XSOAR-Engineer Practice Test 4 — 25 Questions

Question 1

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Settings > Import / Export > Import. This is the built-in Cortex XSOAR UI feature specifically designed to import a previously exported content bundle (a .zip file containing playbooks, scripts, layouts, and other custom content) from one environment into another. It handles dependency resolution and version compatibility, making it the standard method for migrating custom content between development and production instances.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 2

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. In Cortex XSOAR, a task's Conditions tab defines a conditional expression that is evaluated against the current incident context (the JSON data available at that point in the playbook). If the expression evaluates to true, the task runs; if false, the task is skipped. This is the mechanism that determines task execution.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 3

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Option A is correct because a Content Pack must declare its integration dependencies (or the specific integration commands the playbook invokes) so that the target production environment has the required integrations installed and configured before the playbook runs. Option D is correct because custom automation scripts and transformers referenced by playbook tasks are not built-in and must be packaged or referenced in the pack, otherwise tasks will fail with missing-script errors. Option E is correct because any dependent sub-playbooks called by the main playbook must also be included or referenced in the pack, since sub-playbooks are separate content items and will not resolve automatically in the target environment. Option B is not correct because war room chat logs are runtime artifacts of the development environment, not deployable content, and are irrelevant to pack installation or execution. Option C is not correct because analyst credentials and password hashes are environment-specific secrets that should never be exported in a Content Pack and are not required for the playbook to install or run.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.

Question 4

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. In the Cortex XSOAR UI, playbooks are created and modified visually under the 'Automation' tab, specifically the 'Playbooks' section. This is where the Playbook Designer is accessible, allowing drag-and-drop editing of tasks, conditions, and flows. The other options refer to unrelated UI areas such as dashboards, integrations, or incident analysis, which do not host the playbook editor.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 5

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Accepted Answer

Built-in export features in integration instances (e.g., Filebeat, Syslog, or API export). Option B is correct because Cortex XSOAR integration instances such as Filebeat, Syslog, and generic API-based integrations provide built-in export capabilities that forward indicators to external systems. Option C is correct because a TAXII server integration instance in Cortex XSOAR exposes indicators over the TAXII protocol, allowing external threat intelligence platforms to consume them. Option D is correct because playbooks can invoke SIEM or firewall integration commands (push actions) to send indicators to those external systems as part of an automated workflow. Option A is incorrect because flushing server cache with OS kill commands is an administrative action that does not export indicators and could destabilize the server. Option E is incorrect because directly editing PostgreSQL database files bypasses supported APIs, risks corruption, and is not a valid export method.

Answer

Flushing the server cache memory using OS kill commands

Answer

Directly modifying the underlying PostgreSQL database files via text editor

Question 6

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Accepted Answer

Settings > Advanced > Server Configuration. Data retention, incident archiving, and cleanup schedules are managed under Settings > Advanced > Server Configuration.

Answer

Incidents > Retention Policies

Answer

Dashboards > Maintenance Settings

Answer

Settings > Integrations > Database Maintenance

Question 7

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Accepted Answer

In the integration instance configuration under Incoming Mapper. Integration instance mapper configurations handle mapping incoming raw data fields to XSOAR incident fields.

Answer

In the global Layouts customization menu

Answer

Inside the server.properties configuration file

Answer

Within the War Room CLI using the '!set-field' command

Question 8

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

Accepted Answer

High event volume and low operational complexity.. When prioritizing initial pilot use cases for XSOAR, best practices recommend selecting those with high event volume and low operational complexity. This allows the team to demonstrate quick wins, reduce alert fatigue, and build confidence in the platform without being bogged down by complex procedures or integrations.

Answer

Use cases that involve zero existing documentation or standard operating procedures.

Answer

Use cases requiring brand-new custom integrations with unsupported legacy APIs.

Answer

Extremely low event frequency and high procedural ambiguity.

Question 9

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. Option B is correct because Cortex XSOAR's supported disaster-recovery practice is to schedule automated backups of both the configuration and the database (e.g., via the built-in backup mechanism or scripts) and store them on secondary/off-box storage so the environment can be restored after node or site failure. Option C is correct because for high availability and DR, production deployments should use an external highly available PostgreSQL cluster (e.g., streaming replication with automatic failover) instead of the embedded database, which is single-node and unsuitable for HA. Option E is correct because placing a load balancer in front of multiple Cortex XSOAR application server nodes distributes traffic, enables health-check-based failover, and removes the application server as a single point of failure. Option A does not belong because running integration Docker containers in privileged root mode is a security anti-pattern and is not required for HA/DR. Option D does not belong because disabling database persistence sacrifices durability and would prevent recovery, directly contradicting disaster-recovery requirements.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 10

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Accepted Answer

URL. Cortex XSOAR includes predefined indicator types such as URL, IP, Domain, and File Hash.

