XSOAR-Engineer Practice Test 3 — 30 Questions

Question 1

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. In Cortex XSOAR's custom dashboard widget builder, the natively supported chart/widget types include Line (B), Number (C), and Pie (E). Line (B) is correct because XSOAR provides a line chart widget for plotting trends of a selected query over time. Number (C) is correct because the Number widget displays a single aggregated value (such as a count or severity metric) from a query. Pie (E) is correct because XSOAR offers a pie chart widget to visualize proportional distribution of results by a chosen field. The unmarked options do not belong: 3D-Scatter (A) and Heatmap-Matrix (D) are not among the built-in widget types offered in the Cortex XSOAR custom dashboard widget creation interface.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 2

An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?

Accepted Answer

Write outputs to standardized XSOAR context keys (such as Account or Endpoint) so subsequent tasks can reference unified data.. In XSOAR playbook design, context data from multiple sources should be written to standardized context keys (e.g., Account, Endpoint, IP) so that subsequent tasks can reference a unified data model. This enables correlation and enrichment across disparate sources without manual intervention. Using standardized keys allows built-in commands and scripts to automatically access and manipulate the data, ensuring consistency and scalability.

Answer

Save each source's data into a separate hardcoded local text file on the Linux host.

Answer

Manually email raw log dumps to all SOC analysts.

Answer

Delete previous task context before running the next integration.

Question 3

An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?

Accepted Answer

Manual task. A manual task is specifically designed to pause playbook execution and present a customizable form for human input. It is the appropriate task type for manual approvals, allowing the analyst to approve or reject an action before the playbook continues. Other task types either automate execution, evaluate conditions, or collect data without a built-in approval mechanism.

Answer

Data collection task

Answer

Standard task

Answer

Conditional task

Question 4

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

Accepted Answer

Download the content pack from another Cortex XSOAR instance with internet access and manually upload the pack file via the Marketplace interface.. In an air-gapped environment, content packs can be installed by manually uploading a pack file obtained from a connected system or the support portal. This is the supported offline installation method. Proxy configuration, SDK commands, or non-existent offline mode settings do not work when all outbound access is blocked.

Answer

Use the command-line tool 'demisto-sdk download' to fetch the pack directly on the server.

Answer

Configure a proxy server in Cortex XSOAR settings to allow Marketplace access.

Answer

Enable the 'Offline Mode' checkbox in the Marketplace settings, which allows installation from a local repository.

Question 5

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Accepted Answer

Threat Intel Dashboards / Overview workspace. Cortex XSOAR exposes threat intel summary metrics — total indicators, breakdown by indicator type, and top malicious sources — through the Threat Intel Dashboards and Overview workspace. This is the dedicated UI surface for aggregated indicator statistics and source reputation. Administrators use it to monitor feed health and indicator volume.

Answer

Automation > Monitoring > Indicator Stats

Answer

Incidents > Metrics

Answer

Settings > About > System Statistics

Question 6

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

Accepted Answer

To provide human-readable documentation on the playbook's purpose and workflow. The Playbook Description field in Cortex XSOAR is a free-text metadata field used to document the playbook's purpose, scope, and workflow for human readers. It appears in the playbook library and helps analysts and engineers understand what the playbook does without opening and tracing every task.

Answer

To define the regex pattern used for email parsing

Answer

To store encrypted API credentials for sub-playbooks

Answer

To execute initialization scripts when the playbook starts

Question 7

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

Accepted Answer

The Loop feature configured directly on the task properties. To iterate over a list of items in XSOAR context, the engineer uses the Loop feature on the task, specifying the target context array.

Answer

A transformer function in the mapping section

Answer

A sub-playbook with parallel task execution

Answer

A Condition task evaluating the length of the Account array

Question 8

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

Accepted Answer

Configure the playbook trigger rules or associate it with an incident type that excludes automatic classifier fetching.. Playbooks can be restricted by type or execution triggers. To prevent automatic triggering while allowing manual execution, the playbook should be associated with specific incident types or configured as manual-only.

