XSOAR-Engineer Practice Test 6 — 10 Questions

Question 1

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role in Cortex XSOAR holds full administrative privileges across the entire platform, including user management, system settings, integrations, and content. It is the highest-privilege built-in role and is the only one that can modify global configuration and manage other users. This makes it the correct answer for a question about full platform-wide administrative control.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 2

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Accepted Answer

To package related integrations, playbooks, scripts, and dashboards into a single installable unit. A Cortex XSOAR Content Pack is a versioned, installable bundle that packages related integrations, playbooks, scripts, dashboards, incident types, fields, and layouts into a single unit. It enables one-click installation and dependency management from the Marketplace. This is the primary mechanism for distributing and deploying XSOAR content.

Answer

To compile raw source code into executable binary binaries

Answer

To manage Docker container images for offline deployment

Answer

To store encrypted user passwords and API keys securely

Question 3

An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?

Accepted Answer

Process items in efficient batches and utilize native XSOAR demistomock/demisto execution patterns without infinite loops.. Python scripts in XSOAR should execute efficiently, handle pagination or batching, and avoid blocking operations that consume excessive engine resources.

Answer

Write all intermediate data to local hard disk files instead of the XSOAR context.

Answer

Use an infinite 'while True' loop with zero sleep time to poll the API continuously.

Answer

Execute OS-level shell commands using 'subprocess' to bypass XSOAR API restrictions.

Question 4

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

Accepted Answer

Incident type playbook with an initial 'addWarRoomEntry' task. Because the link must appear automatically inside each new Phishing incident's War Room, the mechanism has to write a War Room entry during incident creation. Attaching a playbook to the incident type and including a task that calls addWarRoomEntry accomplishes exactly that, runs without analyst intervention, and keeps the runbook link consistent across every Phishing incident.

Answer

Incident field 'Details' populated by a classification mapping

Answer

Incident type layout with a War Room entry template

Answer

Custom dashboard widget filtered on incident type

Question 5

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

Accepted Answer

Typing the remark into the War Room input box and pressing Enter to post a note. Posting free text in the War Room input box creates an analyst-attributed, timestamped note in the shared incident conversation, which is immediately visible to the whole team. It requires no command execution and preserves the analyst's rationale alongside the rest of the incident timeline, making it the appropriate action for this scenario.

Answer

Editing the incident's Details field from the incident summary panel

Answer

Adding a tag to the incident from the incident header

Answer

Running the '!setIncident' command with a custom field for the remark

Question 6

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 7

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Option B is correct because Cortex XSOAR incident layouts support custom tabs, which let administrators group related fields into logical sections such as Triage or Containment, reducing scrolling and making it faster for analysts to find and enter the data relevant to each phase of an investigation. Option D is correct because Markdown fields are a supported layout element that renders formatted text, so administrators can embed analyst instructions, response checklists, or contextual details directly in the incident form to guide data entry and standardize workflows. The remaining options do not belong: Active Directory domain controller synchronization schedules (A) are configured through integrations and jobs rather than incident layouts, kernel-level memory dump inspectors (C) are forensic tooling outside the layout editor, and embedded firewall policy modification wizards (E) are not a Cortex XSOAR layout component.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 8

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Accepted Answer

Manual Task. A Manual Task in Cortex XSOAR is designed to pause the playbook and present instructions or a form to a human analyst for manual review or decision. This is ideal for phishing email review where an analyst must inspect the email and determine if it is malicious. Data Collection tasks gather data, Sub-playbooks run other playbooks, and Automation tasks execute scripts without human intervention.

Answer

Data Collection Task

Answer

Sub-playbook Task

Answer

Automation Task

Question 9

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. When Cortex XSOAR exports indicators to an external TAXII server, the STIX/TAXII server configuration includes mapping rules that determine which indicator properties are serialized into STIX objects. If custom fields are missing on the recipient side, the outgoing mapping is the first place to verify that those fields are included in the STIX pattern and object properties. The other options relate to unrelated subsystems (proxy, layouts, Syslog parsing) that do not affect TAXII export content.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 10

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

Accepted Answer

Yes, sub-playbooks run synchronously by default, pausing the parent playbook until completion.. Sub-playbooks in XSOAR execute synchronously by default, meaning the parent task waits for the sub-playbook to finish before proceeding.

Answer

No, sub-playbooks require an explicit threading flag in the JSON canvas configuration.

Answer

No, sub-playbooks always run asynchronously, requiring a 'Wait for Sub-playbook' task afterwards.

Answer

Yes, but only if the sub-playbook contains fewer than 10 tasks.