XSOAR-Engineer Incident Interactions And Reporting Practice Test 3 — 15 Questions

Question 1

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Accepted Answer

Dashboards & Reports > Reports > Template management. Report templates in XSOAR use docx or HTML/PDF templates managed under Dashboards & Reports > Reports settings or template customization.

Answer

Settings > Integrations > Email Server > Templates

Answer

Settings > Customization > Branding & Logos

Answer

The incident layout editor under Settings > Customization > Layouts

Question 2

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Accepted Answer

${incident.id}. In Cortex XSOAR, the ${incident.id} context path resolves to the unique ID of the current incident at runtime, making it the correct way to dynamically reference the incident ID inside a War Room script or playbook task.

Answer

${playbook.case_id}

Answer

${active.incident_number}

Answer

${demisto.current_id}

Question 3

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. In Cortex XSOAR, dashboards are shared via the built-in sharing mechanism. Clicking the share icon on a dashboard opens a dialog where you can assign view or edit permissions to specific roles, users, or everyone. Selecting the 'Tier2-SOC' role restricts visibility to only members of that role. This is the standard, supported method for role-based dashboard sharing.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 4

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

Accepted Answer

Configure incident layout validation rules or closing rules requiring the 'closeReason' field. Closing rules or layout validation rules can require specific fields upon closure.

Answer

Enable 'Strict Mode' under Settings > Integrations

Answer

Delete the default close button and require analysts to use CLI commands exclusively

Answer

Modify the server license file to enable strict closure enforcement

Question 5

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Accepted Answer

The auto-refresh dropdown menu located in the dashboard header. In Cortex XSOAR, the refresh rate for an active dashboard is controlled directly from the dashboard header via an auto-refresh dropdown menu. This allows the user to select intervals such as 30 seconds, 1 minute, 5 minutes, etc., without navigating away from the dashboard. The setting is per-dashboard and takes effect immediately, causing all widgets to update automatically at the chosen interval.

Answer

Settings > Customization > UI Preferences

Answer

Dashboards > Widget Editor > Refresh Interval

Answer

Settings > Server Configuration > Dashboard.Refresh.Rate

Question 6

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Accepted Answer

The custom fields were created but not added to the layout assigned to that incident type. Fields must be added to the active layout for the specific incident type to be visible in the Incident Info panel.

Answer

The user browser cache must be cleared via Settings > Server Configuration

Answer

Custom fields are restricted to administrator accounts only by default

Answer

Custom fields require a server restart before appearing in database schemas

Question 7

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. In Cortex XSOAR's custom dashboard widget builder, the natively supported chart/widget types include Line (B), Number (C), and Pie (E). Line (B) is correct because XSOAR provides a line chart widget for plotting trends of a selected query over time. Number (C) is correct because the Number widget displays a single aggregated value (such as a count or severity metric) from a query. Pie (E) is correct because XSOAR offers a pie chart widget to visualize proportional distribution of results by a chosen field. The unmarked options do not belong: 3D-Scatter (A) and Heatmap-Matrix (D) are not among the built-in widget types offered in the Cortex XSOAR custom dashboard widget creation interface.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 8

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Accepted Answer

Execution schedule / frequency. Option C (Execution schedule / frequency) is correct because a scheduled report in Cortex XSOAR requires a defined recurrence—such as daily, weekly, or a cron-style interval—so the system knows when to generate and dispatch the report. Option E (Report definition/template) is correct because the schedule must reference the actual report content, i.e., the saved report template or definition that specifies which widgets, dashboards, and data are included. The remaining options do not belong: A (Elasticsearch cluster shard allocation count) is an Elasticsearch infrastructure tuning setting unrelated to XSOAR report scheduling, B (Raw SSH credentials of the target email relay) is not how XSOAR integrates with mail servers (it uses configured mail/SMTP integration instances, not raw SSH credentials), and D (Active Directory bind password for report viewers) is an authentication detail for directory lookups and is not a required parameter for defining a scheduled report.

Answer

Elasticsearch cluster shard allocation count

Answer

Raw SSH credentials of the target email relay

Answer

Active Directory bind password for report viewers

Question 9

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Accepted Answer

Tabs. In Cortex XSOAR, a custom incident layout is built from three structural building blocks: Tabs (B), which group content into separate views within the incident; Sections (D), which organize content within a tab into logical groupings; and Fields (E), which are the individual incident data elements displayed inside those sections. These three components are exactly what the layout editor exposes when designing a custom incident layout, so B, D, and E are correct. Kernel Modules (A) are operating-system-level components unrelated to XSOAR layout design, and Firmware ROM flashing tools (C) are hardware/firmware utilities that have nothing to do with incident layout configuration, so neither belongs.

Answer

Kernel Modules

Answer

Firmware ROM flashing tools

Question 10

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Accepted Answer

Active. In Cortex XSOAR, every incident carries a status field whose built-in values are Active, Pending, and Closed, so option A (Active) is correct because it is the default status assigned to newly created or currently investigated incidents, and option D (Closed) is correct because it marks incidents that have been resolved and are no longer being worked. These two are part of the standard incident lifecycle (Active → Pending → Closed) used by the incident status field, playbooks, and SLA/MTTR reporting. Option B (Archived) is not a status but a separate flag/action for hiding old incidents from the default view, option C (Quarantined) is not an XSOAR incident status (it relates to endpoint/email quarantine concepts), and option E (Locked) is not a status either—locking refers to record-level edit protection, not an incident lifecycle state.

Answer

Archived

Answer

Quarantined

Answer

Locked

Question 11

Which TWO pieces of information are displayed prominently in the incident header by default?

Accepted Answer

Incident ID. The incident header typically displays key metadata such as Incident Name/ID, Status, Owner, and Severity.

Answer

Active database connection pool size

Answer

CPU temperature of the XSOAR server

Answer

SSL certificate expiration date of the remote mail server

Question 12

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 13

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Accepted Answer

Incident Type playbook association settings. Option A is correct because a playbook only auto-triggers when it is explicitly associated with the incident type of the created incident, so a missing or misconfigured Incident Type playbook association would prevent execution. Option D is correct because incoming mapper rules determine how an incoming event is classified into an incident type; if the mapper assigns the wrong type, the playbook tied to the intended type will never fire. Option E is correct because a global server-level playbook automation toggle can disable automatic playbook execution across the system, blocking triggering even when associations and mappings are correct. Options B and C are incorrect because hypervisor BIOS versions and client browser cookie expiration have no bearing on server-side incident-to-playbook triggering logic.

Answer

The BIOS version of the underlying hypervisor host

Answer

Browser cookie expiration settings in client workstations

Question 14

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 15

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Option B (Widgets) is correct because a standard Cortex XSOAR dashboard is composed of configurable widgets that display security metrics, incident counts, SLA status, and other operational data pulled from the Cortex XSOAR data model. Option E (Dashboard title) is correct because each dashboard in Cortex XSOAR has a title/name that identifies it in the dashboard selector and appears at the top of the dashboard view. The unmarked options do not belong: kernel panic crash dumps (A) are OS-level diagnostics unrelated to the Cortex XSOAR web UI, raw Docker container logs (C) are infrastructure logs accessed outside the dashboard, and BIOS configuration utilities (D) are firmware-level tools with no role in the Cortex XSOAR dashboard.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities