XSOAR-Engineer Practice Test 5 — 25 Questions

Question 1

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reference the incident field using context syntax such as ${incident.ipaddresses} in the sub-playbook input mapping.. To pass incident fields or context data to a sub-playbook, the engineer uses the Context or Incident field selector in the sub-playbook task configuration, referencing the path such as ${incident.ipaddresses}.

Answer

Write a custom Python automation script to manually push the incident field into the sub-playbook context every time.

Answer

Hardcode the IP addresses into the sub-playbook's default argument values.

Answer

Create a global variable in the Server Configuration settings.

Question 2

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Accepted Answer

The execution status of the task (e.g., completed, failed, in-progress). Color coding on playbook tasks in active incidents reflects their execution status (e.g., green for completed, red for failed, blue for in-progress).

Answer

The permission level required by the analyst viewing the task

Answer

The difficulty rating assigned by the playbook developer

Answer

The integration vendor associated with the task command

Question 3

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Accepted Answer

The auto-refresh dropdown menu located in the dashboard header. In Cortex XSOAR, the refresh rate for an active dashboard is controlled directly from the dashboard header via an auto-refresh dropdown menu. This allows the user to select intervals such as 30 seconds, 1 minute, 5 minutes, etc., without navigating away from the dashboard. The setting is per-dashboard and takes effect immediately, causing all widgets to update automatically at the chosen interval.

Answer

Settings > Customization > UI Preferences

Answer

Dashboards > Widget Editor > Refresh Interval

Answer

Settings > Server Configuration > Dashboard.Refresh.Rate

Question 4

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Accepted Answer

Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.. For an air-gapped Cortex XSOAR installation on RHEL, the supported method is to use the offline installation bundle, which includes pre-packaged Python dependencies and local wheels. This bundle is designed for environments without internet access and ensures all required libraries are available for integrations.

Answer

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Answer

Configure the server to tunnel through an unauthenticated proxy.

Answer

Run 'demisto-sdk download-dependencies' from the CLI.

Question 5

An XSOAR implementation team is planning threat intelligence management workflows. Which THREE capabilities does XSOAR provide natively for managing and acting upon threat indicators? (Choose THREE)

Accepted Answer

Indicator matching against active incidents to detect historical compromise.. Option A is correct because XSOAR's threat intel management includes indicator relationships and search that let you match indicators against existing and closed incidents, enabling retroactive/historical compromise hunting. Option B is correct because XSOAR natively performs indicator extraction (via the built-in extractIndicators/Indicator Extraction rules and regex-based extractors) from unstructured fields such as email bodies and incident descriptions. Option D is correct because XSOAR computes a DBot score for indicators on a 0-3 scale (Unknown, Good, Suspicious, Bad), which drives reputation-based decisions and playbook branching. Option C is not a XSOAR capability; it is a data center/DCIM or ITSM function, not threat intel management. Option E is also not provided by XSOAR; exploit compilation is an offensive security/development task outside the platform's native threat intel workflows.

Answer

Physical hardware asset tracking and automated server rack cooling adjustment.

Answer

Direct compilation of proprietary operating system kernel exploits.

Question 6

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Accepted Answer

Active. In Cortex XSOAR, every incident carries a status field whose built-in values are Active, Pending, and Closed, so option A (Active) is correct because it is the default status assigned to newly created or currently investigated incidents, and option D (Closed) is correct because it marks incidents that have been resolved and are no longer being worked. These two are part of the standard incident lifecycle (Active → Pending → Closed) used by the incident status field, playbooks, and SLA/MTTR reporting. Option B (Archived) is not a status but a separate flag/action for hiding old incidents from the default view, option C (Quarantined) is not an XSOAR incident status (it relates to endpoint/email quarantine concepts), and option E (Locked) is not a status either—locking refers to record-level edit protection, not an incident lifecycle state.

Answer

Archived

Answer

Quarantined

Answer

Locked

Question 7

When planning advanced playbook logic and data manipulation in XSOAR, which THREE methods can be used to extract, filter, or transform data within playbook tasks? (Choose THREE)

Accepted Answer

Custom Python automation scripts that process context data and return modified outputs.. Built-in transformer functions, JSON path expressions (jq-like syntax), and custom Python automation scripts are the primary ways to manipulate data in XSOAR playbooks.

