XSOAR-Engineer Practice Test 7 — 10 Questions

Question 1

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Accepted Answer

Fetch interval frequency. Generic feed integrations require URL endpoints, fetch intervals, and indicator type mappings to function properly.

Answer

Active directory domain controller IP address

Answer

Syslog server forwarding port

Question 2

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Accepted Answer

Condition. Flow control tasks in XSOAR include Condition tasks (for branching) and Parallel tasks (for splitting execution paths).

Answer

Credential

Answer

Enrichment

Answer

Mirroring

Question 3

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. XSOAR normalizes indicator values based on indicator type definitions to prevent duplicates from casing or minor formatting differences.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 4

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Accepted Answer

Source trust levels and weights. Indicator scoring is determined by source weight/trust levels and indicator scoring rules configured in the platform.

Answer

The resolution of the user's browser screen

Answer

The total number of open incidents in the War Room

Answer

The physical geographic location of the XSOAR server

Question 5

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

Accepted Answer

High event volume and low operational complexity.. High volume combined with low complexity (quick wins) delivers immediate demonstrable value and builds stakeholder confidence in the XSOAR platform.

Answer

Use cases that involve zero existing documentation or standard operating procedures.

Answer

Use cases requiring brand-new custom integrations with unsupported legacy APIs.

Answer

Extremely low event frequency and high procedural ambiguity.

Question 6

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. Indicator impact on incident severity can be configured or tuned within Advanced settings or indicator scoring configurations.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator

Question 7

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Accepted Answer

The global search bar at the top of the Cortex XSOAR interface.. The global search bar in Cortex XSOAR supports searching for indicators directly by value.

Answer

Automation > Playground > Test Hash

Answer

Settings > Integrations > Global Search

Answer

Incidents > Filter > Hash Lookup

Question 8

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Accepted Answer

Provide the client ID, client secret, and token URL in the integration instance configuration fields designed for OAuth2.. Integration instances supporting OAuth2 utilize built-in authentication parameters where credentials and token endpoints are supplied for automatic token management.

Answer

Hardcode the Bearer token into the integration script source code.

Answer

Write a cron job on the host OS to generate tokens and write them to a shared file.

Answer

Configure a separate incident classification rule to handle authentication headers.

Question 9

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. XSOAR indicator queries utilize specific syntax such as type:IP and reputation:Bad combined with tag filters.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 10

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Accepted Answer

Threat Intel Dashboards / Overview workspace. The Threat Intel dashboard provides out-of-the-box widgets and metrics summarizing indicator statistics.

Answer

Automation > Monitoring > Indicator Stats

Answer

Incidents > Metrics

Answer

Settings > About > System Statistics