XSOAR-Engineer Practice Questions 2 — 50 Questions

Question 1

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

Accepted Answer

To provide human-readable documentation on the playbook's purpose and workflow. The description field provides documentation and details about what the playbook does, helping other analysts understand its purpose.

Answer

To define the regex pattern used for email parsing

Answer

To store encrypted API credentials for sub-playbooks

Answer

To execute initialization scripts when the playbook starts

Question 2

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

Accepted Answer

In the task's 'Conditions' tab by defining expression rules based on incident severity. Task-level execution conditions are configured within the task's 'Conditions' tab in the task properties drawer.

Answer

In the playbook JSON file by manually modifying the 'filters' array

Answer

In the server configuration under Incident Types

Answer

By writing a custom pre-processing script for every integration

Question 3

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Accepted Answer

Conditional Task. Playbook task types include Automation, Conditional, Manual, Sub-playbook, and Data Collection tasks.

Answer

Firewall Task

Answer

Database Task

Answer

Router Task

Question 4

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Task arguments can be populated with static text strings or dynamic context references enclosed in ${}.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands

Question 5

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. Feed integration instances in XSOAR rely on enabled fetch indicators settings and valid instance configurations to pull data into the Threat Intel page.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 6

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Accepted Answer

Executing the sub-playbook either synchronously or asynchronously. Sub-playbooks support input/output mapping to parent playbooks, independent versioning, and running standalone or nested.

Answer

Directly modifying the underlying OS kernel parameters

Answer

Compiling the sub-playbook into a native binary executable file

Question 7

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

Accepted Answer

Prompt Task. A Data Collection or Prompt task is designed to pause the playbook and request manual input or a decision from an analyst.

Answer

Loop Task

Answer

Data Enrichment Task

Answer

Command Task

Question 8

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR allow administrators to assign weights and precedence to different indicator sources to manage conflicts.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 9

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Playbooks standardize incident response workflows and automate repetitive tasks to reduce response times.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 10

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Accepted Answer

Lookback period or First fetch parameter. Feed integration instances typically include a 'First fetch' configuration parameter to determine historical data retrieval depth.

Answer

Fetch Interval frequency

Answer

Maximum Indicator Limit

Answer

Indicator Expiration Timer

Question 11

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Accepted Answer

Fetch interval frequency. Generic feed integrations require URL endpoints, fetch intervals, and indicator type mappings to function properly.

Answer

Active directory domain controller IP address

Answer

Syslog server forwarding port

Question 12

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Accepted Answer

Condition. Flow control tasks in XSOAR include Condition tasks (for branching) and Parallel tasks (for splitting execution paths).

Answer

Credential

Answer

Enrichment

Answer

Mirroring

Question 13

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. XSOAR normalizes indicator values based on indicator type definitions to prevent duplicates from casing or minor formatting differences.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 14

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Accepted Answer

Source trust levels and weights. Indicator scoring is determined by source weight/trust levels and indicator scoring rules configured in the platform.

Answer

The resolution of the user's browser screen

Answer

The total number of open incidents in the War Room

Answer

The physical geographic location of the XSOAR server

Question 15

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

Accepted Answer

High event volume and low operational complexity.. High volume combined with low complexity (quick wins) delivers immediate demonstrable value and builds stakeholder confidence in the XSOAR platform.

Answer

Use cases that involve zero existing documentation or standard operating procedures.

Answer

Use cases requiring brand-new custom integrations with unsupported legacy APIs.

Answer

Extremely low event frequency and high procedural ambiguity.

Question 16

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. Indicator impact on incident severity can be configured or tuned within Advanced settings or indicator scoring configurations.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator

Question 17

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Accepted Answer

The global search bar at the top of the Cortex XSOAR interface.. The global search bar in Cortex XSOAR supports searching for indicators directly by value.

Answer

Automation > Playground > Test Hash

Answer

Settings > Integrations > Global Search

Answer

Incidents > Filter > Hash Lookup

Question 18

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Accepted Answer

Provide the client ID, client secret, and token URL in the integration instance configuration fields designed for OAuth2.. Integration instances supporting OAuth2 utilize built-in authentication parameters where credentials and token endpoints are supplied for automatic token management.

Answer

Hardcode the Bearer token into the integration script source code.

Answer

Write a cron job on the host OS to generate tokens and write them to a shared file.

Answer

Configure a separate incident classification rule to handle authentication headers.

Question 19

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. XSOAR indicator queries utilize specific syntax such as type:IP and reputation:Bad combined with tag filters.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 20

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Accepted Answer

Threat Intel Dashboards / Overview workspace. The Threat Intel dashboard provides out-of-the-box widgets and metrics summarizing indicator statistics.

Answer

Automation > Monitoring > Indicator Stats

Answer

Incidents > Metrics

Answer

Settings > About > System Statistics