XSOAR-Engineer Practice Test 5 — 10 Questions

Question 1

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. For TAXII feed integrations in Cortex XSOAR, the integration instance has a 'Fetch indicators' toggle that must be enabled for the integration to poll the TAXII server and ingest indicators into the Threat Intel database. If it is disabled, the integration may test successfully but no indicators will populate.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 2

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Accepted Answer

The War Room. The War Room is the central interactive interface within an incident where analysts collaborate, run automation scripts, and maintain an audit trail.

Answer

The Job Scheduler

Answer

The Threat Intel page

Answer

The Incident Canvas

Question 3

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 4

An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) or Mean Time to Acknowledge (MTTA) provides the baseline efficiency metrics necessary to measure ROI and operational improvement after automation is deployed.

Answer

CPU utilization of the Demisto engine

Answer

Total number of active API integrations

Answer

Total number of ingested log sources

Question 5

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

Accepted Answer

XSOAR Dashboards and Reports with built-in widget templates for metrics and automation ROI.. XSOAR Dashboards and Reports provide native widgets and reporting templates specifically designed to visualize SOC metrics, automation ROI, and incident statistics.

Answer

The user role permissions matrix table.

Answer

The integration instance health status indicator.

Answer

Linux system kernel logs viewable via SSH.

Question 6

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Accepted Answer

Engines communicate with the Cortex XSOAR server over HTTPS on port 443 by default.. Cortex XSOAR engines are remote execution components that connect to the server over HTTPS on port 443. They enable integration execution in remote network segments, providing local access to resources. They do not store the incident database and require server connectivity to function, so the true statements are about remote deployment and secure communication.

Answer

Engines store a copy of the Cortex XSOAR incident database for offline access.

Answer

Engines can only run Docker-based integrations and cannot execute scripts directly on the host.

Answer

Engines automatically synchronize playbooks and integrations from the server and can execute them without server connectivity.

Question 7

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Accepted Answer

The 'TAXII2 Server' integration, which exposes a TAXII endpoint for consumers to pull indicators.. Sharing indicators outward is accomplished with the TAXII2 Server integration, which exposes a pull endpoint for external consumers, and with the Export Indicators command, which writes indicators to STIX, CSV, or JSON files for downstream systems. Both are supported export capabilities. The Get, Add, and Delete Indicators commands operate inward or on lifecycle management and do not deliver indicator data to external systems, so they do not meet the sharing requirement.

Answer

The 'Add Indicators' command, which inserts new indicators into the database from external sources.

Answer

The 'Delete Indicators' command, which removes indicators after they are shared.

Answer

The 'Get Indicators' command, which retrieves indicators from the database for review.

Question 8

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. In Cortex XSOAR, PDF reports containing aggregated metrics such as incident closure rates are generated from the Dashboards section, where the Reports tab lets analysts schedule or run on-demand reports based on widgets and saved queries. This is the built-in reporting surface designed for management-level summaries.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 9

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget performance in XSOAR dashboards is dominated by the underlying Elasticsearch query — its time range, filter specificity, and aggregation complexity. Narrowing the time range reduces the number of indices and documents scanned, and tightening filters lets Elasticsearch use indexed fields instead of full scans. This directly reduces query latency and dashboard render time without altering the widget's purpose.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 10

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. In Cortex XSOAR, incident layouts are configured under Settings > Customization > Layouts, where administrators can define which fields appear in the Incident Info section, their order, and their visibility. This is the central location for customizing how incident details are displayed for different incident types, including phishing. Changes made here apply to all incidents of the associated type.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration