XSOAR-Engineer Practice Questions 1 — 50 Questions

Question 1

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.. The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder. Minimizing downtime is achieved by the sequential approach.

Answer

Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.

Answer

Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.

Answer

Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.

Question 2

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Accepted Answer

In indicator extraction settings or playbook conditional filters that check for private IP ranges (RFC 1918) before querying external APIs.. Indicator filters or classifier rules can be configured to ignore private, reserved, or internal IP ranges before sending queries to external commercial threat intel feeds.

Answer

By increasing the timeout value of the HTTP client.

Answer

By disabling all threat intelligence integrations entirely.

Answer

Within the user permission role definitions.

Question 3

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Accepted Answer

Open the indicator's details page and review the 'Sources' field, which lists all feeds and manual entries that reported the indicator.. The Sources field on an indicator's details page is the authoritative place to see all feeds and manual entries that have reported the indicator. It aggregates every source that contributed to the indicator's presence and reputation, enabling analysts to assess which threat intelligence sources consider the IP malicious. This is the most direct and accurate method.

Answer

Run the '!ip' command in the CLI to query the indicator and view its reputation score.

Answer

Navigate to the Threat Intel page and apply a filter by the indicator's value to see all related incidents.

Answer

Check the incident's War Room entries for any feed integration logs that mention the indicator.

Question 4

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?

Accepted Answer

In the integration instance configuration settings under mapper parameters.. Integration instance configuration settings provide the mapping interface between XSOAR incident fields and external ticketing system fields.

Answer

As part of the role-based access control (RBAC) permissions matrix.

Answer

Inside the Demisto system log file (/var/log/demisto/server.log).

Answer

Within the server health-check dashboard.

Question 5

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. In Cortex XSOAR, the widget creation wizard exposes a 'Widget Type' selector that includes Bar, Line, Pie, Number, Text, and others. A pie chart visualization is produced by selecting the Pie widget type, which renders incident counts grouped by a chosen field such as severity. This is the direct mapping between the desired visualization and the widget type option.

Answer

Bar

Answer

Number

Answer

Line

Question 6

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. The playbook design interface in Cortex XSOAR provides a task properties drawer where engineers can add Notes and Task Descriptions to document business logic, conditional branches, and expected outcomes. These fields are stored with the task definition and are visible to anyone editing or reviewing the playbook, making them the correct place for inline documentation. This keeps documentation versioned alongside the playbook itself rather than in external channels.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 7

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 8

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Accepted Answer

Incident closure layout with a required 'Close Notes' field for the relevant classification.. Closure layouts control the fields presented when closing an incident and can mark specific fields as required. Configuring the closure layout so Close Notes is mandatory for the False Positive classification ensures the rationale is captured before closure completes.

Answer

Incident field of type 'Long Text' with a validation regex that rejects empty values.

Answer

Playbook task that sends an email to the manager whenever an incident is closed.

Answer

Dashboard widget that counts incidents closed without notes and alerts the SOC manager.

Question 9

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Option A is correct because a clear, descriptive name that reflects the playbook's workflow purpose is essential for discoverability and for users to understand at a glance what the playbook does when browsing the organization-wide library. Option C is correct because documentation or a description explaining input requirements and expected outcomes ensures other analysts can correctly supply required inputs and understand what the playbook will produce, which is critical for reusable, organization-wide content. Option E is correct because associating the playbook with the appropriate Incident Types enables it to trigger automatically when relevant cases are created, which is the standard mechanism for mapping playbooks to case categories in platforms like Cortex XSOAR. Option B is not required because playbooks are defined as declarative workflows (YAML/JSON), not compiled binaries, and Windows execution is handled by integrations or scripts rather than an attached binary. Option D is incorrect and actively discouraged because hardcoding plain-text passwords violates security best practices; credentials should be stored in a secrets manager or credential store and referenced securely.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 10

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. In Cortex XSOAR, dashboards are shared via the built-in sharing mechanism. Clicking the share icon on a dashboard opens a dialog where you can assign view or edit permissions to specific roles, users, or everyone. Selecting the 'Tier2-SOC' role restricts visibility to only members of that role. This is the standard, supported method for role-based dashboard sharing.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 11

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 12

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

Accepted Answer

Define script arguments in the script settings and access them via demisto.args() in Python.. XSOAR automation scripts receive runtime parameters through script arguments, which are declared in the script's settings (YAML/metadata) and retrieved inside Python via demisto.args(). This allows administrators to configure values like thresholds per-task or per-playbook without editing source code. It is the standard, supported pattern for parameterizing automation.

Answer

Hardcode the threshold value directly as a global variable in every script file.

Answer

Write the value to the server's /etc/passwd configuration file.

Answer

Store the threshold inside a browser cookie on the analyst's machine.

Question 13

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Accepted Answer

Type the note in the War Room text box and use Markdown table syntax. The War Room note editor supports Markdown, which includes table syntax. By typing the note using Markdown table syntax, the analyst can create a formatted table that renders in the War Room, making the indicators easily readable. This is the most direct and standard method for adding formatted notes.

Answer

Use the 'Add Note' button and select the 'Table' option from the formatting toolbar

Answer

Attach a CSV file containing the indicators

Answer

Create a dashboard widget with the indicators and link it in the note

Question 14

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Accepted Answer

The Cortex XSOAR server. The Cortex XSOAR server is the central component that distributes incidents and tasks to engines. It manages incident state, playbook execution, and engine communication. Load balancers, message queues, and engine hierarchy do not play a role in task distribution.

Answer

The load balancer

Answer

The message queue service

Answer

The engine that was installed first

Question 15

An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?

Accepted Answer

Use the ${incident.id} and ${incident.severity} placeholders in the Slack message text.. The ${incident.id} and ${incident.severity} placeholders allow the playbook to dynamically insert the incident's ID and severity into the Slack message. This ensures each notification contains the relevant details for that specific incident, enabling effective communication without manual intervention.

Answer

Use a script task to retrieve incident details and store them in the context, then reference the context in the Slack message.

Answer

Configure the Slack integration to automatically append incident details to all messages.

Answer

Create a custom incident field that concatenates the ID and severity, then use that field in the Slack message.

Question 16

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Accepted Answer

Configure the engine to connect outbound to the server on port 443 using the engine key.. Engines connect outbound to the XSOAR server on the configured port, authenticating with an engine key. This allows deployment in restricted networks where only outbound TCP 443 is permitted. The server does not initiate connections to the engine, so no inbound rules are needed. Other options either misstate the communication direction or propose unsupported mechanisms.

Answer

Deploy the engine as a Docker container on the XSOAR server and use the loopback interface.

Answer

Set the engine to use a reverse tunnel over HTTPS to the server.

Answer

Open inbound port 443 on the firewall to allow the server to push tasks to the engine.

Question 17

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 18

An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?

Accepted Answer

Create a sub-playbook containing the tasks and call it from the parent playbooks.. Sub-playbooks are the native reuse mechanism in Cortex XSOAR. They allow a set of tasks to be defined once and called from multiple parent playbooks, ensuring consistency and simplifying updates. The other options either duplicate logic, create disconnected copies, or rely on unsupported custom scripting, none of which meet the efficiency requirement.

Answer

Export the tasks as a playbook and import them into each playbook.

Answer

Use a script to dynamically generate the tasks at runtime.

Answer

Copy and paste the tasks into each playbook manually.

Question 19

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

Accepted Answer

Prompt Task. A Prompt Task in Cortex XSOAR is designed to pause playbook execution and present a question or decision to an analyst, allowing them to review indicators and choose to block or ignore. This task type is specifically built for human-in-the-loop interactions, ensuring analyst input before proceeding. It supports customizable prompts and response options.

Answer

Loop Task

Answer

Data Enrichment Task

Answer

Command Task

Question 20

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Current reputation and score. Option C is correct because the Indicator Details view in Cortex XSOAR prominently displays the indicator's current reputation (e.g., Good, Suspicious, Bad, Unknown) along with its calculated score, which reflects the aggregated threat intelligence verdict for that IOC. Option D is correct because the Indicator Details view lists the contributing feed sources (such as threat intel feeds and integrations) that supplied or enriched the indicator, allowing analysts to trace provenance and understand which sources influenced the reputation. Options A and B are incorrect because XSOAR does not expose administrator OS login passwords or the XSOAR server's raw BIOS serial numbers within an indicator record; those are unrelated to threat intelligence data. Option E is incorrect because physical GPS coordinates of a threat actor are not a standard field shown in an Indicator Details view, as indicators are technical artifacts (IPs, hashes, domains) rather than geolocation profiles of actors.

Answer

Administrator operating system login passwords

Answer

Raw BIOS serial numbers of the XSOAR server

Answer

Physical GPS coordinates of the threat actor