XSOAR-Engineer Practice Test 5 — 10 Questions

Question 1

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Accepted Answer

Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.. To customize built-in content safely, you should clone the playbook, modify the clone, and use the cloned version in your incident types.

Answer

Lock the content pack version in Marketplace settings to prevent all future updates.

Answer

Override playbook tasks by creating a separate script with the same name.

Answer

Edit the content pack files directly on the filesystem via SSH.

Question 2

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. Playbooks are built and managed within the Playbooks section of the XSOAR UI.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 3

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task is designed specifically to pause playbook execution and present a form or prompt to a human analyst for review and input.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 4

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

Accepted Answer

By passing the context path containing the file entry ID, such as ${File.EntryID}. File attachments in XSOAR tasks reference file entry IDs stored in context, typically accessed via context paths pointing to file objects.

Answer

By using the 'AttachFile' system-wide environment variable

Answer

By specifying the exact file path on the XSOAR server filesystem, such as /var/log/demisto/file.txt

Answer

By hardcoding the binary content of the file directly into the argument field

Question 5

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Accepted Answer

Verify content pack compatibility against the target XSOAR server version. Before major upgrades, administrators must back up the application database and configuration using demisto-ctl backup, and verify that all installed content packs and integrations are compatible with the target version.

Answer

Stop all inbound email fetching and incident ingestion streams

Answer

Uninstall all third-party marketplace content packs to prevent schema conflicts

Answer

Re-initialize the PostgreSQL database schema from scratch

Question 6

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Accepted Answer

sys.internal.limits.max.fetch.incidents. Incident ingestion rate and flow can be managed using configuration keys that control fetch limits, batch sizes, and throttling intervals.

Answer

server.jvm.garbage.collection.interval

Answer

docker.max.container.lifespan

Question 7

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks support loops and backward transitions (cycles) under specific conditions, allowing workflows to loop back to prior tasks.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 8

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

Accepted Answer

In the task's 'Assign to Incident Field' configuration setting. Data collection tasks allow mapping user inputs directly to incident fields using the task's 'Mapping' or 'Assign to Incident Field' settings.

Answer

In the 'Details' tab using custom markdown syntax

Answer

In the task's 'Inputs' tab under context mapping

Answer

In the 'Script arguments' section under the 'Key' parameter

Question 9

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. Playbook designers can add visual notes or descriptions to tasks and canvas areas to document workflow logic.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 10

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. Conditional tasks allow evaluating expressions, defining custom labels for branches, and setting a default fallback path.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands