XSOAR-Engineer Practice Test 5 — 25 Questions

Question 1

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Section of type 'Query' configured with the specific incident query and associated widget type.. To include dynamic data from saved queries or widgets into an XSOAR report, the report section must be configured as a Query or Widget type section.

Answer

A Section of type 'Markdown' containing embedded REST API calls to the XSOAR server.

Answer

A Section of type 'War Room Transcript' filtered by playbook task ID.

Answer

A Section of type 'Image' pointing to the temporary URL of the dashboard widget.

Question 2

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

Accepted Answer

The user role viewing the dashboard lacks permissions to access the underlying data or indices.. Widget failures commonly stem from invalid query syntax in the underlying widget definition or permission issues where the running user lacks access to the queried data.

Answer

The SMTP server port is blocked by a local firewall.

Answer

The Linux kernel swap space on the XSOAR server is configured below 512MB.

Answer

The SSL certificate of the active firewall integration has expired.

Question 3

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 4

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Accepted Answer

In the integration instance configuration under Incoming Mapper. Integration instance mapper configurations handle mapping incoming raw data fields to XSOAR incident fields.

Answer

In the global Layouts customization menu

Answer

Inside the server.properties configuration file

Answer

Within the War Room CLI using the '!set-field' command

Question 5

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

Accepted Answer

Configure incident layout validation rules or closing rules requiring the 'closeReason' field. Closing rules or layout validation rules can require specific fields upon closure.

Answer

Enable 'Strict Mode' under Settings > Integrations

Answer

Delete the default close button and require analysts to use CLI commands exclusively

Answer

Modify the server license file to enable strict closure enforcement

Question 6

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Accepted Answer

Dashboards & Reports > Reports > Template management. Report templates in XSOAR use docx or HTML/PDF templates managed under Dashboards & Reports > Reports settings or template customization.

Answer

Settings > Integrations > Email Server > Templates

Answer

Settings > Customization > Branding & Logos

Answer

The incident layout editor under Settings > Customization > Layouts

Question 7

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

Accepted Answer

The corresponding field element in the incident layout is configured as a single-select dropdown instead of multi-select. Layout configurations must match field types; if the layout element is configured as a single select or dropdown instead of multi-select, or if the field definition itself was incorrectly set, behavior is restricted. Assuming layout field configuration.

Answer

Multi-select fields are not supported in custom incident types

Answer

All multi-select fields require an active threat intelligence feed license

Answer

The database index for multi-select fields must be rebuilt via CLI using '!rebuild-index'

Question 8

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Accepted Answer

The custom fields were created but not added to the layout assigned to that incident type. Fields must be added to the active layout for the specific incident type to be visible in the Incident Info panel.

Answer

The user browser cache must be cleared via Settings > Server Configuration

Answer

Custom fields are restricted to administrator accounts only by default

Answer

Custom fields require a server restart before appearing in database schemas

Question 9

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Accepted Answer

In the Dashboard configuration settings by selecting the appropriate Roles under Sharing settings.. Dashboard permissions are managed directly within the Dashboard configuration dialog by assigning specific user roles (such as Tier-2 SOC) to control read or write visibility.

Answer

In the User Profile settings for each individual Tier-2 SOC analyst.

Answer

In the Incident Type layout editor under the Permissions tab.

Answer

In the Server Configuration (Settings > About > Configuration) by updating the 'dashboard.roles.allowed' key.

Question 10

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 11

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Accepted Answer

The War Room. The War Room is the central interactive interface within an incident where analysts collaborate, run automation scripts, and maintain an audit trail.

Answer

The Job Scheduler

Answer

The Threat Intel page

Answer

The Incident Canvas

Question 12

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > Debug Logs. Integration logs and API execution traces can be found within the Audit logs and specific integration instance debug logs available in Settings > About > Troubleshooting.

Answer

Incidents > Audit Trail

Answer

Dashboards > Server Metrics

Answer

Settings > Advanced > System Health

Question 13

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Accepted Answer

Account-based segregation with role-based access control (RBAC) on the central server. In Cortex XSOAR multi-tenancy, accounts and roles manage data segregation between tenants on a single central server.

Answer

Individual PostgreSQL database instances per tenant schema

Answer

Dedicated Docker containers per tenant

Answer

Physical server separation linked via API gateways

Question 14

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

Accepted Answer

Archiving the report inside the built-in XSOAR Report repository for download.. Natively, XSOAR reports can be sent via email to recipients, stored within War Room attachments of specific incidents, or saved directly to the server's report archive/repository for later retrieval.

Answer

Automatic physical printing via networked CUPS printer drivers.

Answer

Real-time SMS broadcast to an administrator mobile gateway.

Question 15

Which TWO built-in fields are automatically populated when a new incident is created in Cortex XSOAR?

Accepted Answer

Status. Built-in fields like incident ID, creation time (or modified time), and status are automatically populated upon creation.

Answer

Vehicle license plate number

Answer

Frequent flyer miles balance

Answer

Employee payroll identification number

Question 16

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Accepted Answer

server.jvm.max.memory. The JVM heap size for the Cortex XSOAR server is controlled via the server configuration parameters, specifically server.jvm.max.memory or system environment variables like JAVA_OPTS.

Answer

demisto.engine.memory.limit

Answer

incident.ingestion.buffersize

Answer

python.max.worker.memory

Question 17

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Database performance can be diagnosed using PostgreSQL query monitoring tools (pg_stat_activity) and optimizing or indexing frequently queried incident fields, along with utilizing Cortex XSOAR server metrics.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 18

An administrator wants to ensure that specific incident fields are automatically populated and marked as read-only once an incident reaches the 'Containment' phase. Where should this behavior be configured?

Accepted Answer

In the Layouts configuration using conditional formatting or read-only rules tied to incident phases.. Layouts in Cortex XSOAR determine field visibility, editability, and arrangement based on incident types and phases.

Answer

In the Incident Types settings under the 'Mandatory Fields' tab.

Answer

In the Server Configuration under the 'incident.readonly.phases' parameter.

Answer

In the Automation script parameters for the containment playbook task.

Question 19

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Accepted Answer

Modify the report section layout dimensions, orientation (Portrait/Landscape), and page break configurations.. Report layouts are structured using customized JSON or built-in orientation and section sizing properties to control PDF rendering margins and element arrangement.

Answer

Increase the server-wide 'report.render.timeout' configuration variable.

Answer

Export the report as a CSV format instead of PDF to bypass layout constraints.

Answer

Update the browser zoom settings of the user who created the scheduled report.

Question 20

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Accepted Answer

PostgreSQL. Cortex XSOAR utilizes an external PostgreSQL database for server clustering and state management to ensure high availability across multiple engine and server instances.

Answer

MySQL

Answer

Microsoft SQL Server

Answer

MongoDB