XSOAR-Engineer Practice Questions 1 — 50 Questions

Question 1

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. Reports are managed and generated from the Dashboards & Reports section in XSOAR.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 2

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. Layouts in XSOAR define the visual presentation of incident details based on incident types.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration

Question 3

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. Filtering incidents in the WorkArea using query builder or pre-filtered views allows analysts to isolate specific criteria such as owner and status.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 4

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

Accepted Answer

Type the text directly into the War Room input bar and press Enter. War Room notes can be prefixed or tagged, but standard War Room entries are visible to all users with access to the incident. (Note: XSOAR War Room entries are generally visible to all incident viewers unless using specific role permissions, but standard entry is typed directly into the CLI/input box). Let's frame around standard entry.

Answer

Use the '!private-note' automation command

Answer

Export the incident to an encrypted ZIP file

Answer

Navigate to Settings > Security > War Room Encryption

Question 5

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Accepted Answer

Incident Type playbook association settings. Playbook triggering depends on Incident Type mapping, Playbook auto-assignment settings on the incident type, and integration mapper configurations.

Answer

The BIOS version of the underlying hypervisor host

Answer

Browser cookie expiration settings in client workstations

Question 6

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Accepted Answer

Excel (XLSX). The Incident WorkArea supports exporting data to formats like CSV and Excel (XLSX).

Answer

Windows Registry hive file (.HIV)

Answer

Direct binary memory dump (.DMP)

Question 7

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Accepted Answer

Navigate to the Playbook tab within the incident, select the specific task, and choose 'Force Run'. Analysts can use the 'task' or similar War Room CLI capabilities or interact with the Playbook tab directly to force execution, but forcing task execution via the Playbook view or CLI override allows manual intervention.

Answer

Restart the entire XSOAR server container to reset playbook state machines

Answer

Type '!force-playbook-task' directly in the War Room CLI without parameters

Answer

Edit the incident type schema to automatically convert all conditional tasks to automatic

Question 8

An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?

Accepted Answer

closed > 24hours. Time-based queries in XSOAR use keywords like 'closed' and relative time ranges like 'closed > 24hours'.

Answer

active:false and duration<1d

Answer

status:closed and time:today

Answer

closeddate:past-day

Question 9

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Accepted Answer

Execution schedule / frequency. Scheduled reports require a defined report template/definition and a schedule/recurrence setting.

Answer

Elasticsearch cluster shard allocation count

Answer

Raw SSH credentials of the target email relay

Answer

Active Directory bind password for report viewers

Question 10

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Accepted Answer

The Owner dropdown field in the incident header. The Owner field in the incident header or layout allows quick assignment to users.

Answer

The Close Incident button

Answer

The Playbook graph zoom button

Answer

The War Room attachment paperclip icon

Question 11

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Accepted Answer

${incident.id}. XSOAR automation contexts use incident metadata paths such as ${incident.id}.

Answer

${playbook.case_id}

Answer

${active.incident_number}

Answer

${demisto.current_id}

Question 12

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Accepted Answer

Hover over the specific War Room entry, click the options menu, and select 'Delete'. War Room entries can be deleted or edited depending on user permissions and entry types, or masked if configured, but individual entries can be deleted by authorized users.

Answer

Modify the integration code to retroactively scrub historical database entries

Answer

Lock the incident, which automatically sanitizes all War Room text matching regex patterns

Answer

Run the '!clear-war-room-secrets' command with the entry ID

Question 13

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. Pie chart widgets are used to show distribution ratios across categories like severity.

Answer

Bar

Answer

Number

Answer

Line

Question 14

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Accepted Answer

The War Room tab. The War Room maintains the complete chronological audit trail of actions, commands, and outputs.

Answer

The Threat Intel tab

Answer

Settings > About

Question 15

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget queries use XSOAR query language and time ranges; refining the query scope and time range improves performance.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 16

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The WorkArea allows bulk actions such as assigning owners, changing incident types, closing incidents, and running playbooks in bulk.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 17

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Accepted Answer

Severity. Widgets query incidents using standard fields such as severity, status, owner, and incident type.

Answer

Ethernet MAC address

Answer

CPU cache size

Question 18

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Accepted Answer

To package related integrations, playbooks, scripts, and dashboards into a single installable unit. Content packs package related integrations, playbooks, layouts, and scripts into a single distributable and version-controlled unit.

Answer

To compile raw source code into executable binary binaries

Answer

To manage Docker container images for offline deployment

Answer

To store encrypted user passwords and API keys securely

Question 19

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Accepted Answer

The auto-refresh dropdown menu located in the dashboard header. Dashboard refresh intervals can be configured via the dashboard view controls.

Answer

Settings > Customization > UI Preferences

Answer

Dashboards > Widget Editor > Refresh Interval

Answer

Settings > Server Configuration > Dashboard.Refresh.Rate

Question 20

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Accepted Answer

Auto-extract indicator settings. Custom incident types can be associated with default playbooks, custom layouts, and specific auto-extract settings.

Answer

Motherboard BIOS serial number

Answer

RAID array stripe size