XSOAR-Engineer Practice Test 8 — 10 Questions

Question 1

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Accepted Answer

'ToLower' to convert string characters to lowercase. Option A ('ToLower') is correct because Cortex XSOAR's built-in transformer set includes string transformers such as ToLower, which converts all characters in a given string value to lowercase within a context expression. Option D ('concat') is correct because concat is a built-in transformer that joins multiple string values together, allowing playbook authors to assemble composite strings from separate context fields. Option E ('uniq') is correct because uniq is a built-in list transformer that removes duplicate elements from a list, which is a standard list-manipulation operation in XSOAR context expressions. Option B ('CompileToMachineCode') is not a real XSOAR transformer; XSOAR does not compile context data into native x86 assembly. Option C ('EncryptDatabase') is also not a built-in transformer; XSOAR does not expose a transformer that secures SQL storage, as database encryption is not a context-expression string or list manipulation.

Answer

'CompileToMachineCode' to convert context into native x86 assembly

Answer

'EncryptDatabase' to secure SQL storage

Question 2

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Accepted Answer

Disable SSL verification in the integration instance configuration parameters if the option is available, or add the CA certificate to the trust store.. Custom or self-signed certificates must be added to the XSOAR server trust store or the integration instance must have certificate validation disabled if supported.

Answer

Delete the integration instance and recreate it using HTTP instead of HTTPS.

Answer

Increase the timeout threshold in server configuration.

Answer

Modify the feed provider's web server configuration.

Question 3

An organization is planning an XSOAR use case for vulnerability management triage. Vulnerability scans produce hundreds of thousands of findings daily. To prevent XSOAR from running out of memory or overwhelming the database, what is the best practice for ingestion planning?

Accepted Answer

Implement integration-level filters or pre-processing rules to ingest only high and critical severity vulnerabilities.. Filtering out low-risk or informational vulnerabilities at the integration level or ingest filter stage prevents unnecessary database bloat.

Answer

Store all vulnerability payloads as plain text strings in a single custom incident field.

Answer

Disable incident auto-saving entirely so data only exists in analyst memory.

Answer

Ingest all raw vulnerabilities as individual high-priority incidents without exception.

Question 4

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

Accepted Answer

Pass password parameters to the file extraction task, or design a prompt for an analyst to supply known container passwords.. XSOAR's file extraction tasks (e.g., the 'Extract Archive' or 'Unzip File' commands) accept a password parameter that allows the playbook to programmatically supply known passwords, such as the common 'infected' password used in malware analysis. Additionally, when the password is unknown, the playbook can use an analyst prompt task (e.g., 'Ask' or 'Manual Task') to request the password from a human analyst, enabling dynamic handling of password-protected archives. This approach balances automation with human intervention, ensuring that encrypted files are properly processed without data loss.

Answer

Convert all archive files into plain text PDF documents automatically.

Answer

Restart the XSOAR server container to clear encryption keys.

Answer

Instantly delete any file ending in a .zip extension without inspection.

Question 5

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

Accepted Answer

By enabling 'Auto-extract indicators' in the incident type or task output configuration settings. Indicators returned by automation scripts or commands in standard task outputs can be automatically processed and ingested into the Threat Intel module based on mapping and indicator extraction settings.

Answer

By writing all indicators manually to a local CSV file on the server

Answer

By assigning the playbook to the 'Indicator' incident type exclusively

Answer

By restarting the Cortex XSOAR server daemon

Question 6

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Settings > Import / Export > Import. This is the built-in Cortex XSOAR UI feature specifically designed to import a previously exported content bundle (a .zip file containing playbooks, scripts, layouts, and other custom content) from one environment into another. It handles dependency resolution and version compatibility, making it the standard method for migrating custom content between development and production instances.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 7

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

Accepted Answer

The evaluation of the task's conditional expression against the current Incident Context. In Cortex XSOAR, a task's Conditions tab defines a conditional expression that is evaluated against the current incident context (the JSON data available at that point in the playbook). If the expression evaluates to true, the task runs; if false, the task is skipped. This is the mechanism that determines task execution.

Answer

The integration instance health status

Answer

The system clock and task timeout thresholds

Answer

The user permissions of the analyst who opened the incident

Question 8

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Option A is correct because a Content Pack must declare its integration dependencies (or the specific integration commands the playbook invokes) so that the target production environment has the required integrations installed and configured before the playbook runs. Option D is correct because custom automation scripts and transformers referenced by playbook tasks are not built-in and must be packaged or referenced in the pack, otherwise tasks will fail with missing-script errors. Option E is correct because any dependent sub-playbooks called by the main playbook must also be included or referenced in the pack, since sub-playbooks are separate content items and will not resolve automatically in the target environment. Option B is not correct because war room chat logs are runtime artifacts of the development environment, not deployable content, and are irrelevant to pack installation or execution. Option C is not correct because analyst credentials and password hashes are environment-specific secrets that should never be exported in a Content Pack and are not required for the playbook to install or run.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.

Question 9

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

Accepted Answer

Automation -> Playbooks. In the Cortex XSOAR UI, playbooks are created and modified visually under the 'Automation' tab, specifically the 'Playbooks' section. This is where the Playbook Designer is accessible, allowing drag-and-drop editing of tasks, conditions, and flows. The other options refer to unrelated UI areas such as dashboards, integrations, or incident analysis, which do not host the playbook editor.

Answer

Dashboards -> Widgets -> Playbook Designer

Answer

Settings -> Integrations -> Playbooks

Answer

Incidents -> Analysis -> Playbooks

Question 10

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Accepted Answer

Built-in export features in integration instances (e.g., Filebeat, Syslog, or API export). Option B is correct because Cortex XSOAR integration instances such as Filebeat, Syslog, and generic API-based integrations provide built-in export capabilities that forward indicators to external systems. Option C is correct because a TAXII server integration instance in Cortex XSOAR exposes indicators over the TAXII protocol, allowing external threat intelligence platforms to consume them. Option D is correct because playbooks can invoke SIEM or firewall integration commands (push actions) to send indicators to those external systems as part of an automated workflow. Option A is incorrect because flushing server cache with OS kill commands is an administrative action that does not export indicators and could destabilize the server. Option E is incorrect because directly editing PostgreSQL database files bypasses supported APIs, risks corruption, and is not a valid export method.

Answer

Flushing the server cache memory using OS kill commands

Answer

Directly modifying the underlying PostgreSQL database files via text editor