Answer

IP

Answer

File Hash

Answer

Domain

Question 11

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

Accepted Answer

Connect the preceding task to all three tasks in parallel, and route them into the joining task.. To run multiple tasks concurrently, you connect the preceding task to all three tasks simultaneously, and then connect all three tasks into the subsequent analysis task to join the workflow.

Answer

Wrap them inside a single Data Collection Task.

Answer

Place them in a serial chain one after another.

Answer

Use a Loop Task with a batch size of 3.

Question 12

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Option B is correct because task inputs in a playbook support dynamic context path references written with the ${} syntax, which resolves values from the playbook's context at runtime (for example ${incident.id} or ${alert.name}). Option E is correct because static text can be typed directly into the argument field, providing a literal value that is passed to the command argument without any resolution step. Option A is incorrect because playbooks do not query the internal PostgreSQL database directly to populate task arguments; data is supplied through context or static input. Option C is incorrect because memory pointer addresses in C syntax are not a supported input mechanism in playbook task configuration. Option D is incorrect because local environment variables set via bash export are not a supported way to pass values into playbook task arguments.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands

Question 13

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Accepted Answer

${incident.id}. In Cortex XSOAR, the ${incident.id} context path resolves to the unique ID of the current incident at runtime, making it the correct way to dynamically reference the incident ID inside a War Room script or playbook task.

Answer

${playbook.case_id}

Answer

${active.incident_number}

Answer

${demisto.current_id}

Question 14

An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?

Accepted Answer

Configure a polling loop with a wait/sleep task that periodically checks the sandbox job status until completion.. Using a timer/sleep task or polling loop combined with a wait-for-results mechanism (or callback/webhook) allows the playbook to check status periodically without wasting continuous active processing time.

Answer

Increase the server RAM allocation to allow blocking threads.

Answer

Run an infinite loop with zero delay checking the API every millisecond.

Answer

Terminate the playbook immediately and require manual review for all files.

Question 15

When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?

Accepted Answer

Disabling an Active Directory user account associated with confirmed malicious activity outside business hours.. High-confidence, low-impact actions like disabling a compromised Active Directory account are prime candidates for automated containment once the threat level is verified.

Answer

Terminating employment status of a suspected insider threat.

Answer

Deleting primary database backups on suspicion of data exfiltration.

Answer

Revoking executive internet access during an ongoing ransomware outbreak.

Question 16

When planning the deployment of XSOAR integrations, which TWO configuration steps are typically required to connect an integration instance to an external product (e.g., a firewall or SIEM)? (Choose TWO)

Accepted Answer

Providing valid authentication credentials such as API keys, tokens, or username/password.. Configuring authentication credentials (API keys/tokens) and setting the target server URL/endpoint are required to establish an integration connection.

Answer

Modifying the client-side web browser theme color.

Answer

Rewriting the external vendor's proprietary firmware source code.

Answer

Installing physical fiber-optic cables into the XSOAR appliance chassis.

Question 17

An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?

Accepted Answer

Sanitize or mask sensitive data within the automation script before writing outputs to the XSOAR context.. The recommended strategy is to sanitize or mask sensitive data within the automation script before writing outputs to the XSOAR context. This ensures that PII is not stored in context or incident fields, complying with data protection requirements. Masking can be done using built-in XSOAR transformations or custom Python scripts that redact or hash sensitive values before they are persisted.

Answer

Store the PII in plain text inside incident custom fields and restrict access using incident layout roles.

Answer

Rely on the browser's local cache to encrypt the sensitive fields on the analyst's workstation.

Answer

Disable the XSOAR server audit log entirely.

Question 18

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Accepted Answer

In the task's Conditions tab using pre-conditions or filtering rules. Task-level conditional filtering (such as checking previous task results or verdicts) is configured in the Conditions tab of the task properties.

Answer

In the Incident Fields configuration menu

Answer

In the playbook Details tab under Script arguments

Answer

By writing a separate Condition task before every single integration task

Question 19

An XSOAR architect is designing custom incident layouts for a new ransomware response use case. The SOC team needs to see critical file hashes, affected machine names, and containment status immediately upon opening an incident. Where should the architect configure these visual elements?

Accepted Answer

In Incident Layouts and custom fields configuration.. Incident Layouts in XSOAR (configured under Settings > Object Fields > Layouts) define the tabs, fields, and visual widgets presented to analysts in the incident war room.

Answer

As part of the database backup retention schedule.

Answer

Inside the server's crontab configuration file.

Answer

Within the integration instance YAML manifest file.

Question 20

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

Accepted Answer

UDP, TCP, and TLS (Encrypted TCP). Cortex XSOAR Syslog integration supports UDP, TCP, and TLS-secured TCP connections for log forwarding.

Answer

UDP only

Answer

UDP and TCP (Plaintext only)

Answer

HTTPS REST API only