XSOAR-Engineer Practice Questions 2 — 50 Questions

Question 1

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role in Cortex XSOAR holds full administrative privileges across the entire platform, including user management, system settings, integrations, and content. It is the highest-privilege built-in role and is the only one that can modify global configuration and manage other users. This makes it the correct answer for a question about full platform-wide administrative control.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 2

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Accepted Answer

To package related integrations, playbooks, scripts, and dashboards into a single installable unit. A Cortex XSOAR Content Pack is a versioned, installable bundle that packages related integrations, playbooks, scripts, dashboards, incident types, fields, and layouts into a single unit. It enables one-click installation and dependency management from the Marketplace. This is the primary mechanism for distributing and deploying XSOAR content.

Answer

To compile raw source code into executable binary binaries

Answer

To manage Docker container images for offline deployment

Answer

To store encrypted user passwords and API keys securely

Question 3

An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?

Accepted Answer

Process items in efficient batches and utilize native XSOAR demistomock/demisto execution patterns without infinite loops.. Python scripts in XSOAR should execute efficiently, handle pagination or batching, and avoid blocking operations that consume excessive engine resources.

Answer

Write all intermediate data to local hard disk files instead of the XSOAR context.

Answer

Use an infinite 'while True' loop with zero sleep time to poll the API continuously.

Answer

Execute OS-level shell commands using 'subprocess' to bypass XSOAR API restrictions.

Question 4

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Accepted Answer

Incident type playbook with an initial 'addWarRoomEntry' task. Because the link must appear automatically inside each new Phishing incident's War Room, the mechanism has to write a War Room entry during incident creation. Attaching a playbook to the incident type and including a task that calls addWarRoomEntry accomplishes exactly that, runs without analyst intervention, and keeps the runbook link consistent across every Phishing incident.

Answer

Incident field 'Details' populated by a classification mapping

Answer

Incident type layout with a War Room entry template

Answer

Custom dashboard widget filtered on incident type

Question 5

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Accepted Answer

Typing the remark into the War Room input box and pressing Enter to post a note. Posting free text in the War Room input box creates an analyst-attributed, timestamped note in the shared incident conversation, which is immediately visible to the whole team. It requires no command execution and preserves the analyst's rationale alongside the rest of the incident timeline, making it the appropriate action for this scenario.

Answer

Editing the incident's Details field from the incident summary panel

Answer

Adding a tag to the incident from the incident header

Answer

Running the '!setIncident' command with a custom field for the remark

Question 6

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 7

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Option B is correct because Cortex XSOAR incident layouts support custom tabs, which let administrators group related fields into logical sections such as Triage or Containment, reducing scrolling and making it faster for analysts to find and enter the data relevant to each phase of an investigation. Option D is correct because Markdown fields are a supported layout element that renders formatted text, so administrators can embed analyst instructions, response checklists, or contextual details directly in the incident form to guide data entry and standardize workflows. The remaining options do not belong: Active Directory domain controller synchronization schedules (A) are configured through integrations and jobs rather than incident layouts, kernel-level memory dump inspectors (C) are forensic tooling outside the layout editor, and embedded firewall policy modification wizards (E) are not a Cortex XSOAR layout component.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 8

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task in Cortex XSOAR is designed to pause the playbook and present instructions or a form to a human analyst for manual review or decision. This is ideal for phishing email review where an analyst must inspect the email and determine if it is malicious. Data Collection tasks gather data, Sub-playbooks run other playbooks, and Automation tasks execute scripts without human intervention.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 9

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. When Cortex XSOAR exports indicators to an external TAXII server, the STIX/TAXII server configuration includes mapping rules that determine which indicator properties are serialized into STIX objects. If custom fields are missing on the recipient side, the outgoing mapping is the first place to verify that those fields are included in the STIX pattern and object properties. The other options relate to unrelated subsystems (proxy, layouts, Syslog parsing) that do not affect TAXII export content.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 10

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.

Question 11

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. In Cortex XSOAR's custom dashboard widget builder, the natively supported chart/widget types include Line (B), Number (C), and Pie (E). Line (B) is correct because XSOAR provides a line chart widget for plotting trends of a selected query over time. Number (C) is correct because the Number widget displays a single aggregated value (such as a count or severity metric) from a query. Pie (E) is correct because XSOAR offers a pie chart widget to visualize proportional distribution of results by a chosen field. The unmarked options do not belong: 3D-Scatter (A) and Heatmap-Matrix (D) are not among the built-in widget types offered in the Cortex XSOAR custom dashboard widget creation interface.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 12

An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?