Answer

Recompiling the XSOAR Java Virtual Machine bytecode.

Answer

Modifying raw database transaction logs with a hex editor.

Question 8

During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?

Accepted Answer

A manual task configured with prompt options and assigned to the relevant analyst role.. A manual task (or data collection task configured with a prompt) pauses playbook execution and assigns a pending task to an analyst or user role for approval.

Answer

An integration instance fetch-incidents polling interval adjustment.

Answer

A pre-processing rule that drops incoming JSON payloads lacking approval metadata.

Answer

A transformer function applied to incident field mapping.

Question 9

An XSOAR architect is designing a SOC workflow where critical alerts from a SIEM must bypass the standard queue and immediately trigger an urgent page to the on-call engineer. Which integration category and playbook design pattern should be utilized?

Accepted Answer

PagerDuty/On-call alerting integration tasks placed on a high-priority incident routing path.. PagerDuty or on-call alerting integrations combined with high-priority conditional playbook branching ensure urgent notifications are dispatched instantly.

Answer

A scheduled weekly email summary report sent to department heads.

Answer

A pre-processing rule that archives all critical alerts.

Answer

A database index optimization job.

Question 10

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

Accepted Answer

A Section of type 'Query' configured with the specific incident query and associated widget type.. To include dynamic data from saved queries or widgets into an XSOAR report, the report section must be configured as a Query or Widget type section.

Answer

A Section of type 'Markdown' containing embedded REST API calls to the XSOAR server.

Answer

A Section of type 'War Room Transcript' filtered by playbook task ID.

Answer

A Section of type 'Image' pointing to the temporary URL of the dashboard widget.

Question 11

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Accepted Answer

Dashboards & Reports > Reports > Template management. Report templates in XSOAR use docx or HTML/PDF templates managed under Dashboards & Reports > Reports settings or template customization.

Answer

Settings > Integrations > Email Server > Templates

Answer

Settings > Customization > Branding & Logos

Answer

The incident layout editor under Settings > Customization > Layouts

Question 12

An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?

Accepted Answer

Database replication (PostgreSQL) and Elasticsearch synchronization across all engine/server nodes.. For XSOAR high availability and disaster recovery, the critical components to synchronize are the PostgreSQL database (which stores incidents, playbooks, and configurations) and Elasticsearch (which indexes data for search and dashboards). These must be replicated across all engine and server nodes to ensure seamless failover and data consistency. Proper planning involves configuring database replication and Elasticsearch clustering to avoid split-brain and data loss.

Answer

Duplicating integration API keys in plain text within the system welcome banner.

Answer

Synchronizing browser cookies across all analyst workstations.

Answer

Manual copying of log files via FTP every week.

Question 13

An XSOAR architect is designing incident data ingestion flows. Which TWO mechanisms can be used to filter or modify incoming raw events before they are officially created as XSOAR incidents? (Choose TWO)

Accepted Answer

Integration instance configuration filters and mapper settings.. Option C is correct because integration instance configuration in XSOAR allows you to define fetch filters (e.g., query parameters, incident type filters, and fetch limits) and classifier/mapper settings that determine which raw events are ingested and how their fields are transformed into incident fields before the incident is created. Option D is correct because pre-processing rules (Pre-Process Rules) in XSOAR settings are evaluated on incoming events and can drop, filter, or modify events—including changing fields or linking to existing incidents—before an incident is officially created. Option A is incorrect because nightly PostgreSQL backups are a database maintenance/DR activity and have no role in filtering or transforming incoming events. Option B is incorrect because playbook post-processing tasks run after an incident exists (and after closure), so they cannot affect pre-creation ingestion. Option E is incorrect because browser CSS stylesheets only affect the visual rendering of the login page and have no bearing on event ingestion logic.

Answer

Nightly PostgreSQL database backup snapshots.

Answer

Playbook post-processing tasks that run after incident closure.

