XSOAR-Engineer Practice Test 9 — 10 Questions

Question 1

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Accepted Answer

Settings > Advanced > Server Configuration. Data retention, incident archiving, and cleanup schedules are managed under Settings > Advanced > Server Configuration.

Answer

Incidents > Retention Policies

Answer

Dashboards > Maintenance Settings

Answer

Settings > Integrations > Database Maintenance

Question 2

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Accepted Answer

In the integration instance configuration under Incoming Mapper. Integration instance mapper configurations handle mapping incoming raw data fields to XSOAR incident fields.

Answer

In the global Layouts customization menu

Answer

Inside the server.properties configuration file

Answer

Within the War Room CLI using the '!set-field' command

Question 3

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

Accepted Answer

High event volume and low operational complexity.. When prioritizing initial pilot use cases for XSOAR, best practices recommend selecting those with high event volume and low operational complexity. This allows the team to demonstrate quick wins, reduce alert fatigue, and build confidence in the platform without being bogged down by complex procedures or integrations.

Answer

Use cases that involve zero existing documentation or standard operating procedures.

Answer

Use cases requiring brand-new custom integrations with unsupported legacy APIs.

Answer

Extremely low event frequency and high procedural ambiguity.

Question 4

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. Option B is correct because Cortex XSOAR's supported disaster-recovery practice is to schedule automated backups of both the configuration and the database (e.g., via the built-in backup mechanism or scripts) and store them on secondary/off-box storage so the environment can be restored after node or site failure. Option C is correct because for high availability and DR, production deployments should use an external highly available PostgreSQL cluster (e.g., streaming replication with automatic failover) instead of the embedded database, which is single-node and unsuitable for HA. Option E is correct because placing a load balancer in front of multiple Cortex XSOAR application server nodes distributes traffic, enables health-check-based failover, and removes the application server as a single point of failure. Option A does not belong because running integration Docker containers in privileged root mode is a security anti-pattern and is not required for HA/DR. Option D does not belong because disabling database persistence sacrifices durability and would prevent recovery, directly contradicting disaster-recovery requirements.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 5

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Accepted Answer

URL. Cortex XSOAR includes predefined indicator types such as URL, IP, Domain, and File Hash.

Answer

IP

Answer

File Hash

Answer

Domain

Question 6

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

Accepted Answer

Connect the preceding task to all three tasks in parallel, and route them into the joining task.. To run multiple tasks concurrently, you connect the preceding task to all three tasks simultaneously, and then connect all three tasks into the subsequent analysis task to join the workflow.

Answer

Wrap them inside a single Data Collection Task.

Answer

Place them in a serial chain one after another.

Answer

Use a Loop Task with a batch size of 3.

Question 7

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Option B is correct because task inputs in a playbook support dynamic context path references written with the ${} syntax, which resolves values from the playbook's context at runtime (for example ${incident.id} or ${alert.name}). Option E is correct because static text can be typed directly into the argument field, providing a literal value that is passed to the command argument without any resolution step. Option A is incorrect because playbooks do not query the internal PostgreSQL database directly to populate task arguments; data is supplied through context or static input. Option C is incorrect because memory pointer addresses in C syntax are not a supported input mechanism in playbook task configuration. Option D is incorrect because local environment variables set via bash export are not a supported way to pass values into playbook task arguments.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands

Question 8

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Accepted Answer

${incident.id}. In Cortex XSOAR, the ${incident.id} context path resolves to the unique ID of the current incident at runtime, making it the correct way to dynamically reference the incident ID inside a War Room script or playbook task.

Answer

${playbook.case_id}

Answer

${active.incident_number}

Answer

${demisto.current_id}

Question 9

An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?

Accepted Answer

Configure a polling loop with a wait/sleep task that periodically checks the sandbox job status until completion.. Using a timer/sleep task or polling loop combined with a wait-for-results mechanism (or callback/webhook) allows the playbook to check status periodically without wasting continuous active processing time.

Answer

Increase the server RAM allocation to allow blocking threads.

Answer

Run an infinite loop with zero delay checking the API every millisecond.

Answer

Terminate the playbook immediately and require manual review for all files.

Question 10

When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?

Accepted Answer

Disabling an Active Directory user account associated with confirmed malicious activity outside business hours.. High-confidence, low-impact actions like disabling a compromised Active Directory account are prime candidates for automated containment once the threat level is verified.

Answer

Terminating employment status of a suspected insider threat.

Answer

Deleting primary database backups on suspicion of data exfiltration.

Answer

Revoking executive internet access during an ongoing ransomware outbreak.