XSOAR-Engineer Hard Questions — 25 Difficult Questions

Question 1

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.. The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder. Minimizing downtime is achieved by the sequential approach.

Answer

Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.

Answer

Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.

Answer

Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.

Question 2

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Accepted Answer

Open the indicator's details page and review the 'Sources' field, which lists all feeds and manual entries that reported the indicator.. The Sources field on an indicator's details page is the authoritative place to see all feeds and manual entries that have reported the indicator. It aggregates every source that contributed to the indicator's presence and reputation, enabling analysts to assess which threat intelligence sources consider the IP malicious. This is the most direct and accurate method.

Answer

Run the '!ip' command in the CLI to query the indicator and view its reputation score.

Answer

Navigate to the Threat Intel page and apply a filter by the indicator's value to see all related incidents.

Answer

Check the incident's War Room entries for any feed integration logs that mention the indicator.

Question 3

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Take a full backup of the Cortex XSOAR server, including the configuration and data.. Before upgrading, you must back up the server and verify PostgreSQL compatibility. Engines are upgraded after the server, and disabling integrations or migrating the database is not required. These two actions ensure a safe upgrade path.

Answer

Migrate the PostgreSQL database to the same server as Cortex XSOAR to simplify the upgrade.

Answer

Upgrade all engines to the same version as the server before upgrading the server.

Answer

Disable all integrations and playbooks to prevent data corruption during the upgrade.

Question 4

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 5

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Accepted Answer

Type the note in the War Room text box and use Markdown table syntax. The War Room note editor supports Markdown, which includes table syntax. By typing the note using Markdown table syntax, the analyst can create a formatted table that renders in the War Room, making the indicators easily readable. This is the most direct and standard method for adding formatted notes.

Answer

Use the 'Add Note' button and select the 'Table' option from the formatting toolbar

Answer

Attach a CSV file containing the indicators

Answer

Create a dashboard widget with the indicators and link it in the note

Question 6

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

Accepted Answer

The corresponding field element in the incident layout is configured as a single-select dropdown instead of multi-select. Layout configurations must match field types; if the layout element is configured as a single select or dropdown instead of multi-select, or if the field definition itself was incorrectly set, behavior is restricted. Assuming layout field configuration.

Answer

Multi-select fields are not supported in custom incident types

Answer

All multi-select fields require an active threat intelligence feed license

Answer

The database index for multi-select fields must be rebuilt via CLI using '!rebuild-index'

Question 7

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Accepted Answer

Identifying correct JSONPath expressions for indicator fields. Option D is correct because a non-standard JSON threat feed has no predefined parser, so you must determine the exact JSONPath expressions (e.g., $.data[].attributes.value) that locate each indicator field such as IP, domain, or hash within the nested JSON structure. Option E is correct because once values are extracted, they must be mapped to the standard XSOAR indicator schema attributes (e.g., ip, domain, filehash, or the relevant indicator type fields) so the platform can normalize, deduplicate, and enrich them correctly. Option A is incorrect because custom C++ kernel modules are unnecessary and inappropriate for parsing JSON feed data in XSOAR. Option B is incorrect because modifying the XSOAR source code repository is not required and would break supportability; custom mapping is done through configuration and integration code, not core source edits. Option C is incorrect because hardware load balancers address traffic distribution and availability, not indicator field extraction or schema mapping.

Answer

Writing custom C++ kernel modules for memory parsing

Answer

Modifying the XSOAR source code repository

Answer

Configuring hardware load balancers for the feed server

Question 8

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Accepted Answer

By configuring the indicator mapping in the export integration instance settings.. Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.

Answer

By adding the attribute to the incident layout editor.

Answer

By modifying the server configuration key 'vim.export.custom.fields'.

Answer

By writing a post-processing automation script that directly injects XML tags into the firewall API.

Question 9

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

Accepted Answer

Sub-playbook outputs must be explicitly mapped in the sub-playbook task configuration under 'Outputs' to merge into the parent context.. By default, sub-playbooks run in their own scoped context namespace, but output keys can be mapped back to the parent playbook's context using the sub-playbook task configuration.