Answer

Browser CSS stylesheets applied to the login page.

Question 14

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Accepted Answer

Condition. Option B, Condition, is correct because a condition task evaluates a defined expression against playbook context data and branches execution down different paths depending on whether the result is true or false, which is exactly how XSOAR playbooks control decision-based flow. Option D, Parallel, is correct because a parallel task splits execution into multiple concurrent branches, allowing several task sequences to run simultaneously and then optionally rejoin, which directly controls the execution path and concurrency of the playbook. The unmarked options do not belong: Credential (A) is a task input/parameter type used to supply stored credentials to a task rather than a flow-control task, Enrichment (C) refers to tasks that query integrations to add data to the incident context rather than direct branching logic, and Mirroring (E) is an incident-level feature for syncing fields and entries with external systems such as ticketing platforms, not a playbook flow-control task type.

Answer

Credential

Answer

Enrichment

Answer

Mirroring

Question 15

An enterprise XSOAR administrator is planning the deployment of remote engines (DEX - Demisto Execution Engines) across multiple isolated regional network zones. What is the primary architectural purpose of deploying remote engines in this scenario?

Accepted Answer

To execute integrations locally within isolated network segments and securely relay results back to the central XSOAR server.. Remote engines execute integration commands and playbooks locally within restricted network zones (e.g., DMZ or remote datacenters) and communicate back to the central XSOAR server via encrypted channels.

Answer

To bypass the need for API keys when connecting to external cloud services.

Answer

To replace the underlying PostgreSQL database cluster with local SQLite files.

Answer

To provide local graphical user interfaces for regional SOC analysts.

Question 16

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

Accepted Answer

Loop Task. A Loop Task is used in XSOAR playbooks to iterate over a list of items and execute subsequent tasks for each item.

Answer

Data Collection Task

Answer

Parallel Task Group

Answer

Conditional Task

Question 17

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Accepted Answer

Review the integration instance execution logs for raw response errors.. Option A is correct because the integration instance execution logs capture the raw HTTP response and error details returned by the feed, which is the fastest way to see whether the failure is an authentication, timeout, or malformed-payload issue during parsing. Option E is correct because running the feed query in a standalone test script or inspecting the raw JSON payload lets the administrator validate the response structure against the integration's expected schema and parser logic, isolating whether the problem is in the data or the parsing code. Options B, C, and D are not appropriate: hypervisor upgrades, reinstalling the Cortex XSOAR Linux OS, and changing the network gateway address are infrastructure-level actions unrelated to a feed parsing failure, and they would not diagnose or resolve a malformed or unexpected data payload.

Answer

Upgrade the hypervisor running the virtual machine.

Answer

Reinstall the entire Cortex XSOAR Linux operating system.

Answer

Change the server's primary network gateway IP address.

Question 18

An XSOAR architect is designing an automated incident response workflow that requires human approval before executing destructive remediation actions. Which THREE design patterns or features should be incorporated to handle human interaction securely and effectively? (Choose THREE)

Accepted Answer

Manual playbook tasks configured with specific prompt options (e.g., Approve / Deny).. Manual tasks with prompt options, role-based task assignments, and ChatOps (Slack/Teams) interactive buttons are standard patterns for human approval workflows.

Answer

Terminates the entire XSOAR server instance immediately upon hitting a manual task.

Answer

Relying on anonymous public web forms accessible without authentication.

Question 19

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. The XSOAR Incident WorkArea includes a search bar that accepts Lucene-style queries against incident fields. The query 'owner:me and status:Investigation' filters incidents where the current user is the owner and the status is Investigation, returning exactly the desired set without leaving the WorkArea.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 20

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

Accepted Answer

Use the search bar in the Incidents page with a query filtering by owner and status.. The Incident List view provides a query search bar where analysts can enter query syntax like `owner:current_user and status:"In Progress"` to filter incidents.

Answer

Create a completely new custom Report and export it to Excel.

Answer

Modify the default Playbook definitions to restrict visibility.

Answer

Build a new Dashboard widget and restart the XSOAR service.