Accepted Answer

Write outputs to standardized XSOAR context keys (such as Account or Endpoint) so subsequent tasks can reference unified data.. In XSOAR playbook design, context data from multiple sources should be written to standardized context keys (e.g., Account, Endpoint, IP) so that subsequent tasks can reference a unified data model. This enables correlation and enrichment across disparate sources without manual intervention. Using standardized keys allows built-in commands and scripts to automatically access and manipulate the data, ensuring consistency and scalability.

Answer

Save each source's data into a separate hardcoded local text file on the Linux host.

Answer

Manually email raw log dumps to all SOC analysts.

Answer

Delete previous task context before running the next integration.

Question 13

An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?

Accepted Answer

Manual task. A manual task is specifically designed to pause playbook execution and present a customizable form for human input. It is the appropriate task type for manual approvals, allowing the analyst to approve or reject an action before the playbook continues. Other task types either automate execution, evaluate conditions, or collect data without a built-in approval mechanism.

Answer

Data collection task

Answer

Standard task

Answer

Conditional task

Question 14

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

Accepted Answer

Download the content pack from another Cortex XSOAR instance with internet access and manually upload the pack file via the Marketplace interface.. In an air-gapped environment, content packs can be installed by manually uploading a pack file obtained from a connected system or the support portal. This is the supported offline installation method. Proxy configuration, SDK commands, or non-existent offline mode settings do not work when all outbound access is blocked.

Answer

Use the command-line tool 'demisto-sdk download' to fetch the pack directly on the server.

Answer

Configure a proxy server in Cortex XSOAR settings to allow Marketplace access.

Answer

Enable the 'Offline Mode' checkbox in the Marketplace settings, which allows installation from a local repository.

Question 15

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Accepted Answer

Threat Intel Dashboards / Overview workspace. Cortex XSOAR exposes threat intel summary metrics — total indicators, breakdown by indicator type, and top malicious sources — through the Threat Intel Dashboards and Overview workspace. This is the dedicated UI surface for aggregated indicator statistics and source reputation. Administrators use it to monitor feed health and indicator volume.

Answer

Automation > Monitoring > Indicator Stats

Answer

Incidents > Metrics

Answer

Settings > About > System Statistics

Question 16

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

Accepted Answer

To provide human-readable documentation on the playbook's purpose and workflow. The Playbook Description field in Cortex XSOAR is a free-text metadata field used to document the playbook's purpose, scope, and workflow for human readers. It appears in the playbook library and helps analysts and engineers understand what the playbook does without opening and tracing every task.

Answer

To define the regex pattern used for email parsing

Answer

To store encrypted API credentials for sub-playbooks

Answer

To execute initialization scripts when the playbook starts

Question 17

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

Accepted Answer

The Loop feature configured directly on the task properties. To iterate over a list of items in XSOAR context, the engineer uses the Loop feature on the task, specifying the target context array.

Answer

A transformer function in the mapping section

Answer

A sub-playbook with parallel task execution

Answer

A Condition task evaluating the length of the Account array

Question 18

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

Accepted Answer

Configure the playbook trigger rules or associate it with an incident type that excludes automatic classifier fetching.. Playbooks can be restricted by type or execution triggers. To prevent automatic triggering while allowing manual execution, the playbook should be associated with specific incident types or configured as manual-only.

Answer

Disable the integration instance responsible for email fetching.

Answer

Set the playbook role restriction to Administrator only.

Answer

Delete the start task of the playbook.

Question 19

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Accepted Answer

Executing the sub-playbook either synchronously or asynchronously. Option B is correct because Cortex XSOAR sub-playbooks can be invoked with the 'RunAsynchronously' setting, allowing the parent playbook to either wait for the sub-playbook to finish (synchronous) or continue execution while the sub-playbook runs in parallel (asynchronous). Option C is correct because the sub-playbook task configuration includes an 'Inputs' section where parent playbook context keys are mapped to the sub-playbook's defined input arguments, enabling data to flow into the sub-playbook. Option E is correct because the sub-playbook task also has an 'Outputs' section that maps the sub-playbook's output keys back into the parent playbook context, making the results available to subsequent tasks in the parent. Option A is incorrect because Cortex XSOAR playbooks operate at the orchestration layer and cannot directly modify OS kernel parameters. Option D is incorrect because sub-playbooks are interpreted automation content within the XSOAR engine, not compiled into native binary executables.

Answer

Directly modifying the underlying OS kernel parameters

Answer

Compiling the sub-playbook into a native binary executable file

Question 20

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

Accepted Answer

Native installer script. For installing Cortex XSOAR server on a Linux distribution like Ubuntu, Palo Alto Networks provides a native installer script. This script handles the installation of all necessary components and is the officially supported method. Other methods like Docker Compose, Helm charts, or manual compilation are not supported for the server component. Therefore, the native installer script is the correct choice.

Answer

Docker Compose deployment

Answer

Manual compilation from source code

Answer

Kubernetes Helm chart