Answer

Disable the integration instance responsible for email fetching.

Answer

Set the playbook role restriction to Administrator only.

Answer

Delete the start task of the playbook.

Question 9

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Accepted Answer

Executing the sub-playbook either synchronously or asynchronously. Option B is correct because Cortex XSOAR sub-playbooks can be invoked with the 'RunAsynchronously' setting, allowing the parent playbook to either wait for the sub-playbook to finish (synchronous) or continue execution while the sub-playbook runs in parallel (asynchronous). Option C is correct because the sub-playbook task configuration includes an 'Inputs' section where parent playbook context keys are mapped to the sub-playbook's defined input arguments, enabling data to flow into the sub-playbook. Option E is correct because the sub-playbook task also has an 'Outputs' section that maps the sub-playbook's output keys back into the parent playbook context, making the results available to subsequent tasks in the parent. Option A is incorrect because Cortex XSOAR playbooks operate at the orchestration layer and cannot directly modify OS kernel parameters. Option D is incorrect because sub-playbooks are interpreted automation content within the XSOAR engine, not compiled into native binary executables.

Answer

Directly modifying the underlying OS kernel parameters

Answer

Compiling the sub-playbook into a native binary executable file

Question 10

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

Accepted Answer

Native installer script. For installing Cortex XSOAR server on a Linux distribution like Ubuntu, Palo Alto Networks provides a native installer script. This script handles the installation of all necessary components and is the officially supported method. Other methods like Docker Compose, Helm charts, or manual compilation are not supported for the server component. Therefore, the native installer script is the correct choice.

Answer

Docker Compose deployment

Answer

Manual compilation from source code

Answer

Kubernetes Helm chart

Question 11

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Accepted Answer

'ToLower' to convert string characters to lowercase. Option A ('ToLower') is correct because Cortex XSOAR's built-in transformer set includes string transformers such as ToLower, which converts all characters in a given string value to lowercase within a context expression. Option D ('concat') is correct because concat is a built-in transformer that joins multiple string values together, allowing playbook authors to assemble composite strings from separate context fields. Option E ('uniq') is correct because uniq is a built-in list transformer that removes duplicate elements from a list, which is a standard list-manipulation operation in XSOAR context expressions. Option B ('CompileToMachineCode') is not a real XSOAR transformer; XSOAR does not compile context data into native x86 assembly. Option C ('EncryptDatabase') is also not a built-in transformer; XSOAR does not expose a transformer that secures SQL storage, as database encryption is not a context-expression string or list manipulation.

Answer

'CompileToMachineCode' to convert context into native x86 assembly

Answer

'EncryptDatabase' to secure SQL storage

Question 12

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Accepted Answer

Disable SSL verification in the integration instance configuration parameters if the option is available, or add the CA certificate to the trust store.. Custom or self-signed certificates must be added to the XSOAR server trust store or the integration instance must have certificate validation disabled if supported.

Answer

Delete the integration instance and recreate it using HTTP instead of HTTPS.

Answer

Increase the timeout threshold in server configuration.

Answer

Modify the feed provider's web server configuration.

Question 13

An organization is planning an XSOAR use case for vulnerability management triage. Vulnerability scans produce hundreds of thousands of findings daily. To prevent XSOAR from running out of memory or overwhelming the database, what is the best practice for ingestion planning?

Accepted Answer

Implement integration-level filters or pre-processing rules to ingest only high and critical severity vulnerabilities.. Filtering out low-risk or informational vulnerabilities at the integration level or ingest filter stage prevents unnecessary database bloat.

Answer

Store all vulnerability payloads as plain text strings in a single custom incident field.

Answer

Disable incident auto-saving entirely so data only exists in analyst memory.

Answer

Ingest all raw vulnerabilities as individual high-priority incidents without exception.

Question 14

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

Accepted Answer

Pass password parameters to the file extraction task, or design a prompt for an analyst to supply known container passwords.. XSOAR's file extraction tasks (e.g., the 'Extract Archive' or 'Unzip File' commands) accept a password parameter that allows the playbook to programmatically supply known passwords, such as the common 'infected' password used in malware analysis. Additionally, when the password is unknown, the playbook can use an analyst prompt task (e.g., 'Ask' or 'Manual Task') to request the password from a human analyst, enabling dynamic handling of password-protected archives. This approach balances automation with human intervention, ensuring that encrypted files are properly processed without data loss.

Answer

Convert all archive files into plain text PDF documents automatically.

Answer

Restart the XSOAR server container to clear encryption keys.

Answer

Instantly delete any file ending in a .zip extension without inspection.

Question 15

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

Accepted Answer

By enabling 'Auto-extract indicators' in the incident type or task output configuration settings. Indicators returned by automation scripts or commands in standard task outputs can be automatically processed and ingested into the Threat Intel module based on mapping and indicator extraction settings.

Answer

By writing all indicators manually to a local CSV file on the server

Answer

By assigning the playbook to the 'Indicator' incident type exclusively

Answer

By restarting the Cortex XSOAR server daemon

Question 16

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Settings > Import / Export > Import. This is the built-in Cortex XSOAR UI feature specifically designed to import a previously exported content bundle (a .zip file containing playbooks, scripts, layouts, and other custom content) from one environment into another. It handles dependency resolution and version compatibility, making it the standard method for migrating custom content between development and production instances.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 17

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. In Cortex XSOAR, a task's Conditions tab defines a conditional expression that is evaluated against the current incident context (the JSON data available at that point in the playbook). If the expression evaluates to true, the task runs; if false, the task is skipped. This is the mechanism that determines task execution.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 18

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Option A is correct because a Content Pack must declare its integration dependencies (or the specific integration commands the playbook invokes) so that the target production environment has the required integrations installed and configured before the playbook runs. Option D is correct because custom automation scripts and transformers referenced by playbook tasks are not built-in and must be packaged or referenced in the pack, otherwise tasks will fail with missing-script errors. Option E is correct because any dependent sub-playbooks called by the main playbook must also be included or referenced in the pack, since sub-playbooks are separate content items and will not resolve automatically in the target environment. Option B is not correct because war room chat logs are runtime artifacts of the development environment, not deployable content, and are irrelevant to pack installation or execution. Option C is not correct because analyst credentials and password hashes are environment-specific secrets that should never be exported in a Content Pack and are not required for the playbook to install or run.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.

Question 19

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. In the Cortex XSOAR UI, playbooks are created and modified visually under the 'Automation' tab, specifically the 'Playbooks' section. This is where the Playbook Designer is accessible, allowing drag-and-drop editing of tasks, conditions, and flows. The other options refer to unrelated UI areas such as dashboards, integrations, or incident analysis, which do not host the playbook editor.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 20

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Accepted Answer

Built-in export features in integration instances (e.g., Filebeat, Syslog, or API export). Option B is correct because Cortex XSOAR integration instances such as Filebeat, Syslog, and generic API-based integrations provide built-in export capabilities that forward indicators to external systems. Option C is correct because a TAXII server integration instance in Cortex XSOAR exposes indicators over the TAXII protocol, allowing external threat intelligence platforms to consume them. Option D is correct because playbooks can invoke SIEM or firewall integration commands (push actions) to send indicators to those external systems as part of an automated workflow. Option A is incorrect because flushing server cache with OS kill commands is an administrative action that does not export indicators and could destabilize the server. Option E is incorrect because directly editing PostgreSQL database files bypasses supported APIs, risks corruption, and is not a valid export method.

Answer

Flushing the server cache memory using OS kill commands

Answer

Directly modifying the underlying PostgreSQL database files via text editor