XSOAR-Engineer Practice Test 4 — 10 Questions

Question 1

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the incident to the shift lead using the Owner field. Ownership transfer in Cortex XSOAR is performed through the Owner field on the incident. Setting the Owner to the shift lead makes that analyst the acknowledged owner, sends an in-app notification, and records the change in the incident audit trail, satisfying the handoff requirement for the malware containment incident.

Answer

Add the shift lead as a collaborator on the incident

Answer

Move the incident to a different investigation queue

Answer

Mention the shift lead with @ in a War Room note

Question 2

An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?

Accepted Answer

A conditional task that checks indicator reputation or confidence scores before executing the block command.. A conditional task evaluating indicator reputation or confidence scores prevents low-confidence indicators from reaching downstream blocking actions.

Answer

By increasing the server thread pool size.

Answer

Within the user account management settings.

Answer

By modifying the default system clock synchronization settings.

Question 3

Which TWO pieces of information are displayed prominently in the incident header by default?

Accepted Answer

Incident ID. The incident header typically displays key metadata such as Incident Name/ID, Status, Owner, and Severity.

Answer

Active database connection pool size

Answer

CPU temperature of the XSOAR server

Answer

SSL certificate expiration date of the remote mail server

Question 4

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 5

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Option B is correct because Cortex XSOAR playbooks execute automated workflows that handle repetitive SOC tasks such as enrichment, triage, and containment actions, which directly reduces Mean Time to Respond (MTTR). Option D is correct because playbooks encode a defined, repeatable sequence of steps so that every analyst handles the same incident type consistently, standardizing incident response across the team. Option A is incorrect because playbooks do not permanently disable all external network connections during any alert; containment actions are typically scoped, conditional, and reversible. Option C is incorrect because XSOAR is designed to augment analysts, not eliminate human oversight; human-in-the-loop approvals and analyst judgment remain essential. Option E is incorrect because XSOAR does not replace SIEM databases with flat text files; it integrates with SIEMs and other tools rather than substituting their data stores.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 6

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 7

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Accepted Answer

The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.. Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Answer

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Answer

The user's email address contains uppercase characters.

Answer

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Question 8

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Accepted Answer

Related incidents list. Option C (Related incidents list) is correct because Cortex XSOAR correlates indicators from threat feeds with existing incidents, letting analysts pivot from an indicator to all incidents that reference it and quickly assess prior investigations and impact. Option D (Indicator relationship graphs and mappings) is correct because XSOAR builds relationships between indicators (for example, domain-to-IP, file-to-C2) and renders them as graphs, and its indicator type mappings normalize feed data so analysts can visualize and traverse these connections during an investigation. The other options do not belong: A (HTML email template designer) is a phishing/notification formatting feature unrelated to indicator investigation, B (Global LDAP user directory sync) only provisions users and roles for authentication, and E (Automatic hypervisor backup scheduling) is not a Cortex XSOAR capability at all.

Answer

HTML email template designer

Answer

Global LDAP user directory sync

Answer

Automatic hypervisor backup scheduling

Question 9

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. In a playbook Conditional Task, option B is correct because you can configure custom branch labels that name each possible outcome, allowing subsequent tasks to be routed based on which branch is taken. Option C is correct because the core of a Conditional Task is defining conditional expressions that evaluate incident fields or context data to determine which branch executes. Option E is correct because a Conditional Task supports a default (else) fallback path that runs when none of the specified conditions evaluate to true. Option A is not a playbook Conditional Task setting; compiling Python source into bytecode is a Python runtime/build operation, not a playbook configuration. Option D is not a Conditional Task setting either, since directly modifying firewall ACLs without commands is not a supported configuration mechanism in a Conditional Task.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 10

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens