XSOAR-Engineer Practice Test 2 — 30 Questions

Question 1

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Accepted Answer

Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.. Air-gapped installations require pre-downloading or embedding the required Python wheels or using a local PyPI mirror configured via Cortex XSOAR configuration settings.

Answer

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Answer

Configure the server to tunnel through an unauthenticated proxy.

Answer

Run 'demisto-sdk download-dependencies' from the CLI.

Question 2

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. When upgrading a high-availability Cortex XSOAR environment, the primary server must be updated first, followed by secondary servers, and finally engines.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 3

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Images. Docker image details and container management are located in Settings > Integrations > Docker Images.

Answer

Dashboards > Container Health

Answer

Incidents > Management > Containers

Answer

Settings > About > System Information

Question 4

What is the primary purpose of deploying a Cortex XSOAR Engine?

Accepted Answer

To execute integrations and playbooks in isolated network segments and reduce server load. Cortex XSOAR engines allow the platform to execute integrations and playbooks within isolated network segments (such as DMZs or internal subnets) and offload processing from the main server.

Answer

To act as a primary database replica for high availability

Answer

To handle user authentication and single sign-on (SSO) requests

Answer

To store long-term incident archives for compliance reporting

Question 5

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Registry Configuration. Private Docker registry credentials are configured in Settings > Integrations > Servers and Services or via specific Docker daemon / server configuration properties depending on the deployment architecture.

Answer

Via the demisto-sdk registry-login command

Answer

In the individual integration instance settings under API Key

Answer

Inside the demisto.conf configuration file on the Linux host file system

Question 6

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Accepted Answer

Settings > About in the Cortex XSOAR Web UI. The server version can be verified via the Web UI under Settings > About and via the server command line using demisto-ctl version or querying server status.

Answer

Settings > Integrations > Server Version

Answer

Checking the Apache HTTP server header response

Answer

The server file system path /var/lib/demisto/VERSION

Question 7

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Custom content bundles are imported via Settings > Import / Export > Import in the Cortex XSOAR web interface.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 8

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Accepted Answer

API Keys generated within user profile settings. Cortex XSOAR API authentication supports API Keys generated by users and standard user credentials (username/password) to obtain session tokens.

Answer

OAuth 2.0 client credentials grant type natively configured without user context

Answer

Kerberos ticket-granting service tickets

Answer

Public key SSH key pairs

Question 9

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. High availability and disaster recovery best practices include deploying an external replicated PostgreSQL database, utilizing active-active server clusters with a load balancer, and scheduling automated offsite backups.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 10

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. Playbook task conditions evaluate context paths and expressions to determine whether the task should execute or be skipped.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 11

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Accepted Answer

Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.. To customize built-in content safely, you should clone the playbook, modify the clone, and use the cloned version in your incident types.

Answer

Lock the content pack version in Marketplace settings to prevent all future updates.

Answer

Override playbook tasks by creating a separate script with the same name.

Answer

Edit the content pack files directly on the filesystem via SSH.

Question 12

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. Playbooks are built and managed within the Playbooks section of the XSOAR UI.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 13

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task is designed specifically to pause playbook execution and present a form or prompt to a human analyst for review and input.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 14

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

Accepted Answer

By passing the context path containing the file entry ID, such as ${File.EntryID}. File attachments in XSOAR tasks reference file entry IDs stored in context, typically accessed via context paths pointing to file objects.

Answer

By using the 'AttachFile' system-wide environment variable

Answer

By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt

Answer

By hardcoding the binary content of the file directly into the argument field

Question 15

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Accepted Answer

Verify content pack compatibility against the target XSOAR server version. Before major upgrades, administrators must back up the application database and configuration using demisto-ctl backup, and verify that all installed content packs and integrations are compatible with the target version.

Answer

Stop all inbound email fetching and incident ingestion streams

Answer

Uninstall all third-party marketplace content packs to prevent schema conflicts

Answer

Re-initialize the PostgreSQL database schema from scratch

Question 16

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Accepted Answer

sys.internal.limits.max.fetch.incidents. Incident ingestion rate and flow can be managed using configuration keys that control fetch limits, batch sizes, and throttling intervals.

Answer

server.jvm.garbage.collection.interval

Answer

docker.max.container.lifespan

Question 17

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks support loops and backward transitions (cycles) under specific conditions, allowing workflows to loop back to prior tasks.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 18

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. Data collection tasks allow mapping user inputs directly to incident fields using the task's 'Mapping' or 'Assign to Incident Field' settings.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 19

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. Playbook designers can add visual notes or descriptions to tasks and canvas areas to document workflow logic.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 20

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. Conditional tasks allow evaluating expressions, defining custom labels for branches, and setting a default fallback path.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands