XSOAR-Engineer Practice Test 3 — 10 Questions

Question 1

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. In Cortex XSOAR, when configuring a data collection task, the user's response is mapped to an incident field via the task's 'Assign to Incident Field' configuration setting. This setting explicitly binds the response to a chosen incident field, making it available for downstream playbook logic and incident context. Other tabs handle inputs, scripts, or display, not incident field assignment.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 2

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Accepted Answer

Identifying correct JSONPath expressions for indicator fields. Option D is correct because a non-standard JSON threat feed has no predefined parser, so you must determine the exact JSONPath expressions (e.g., $.data[].attributes.value) that locate each indicator field such as IP, domain, or hash within the nested JSON structure. Option E is correct because once values are extracted, they must be mapped to the standard XSOAR indicator schema attributes (e.g., ip, domain, filehash, or the relevant indicator type fields) so the platform can normalize, deduplicate, and enrich them correctly. Option A is incorrect because custom C++ kernel modules are unnecessary and inappropriate for parsing JSON feed data in XSOAR. Option B is incorrect because modifying the XSOAR source code repository is not required and would break supportability; custom mapping is done through configuration and integration code, not core source edits. Option C is incorrect because hardware load balancers address traffic distribution and availability, not indicator field extraction or schema mapping.

Answer

Writing custom C++ kernel modules for memory parsing

Answer

Modifying the XSOAR source code repository

Answer

Configuring hardware load balancers for the feed server

Question 3

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. Cortex XSOAR automatically normalizes and merges indicator entries based on type-specific normalization rules. For example, domains are lowercased, IP addresses are canonicalized, and hashes are standardized. This deduplication ensures that the same indicator from different feeds is represented as a single record, with aggregated data and reputation.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 4

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

Accepted Answer

Set the chart type to Bar and group the data by the appropriate incident field representing the source.. When creating a custom chart widget in XSOAR, the analyst specifies the chart type (e.g., Bar) and groups the results by a specific incident field (such as 'brand' or source integration).

Answer

Configure a War Room script automation that injects HTML directly into the server header.

Answer

Create a dynamic playbook task that exports PNG screenshots to the dashboard folder.

Answer

Enable raw syslog streaming to an external SIEM for visualization.

Question 5

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

Accepted Answer

Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.. By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Answer

Sub-playbooks share the exact same global context without any isolation or scoping.

Answer

All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.

Answer

Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.

Question 6

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Accepted Answer

Navigate to Threat Intel > Indicators > New Indicator.. Indicators can be created manually directly from the Threat Intel workspace using the 'New Indicator' button.

Answer

Modify the server configuration file via SSH.

Answer

Create a dummy incident and run a War Room command.

Answer

Import a full STIX 2.1 bundle via API.

Question 7

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Option B (Widgets) is correct because a standard Cortex XSOAR dashboard is composed of configurable widgets that display security metrics, incident counts, SLA status, and other operational data pulled from the Cortex XSOAR data model. Option E (Dashboard title) is correct because each dashboard in Cortex XSOAR has a title/name that identifies it in the dashboard selector and appears at the top of the dashboard view. The unmarked options do not belong: kernel panic crash dumps (A) are OS-level diagnostics unrelated to the Cortex XSOAR web UI, raw Docker container logs (C) are infrastructure logs accessed outside the dashboard, and BIOS configuration utilities (D) are firmware-level tools with no role in the Cortex XSOAR dashboard.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 8

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Accepted Answer

Reference the context path using the ${Email.Body} syntax in the argument field. Dynamic values from the Incident Context are passed into task arguments using the ${Context.Path} syntax.

Answer

Hardcode the expected string value directly into the task argument field

Answer

Store the value in a server-wide environment variable and call os.environ

Answer

Write a custom integration instance configuration for that specific email

Question 9

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Accepted Answer

Toggle the 'Fetch indicators' or active status switch off on the integration instance.. Cortex XSOAR integration instances have a 'Fetch indicators' toggle (and an active/enabled state) that stops ingestion without deleting the instance or its configuration. This preserves all feed settings, credentials, and mappings so the feed can be re-enabled later. Deleting the instance or its indicators is destructive and unnecessary for a temporary pause.

Answer

Delete the integration instance entirely.

Answer

Delete all indicators associated with the feed.

Answer

Change the server license to basic mode.

Question 10

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

Accepted Answer

Tenant management features (or RBAC combined with incident query filters and role-based permissions).. RBAC roles combined with tenant accounts or query filters ensure that users only see incidents and data relevant to their specific department or tenant context.

Answer

Modifying the default CSS stylesheet to hide sensitive UI elements.

Answer

Configuring distinct API keys for every individual playbook task.

Answer

Running multiple separate Linux virtual machines on the same physical server without XSOAR tenant settings.