incident layout roles.

Answer

Rely on the browser's local cache to encrypt the sensitive fields on the analyst's workstation.

Answer

Disable the XSOAR server audit log entirely.

Question 6

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

Accepted Answer

Define script arguments in the script settings and access them via demisto.args() in Python.. Script arguments defined in the script metadata allow administrators to pass dynamic values from the playbook task configuration into the Python script.

Answer

Hardcode the threshold value directly as a global variable in every script file.

Answer

Write the value to the server's /etc/passwd configuration file.

Answer

Store the threshold inside a browser cookie on the analyst's machine.

Question 7

An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)

Accepted Answer

demisto.args() for retrieving argument values passed into the script or command.. demisto.results() and demisto.args() are foundational API methods used in XSOAR Python scripts to return outputs and retrieve input arguments.

Answer

os.format_disk() for repartitioning the host server's root drive.

Answer

demisto.shutdown_server() to permanently kill the production database.

Answer

sys.reboot_engine() for restarting physical network switches.

Question 8

An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?

Accepted Answer

Configure the playbook tasks with parallel branching paths coming out of a single parent task.. Parallel task execution allows independent enrichment integrations to run concurrently without waiting for each other to finish sequentially.

Answer

Use a scheduled job instead of a playbook to poll all three platforms periodically.

Answer

Place the three integration tasks sequentially in a straight vertical line.

Answer

Combine all three TIP calls into a single monolithic Python script inside one automation task.

Question 9

When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)

Accepted Answer

The steps are well-defined, repeatable, and follow a standard operating procedure.. Process repeatability and high execution volume make tasks ideal for automation, whereas highly ambiguous or one-off tasks are poor candidates.

Answer

The task is performed exactly once every five years.

Answer

The process requires constant creative intuition and subjective executive judgment.

Answer

The underlying systems have completely undocumented and unsupported proprietary APIs.

Question 10

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

Accepted Answer

Pass password parameters to the file extraction task, or design a prompt for an analyst to supply known container passwords.. File extraction commands in XSOAR (such as Unzip or extract files) support passing password parameters, which can be dynamically retrieved or prompted from analysts if necessary.

Answer

Convert all archive files into plain text PDF documents automatically.

Answer

Restart the XSOAR server container to clear encryption keys.

Answer

Instantly delete any file ending in a .zip extension without inspection.

Question 11

When planning a new automation use case, an XSOAR analyst needs to reference documentation and example code for built-in automation scripts and commands. Where within the XSOAR UI can this reference library be accessed directly?

Accepted Answer

In the Automation library (Playbooks > Scripts or Settings > Integrations > Automation).. The Automation section (or Playground / CLI help) provides access to the comprehensive command library and script documentation.

Answer

Within the incident list view column selector.

Answer

In the user profile settings under password reset.

Answer

Inside the dashboard widget editor.

Question 12

An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?

Accepted Answer

Using demisto.getLastRun() and demisto.setLastRun() to persist cursor timestamps between execution cycles.. Integrations in XSOAR store pagination markers and last-run timestamps using `demisto.getLastRun()` and `demisto.setLastRun()`.

Answer

Writing the cursor value to a global environment variable in the operating system shell.

Answer

Storing the cursor in the browser local storage of the administrator who configured the instance.

Answer

Hardcoding the timestamp directly into the integration YAML source code.

Question 13

When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)

Accepted Answer

Implement error handling and alternative paths (such as timeout or failure branches) for critical integration tasks.. Modular sub-playbooks, clear task naming, and structured error handling ensure playbooks are maintainable and easy to troubleshoot.

Answer

Hardcode all API authentication tokens directly into every playbook task description.

Answer

Combine all enrichment, containment, and reporting steps into a single massive, unbranched task.

Question 14

An XSOAR architect is planning automated reporting and stakeholder notification workflows. Which THREE methods are supported for distributing reports or alert summaries to stakeholders outside the SOC? (Choose THREE)

Accepted Answer

Automated ticketing integration tasks (e.g., ServiceNow or Jira) creating summary tickets for management review.. Email notification tasks, scheduled report generation, and SIEM/ticketing integrations are standard methods for distributing summaries to stakeholders.

Answer

Broadcasting audio alerts over the local FM radio frequency spectrum.

Answer

Printing physical paper reports via interconnected dot-matrix receipt printers in the lobby.

Question 15

When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)

Accepted Answer

Incident Fields and Layouts that structure and display data attributes in the UI.. Incident Types and Incident Fields/Layouts form the foundational data structure used to categorize and present incident details in XSOAR.

Answer

Physical server rack elevation diagrams.

Answer

Browser extension plugin manifests.

Answer

Linux kernel module compilation parameters.

Question 16

An XSOAR automation engineer is planning incident classification and routing for incoming multi-source alerts. Which THREE elements must be considered when designing the mapping between incoming raw event fields and XSOAR incident fields? (Choose THREE)

Accepted Answer

Mapping raw alert JSON keys to corresponding XSOAR incident custom fields.. Field transformers, custom mapping rules, and matching raw payload attributes to custom incident fields are key considerations for incident routing and mapping.

Answer

Changing the BIOS serial number of the XSOAR host server.

Answer

Manually retyping every incoming log into a physical typewriter.

Question 17

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Accepted Answer

Share with specific user roles. Dashboards can be shared with specific roles or made public to all users.

Answer

Broadcast via Bluetooth pairing

Answer

Publish via public FTP server upload

Answer

Print via thermal receipt printer

Question 18

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Accepted Answer

systemctl restart demisto. Cortex XSOAR runs as a systemd service named 'demisto' on RHEL systems.

Answer

demisto-ctl restart

Answer

systemctl restart cortex-xsoar

Answer

service xsoar-server restart

Question 19

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

Accepted Answer

Uploaded via Settings > About > Troubleshooting > Server Certificate (Custom Certificate). Custom CA certificates must be uploaded to Cortex XSOAR via Settings > About > Troubleshooting > Server Certificate, which injects them into the trust store used by integration containers.

Answer

Configured inside the PostgreSQL database connection string

Answer

In the host operating system's /etc/pki/ca-trust/source/anchors/ directory only

Answer

Inside each individual integration's Python script code

Question 20

What is the purpose of the Cortex XSOAR Health Check integration?

Accepted Answer

To monitor system resources, database connectivity, and platform operational metrics. The Health Check integration monitors the operational status of the XSOAR server, database connectivity, license expiration, and integration health.

Answer

To test outbound internet connectivity for Docker Hub

Answer

To scan endpoints for malware and vulnerabilities

Answer

To validate syntax in custom Python automation scripts