Answer

Sub-playbooks share the exact same global context without any isolation or scoping.

Answer

All sub-playbook context keys automatically overwrite parent context keys with identical names without mapping.

Answer

Context promotion requires a dedicated python script usingdemisto.setContext() with the 'parent' flag.

Question 10

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

Accepted Answer

Tenant management features (or RBAC combined with incident query filters and role-based permissions).. RBAC roles combined with tenant accounts or query filters ensure that users only see incidents and data relevant to their specific department or tenant context.

Answer

Modifying the default CSS stylesheet to hide sensitive UI elements.

Answer

Configuring distinct API keys for every individual playbook task.

Answer

Running multiple separate Linux virtual machines on the same physical server without XSOAR tenant settings.

Question 11

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

Accepted Answer

Run 'demisto-ctl clean-history' to purge old logs and temporary files.. The demisto-ctl tool provides administrative utilities, and housekeeping configurations handle file pruning, while direct manual file deletion can cause corruption.

Answer

Drop the PostgreSQL temporary tables using psql.

Answer

Restart the demisto service with the '--purge-cache' flag.

Answer

Execute 'rm -rf /var/lib/demisto/tmp/*' directly from the Linux shell.

Question 12

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Accepted Answer

Settings > Advanced > Indicator Types > [Type] > Auto-enrichment Playbook. Enrichment playbooks can be linked directly to indicator types or feed ingestion pipelines to automatically run enrichment tasks upon creation.

Answer

Settings > Integrations > Instances > Enrichment Settings

Answer

Incidents > Classification & Mapping > Indicator Rules

Answer

Threat Intel > Feeds > Automation Rules

Question 13

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 14

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 15

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Accepted Answer

The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.. Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Answer

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Answer

The user's email address contains uppercase characters.

Answer

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Question 16

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Accepted Answer

server.jvm.max.memory. The JVM heap size for the Cortex XSOAR server is controlled via the server configuration parameters, specifically server.jvm.max.memory or system environment variables like JAVA_OPTS.

Answer

demisto.engine.memory.limit

Answer

incident.ingestion.buffersize

Answer

python.max.worker.memory

Question 17

An engineer has configured a Loop Task in a playbook to iterate over a list of 50 IP addresses. To prevent the playbook from timing out or overwhelming the external API, the engineer needs to execute batches of 10 items concurrently. Where is this concurrency setting configured?

Accepted Answer

In the Loop tab of the specific playbook task properties drawer. In XSOAR loop task configurations, the concurrency or batch size can be defined under the task's Loop configuration settings to control parallel execution limits.

Answer

In the playbook-level JSON file under the 'canvas' properties

Answer

In the integration instance settings for the executed command

Answer

In the global server configuration (Server Settings -> Incidents)

Question 18

Which THREE actions can be performed using the Loop task configuration in a Cortex XSOAR playbook? (Choose three)

Accepted Answer

Iterate over a list of items stored in the incident context. Option B is correct because the Loop task in a Cortex XSOAR playbook is designed to iterate over a list of items (for example, an array stored under a context key such as ${incident.items}) and run its sub-tasks once per element. Option D is correct because the Loop task configuration exposes settings for batch size and concurrency, allowing parallel iterations to be throttled so that only a defined number run simultaneously. Option E is correct because the Loop task supports an exit/stop condition evaluated against the context, enabling the loop to terminate early when a specified expression becomes true. Option A is not a Loop task capability; generating PDF incident reports requires separate tasks or integrations, not the loop configuration. Option C is invalid because no playbook task can directly alter the core XSOAR database schema, which is managed by the platform itself.

Answer

Automatically convert all looped outputs into PDF incident reports

Answer

Directly modify the core XSOAR database schema during each iteration

Question 19

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget performance in XSOAR dashboards is dominated by the underlying Elasticsearch query — its time range, filter specificity, and aggregation complexity. Narrowing the time range reduces the number of indices and documents scanned, and tightening filters lets Elasticsearch use indexed fields instead of full scans. This directly reduces query latency and dashboard render time without altering the widget's purpose.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 20

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.