XSOAR-Engineer Hard Questions — 25 Difficult Questions

Question 1

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Accepted Answer

Incident Type playbook association settings. Playbook triggering depends on Incident Type mapping, Playbook auto-assignment settings on the incident type, and integration mapper configurations.

Answer

The BIOS version of the underlying hypervisor host

Answer

Browser cookie expiration settings in client workstations

Question 2

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Accepted Answer

Excel (XLSX). The Incident WorkArea supports exporting data to formats like CSV and Excel (XLSX).

Answer

Windows Registry hive file (.HIV)

Answer

Direct binary memory dump (.DMP)

Question 3

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Accepted Answer

Navigate to the Playbook tab within the incident, select the specific task, and choose 'Force Run'. Analysts can use the 'task' or similar War Room CLI capabilities or interact with the Playbook tab directly to force execution, but forcing task execution via the Playbook view or CLI override allows manual intervention.

Answer

Restart the entire XSOAR server container to reset playbook state machines

Answer

Type '!force-playbook-task' directly in the War Room CLI without parameters

Answer

Edit the incident type schema to automatically convert all conditional tasks to automatic

Question 4

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Accepted Answer

Execution schedule / frequency. Scheduled reports require a defined report template/definition and a schedule/recurrence setting.

Answer

Elasticsearch cluster shard allocation count

Answer

Raw SSH credentials of the target email relay

Answer

Active Directory bind password for report viewers

Question 5

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Accepted Answer

Hover over the specific War Room entry, click the options menu, and select 'Delete'. War Room entries can be deleted or edited depending on user permissions and entry types, or masked if configured, but individual entries can be deleted by authorized users.

Answer

Modify the integration code to retroactively scrub historical database entries

Answer

Lock the incident, which automatically sanitizes all War Room text matching regex patterns

Answer

Run the '!clear-war-room-secrets' command with the entry ID

Question 6

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget queries use XSOAR query language and time ranges; refining the query scope and time range improves performance.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 7

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The WorkArea allows bulk actions such as assigning owners, changing incident types, closing incidents, and running playbooks in bulk.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 8

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Accepted Answer

Auto-extract indicator settings. Custom incident types can be associated with default playbooks, custom layouts, and specific auto-extract settings.

Answer

Motherboard BIOS serial number

Answer

RAID array stripe size

Question 9

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. When upgrading a high-availability Cortex XSOAR environment, the primary server must be updated first, followed by secondary servers, and finally engines.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 10

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Registry Configuration. Private Docker registry credentials are configured in Settings > Integrations > Servers and Services or via specific Docker daemon / server configuration properties depending on the deployment architecture.

Answer

Via the demisto-sdk registry-login command

Answer

In the individual integration instance settings under API Key

Answer

Inside the demisto.conf configuration file on the Linux host file system

Question 11

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. High availability and disaster recovery best practices include deploying an external replicated PostgreSQL database, utilizing active-active server clusters with a load balancer, and scheduling automated offsite backups.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 12

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Accepted Answer

Clone the playbook, make modifications to the clone, and use the customized clone in your workflows.. To customize built-in content safely, you should clone the playbook, modify the clone, and use the cloned version in your incident types.

Answer

Lock the content pack version in Marketplace settings to prevent all future updates.

Answer

Override playbook tasks by creating a separate script with the same name.

Answer

Edit the content pack files directly on the filesystem via SSH.

Question 13

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

Accepted Answer

Yes, but only through Loop Tasks or explicit conditional paths that allow looping back to earlier task nodes.. Cortex XSOAR playbooks support loops and backward transitions (cycles) under specific conditions, allowing workflows to loop back to prior tasks.

Answer

Yes, by editing the raw JSON and inserting a goto statement.

Answer

No, backward navigation is only possible by terminating the incident and creating a new one.

Answer

No, XSOAR playbooks are strictly directed acyclic graphs (DAGs) and never permit backward transitions.

Question 14

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Accepted Answer

Source trust levels and weights. Indicator scoring is determined by source weight/trust levels and indicator scoring rules configured in the platform.

Answer

The resolution of the user's browser screen

Answer

The total number of open incidents in the War Room

Answer

The physical geographic location of the XSOAR server

Question 15

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Accepted Answer

Provide the client ID, client secret, and token URL in the integration instance configuration fields designed for OAuth2.. Integration instances supporting OAuth2 utilize built-in authentication parameters where credentials and token endpoints are supplied for automatic token management.

Answer

Hardcode the Bearer token into the integration script source code.

Answer

Write a cron job on the host OS to generate tokens and write them to a shared file.

Answer

Configure a separate incident classification rule to handle authentication headers.

Question 16

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. TAXII server export configurations require defining which indicator fields and custom tags to include in the outgoing STIX collection mapping.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 17

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

Accepted Answer

TAXII Server URL (Discovery or Collection endpoint). TAXII client feeds require the discovery or collection URL and appropriate authentication credentials (such as API keys or basic auth).

Answer

Kernel-level TCP window size parameters

Answer

Local firewall packet filtering rules

Answer

Active Directory domain functional level

Question 18

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

Accepted Answer

demisto.createIndicators(indicators). Custom feed integrations use demisto.createIndicators() to submit parsed indicator objects to the XSOAR indicator engine.

Answer

demisto.incidents().create()

Answer

demisto.executeCommand('add-indicator', args)

Answer

demisto.setIndicatorReputation(values)

Question 19

An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?

Accepted Answer

Database replication (PostgreSQL) and Elasticsearch synchronization across all engine/server nodes.. XSOAR utilizes an active-active or active-passive architecture where the underlying PostgreSQL database and Elasticsearch stores must be synchronized or clustered.

Answer

Duplicating integration API keys in plain text within the system welcome banner.

Answer

Synchronizing browser cookies across all analyst workstations.

Answer

Manual copying of log files via FTP every week.

Question 20

An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?

Accepted Answer

Using demisto.getLastRun() and demisto.setLastRun() to persist cursor timestamps between execution cycles.. Integrations in XSOAR store pagination markers and last-run timestamps using `demisto.getLastRun()` and `demisto.setLastRun()`.

Answer

Writing the cursor value to a global environment variable in the operating system shell.

Answer

Storing the cursor in the browser local storage of the administrator who configured the instance.

Answer

Hardcoding the timestamp directly into the integration YAML source code.