XSOAR-Engineer Incident Interactions And Reporting Practice Test 4 — 15 Questions

Question 1

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Accepted Answer

Share with specific user roles. Dashboards can be shared with specific roles or made public to all users.

Answer

Broadcast via Bluetooth pairing

Answer

Publish via public FTP server upload

Answer

Print via thermal receipt printer

Question 2

Which TWO actions can an analyst perform within the Incident War Room?

Accepted Answer

Add analyst notes and comments. Option B is correct because the Incident War Room in Cortex XSOAR is a collaborative workspace where analysts document their investigation by adding notes and comments to the incident, keeping the whole team informed. Option E is correct because the War Room CLI allows analysts to run integration commands directly (for example, using the command line to query an integration or execute a configured command) to gather data and take response actions during an investigation. Options A, C, and D are not War Room functions: provisioning cloud VMs, configuring physical firewall port speeds, and updating XSOAR server SSL certificates are infrastructure or administrative tasks performed outside the incident War Room, not analyst actions within it.

Answer

Provision new cloud virtual machines

Answer

Configure physical firewall port speeds

Answer

Update XSOAR server SSL certificates

Question 3

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Accepted Answer

Excel (XLSX). Option B (Excel/XLSX) is correct because the Incident WorkArea natively exports incident data into XLSX spreadsheets, allowing analysts to filter, pivot, and share structured tabular data for external reporting. Option D (CSV) is correct because CSV is a native, plain-text delimited export format that preserves incident fields for ingestion into SIEMs, ticketing systems, or archival stores. Option E (PDF via Incident Report generation) is correct because the WorkArea can generate an Incident Report and render it as a PDF, which is the standard format for immutable, human-readable archival and external distribution. Option A (.HIV) does not belong because a Windows Registry hive is an OS registry artifact, not an incident data export format. Option C (.DMP) does not belong because a binary memory dump is a forensic memory capture, not a supported incident data export from the WorkArea.

Answer

Windows Registry hive file (.HIV)

Answer

Direct binary memory dump (.DMP)

Question 4

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Accepted Answer

Severity. Severity (B) is a standard incident attribute used to filter and categorize incidents in dashboard widget queries, since incidents are classified by urgency levels such as critical, high, medium, and low. Owner (C) is also a valid incident attribute, allowing queries to group or filter incidents by the assigned user or team responsible for resolution. Status (D) is likewise a core incident field, enabling filtering by lifecycle states such as open, acknowledged, or resolved. Ethernet MAC address (A) is a network-layer hardware identifier, not an incident metadata attribute, so it cannot be used to query incidents. CPU cache size (E) is a hardware performance specification, unrelated to incident categorization or filtering.

Answer

Ethernet MAC address

Answer

CPU cache size

Question 5

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Accepted Answer

Auto-extract indicator settings. In a SOAR/incident-management platform, a custom incident type can carry its own auto-extract indicator settings (B), which define the regexes and fields used to automatically pull indicators such as IPs, hashes, and domains out of incident data as it is ingested. It can also define a Layout (D), which controls which fields, tabs, and sections are displayed when viewing incidents of that type. And it can specify a Default Playbook (E), the playbook automatically attached or suggested for incidents of that type. Motherboard BIOS serial number (A) is hardware inventory data, not an incident-type configuration, and RAID array stripe size (C) is a storage-controller setting, so neither belongs here.

Answer

Motherboard BIOS serial number

Answer

RAID array stripe size

Question 6

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Accepted Answer

In the Dashboard configuration settings by selecting the appropriate Roles under Sharing settings.. Dashboard permissions are managed directly within the Dashboard configuration dialog by assigning specific user roles (such as Tier-2 SOC) to control read or write visibility.

Answer

In the User Profile settings for each individual Tier-2 SOC analyst.

Answer

In the Incident Type layout editor under the Permissions tab.

Answer

In the Server Configuration (Settings > About > Configuration) by updating the 'dashboard.roles.allowed' key.

Question 7

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

Accepted Answer

A Section of type 'Query' configured with the specific incident query and associated widget type.. To include dynamic data from saved queries or widgets into an XSOAR report, the report section must be configured as a Query or Widget type section.

Answer

A Section of type 'Markdown' containing embedded REST API calls to the XSOAR server.

Answer

A Section of type 'War Room Transcript' filtered by playbook task ID.

Answer

A Section of type 'Image' pointing to the temporary URL of the dashboard widget.

Question 8

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Accepted Answer

The War Room. The War Room is the central interactive interface within an incident where analysts collaborate, run automation scripts, and maintain an audit trail.

Answer

The Job Scheduler

Answer

The Threat Intel page

Answer

The Incident Canvas

Question 9

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Accepted Answer

Modify the report section layout dimensions, orientation (Portrait/Landscape), and page break configurations.. Report layouts are structured using customized JSON or built-in orientation and section sizing properties to control PDF rendering margins and element arrangement.

Answer

Increase the server-wide 'report.render.timeout' configuration variable.

Answer

Export the report as a CSV format instead of PDF to bypass layout constraints.

Answer

Update the browser zoom settings of the user who created the scheduled report.

Question 10

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

Accepted Answer

Use the search bar in the Incidents page with a query filtering by owner and status.. The Incident List view provides a query search bar where analysts can enter query syntax like `owner:current_user and status:"In Progress"` to filter incidents.

Answer

Create a completely new custom Report and export it to Excel.

Answer

Modify the default Playbook definitions to restrict visibility.

Answer

Build a new Dashboard widget and restart the XSOAR service.

Question 11

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

Accepted Answer

Set the chart type to Bar and group the data by the appropriate incident field representing the source.. When creating a custom chart widget in XSOAR, the analyst specifies the chart type (e.g., Bar) and groups the results by a specific incident field (such as 'brand' or source integration).

Answer

Configure a War Room script automation that injects HTML directly into the server header.

Answer

Create a dynamic playbook task that exports PNG screenshots to the dashboard folder.

Answer

Enable raw syslog streaming to an external SIEM for visualization.

Question 12

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

Accepted Answer

Archiving the report inside the built-in XSOAR Report repository for download.. Option A is correct because the Cortex XSOAR reporting engine natively stores generated scheduled reports in the built-in Report repository, where they can be archived and downloaded later. Option B is correct because scheduled reports can be delivered by email to specified internal or external recipients using the configured mail integration. Option D is correct because the reporting engine can save report output directly to a designated incident's War Room, making it available as an attachment or entry in that incident. Option C is not supported natively, as XSOAR does not include CUPS-based physical printing as a report distribution method. Option E is also not supported natively, since real-time SMS broadcast to an administrator mobile gateway is not a built-in scheduled report delivery option.

Answer

Automatic physical printing via networked CUPS printer drivers.

Answer

Real-time SMS broadcast to an administrator mobile gateway.

Question 13

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Option B is correct because Cortex XSOAR incident layouts support custom tabs, which let administrators group related fields into logical sections such as Triage or Containment, reducing scrolling and making it faster for analysts to find and enter the data relevant to each phase of an investigation. Option D is correct because Markdown fields are a supported layout element that renders formatted text, so administrators can embed analyst instructions, response checklists, or contextual details directly in the incident form to guide data entry and standardize workflows. The remaining options do not belong: Active Directory domain controller synchronization schedules (A) are configured through integrations and jobs rather than incident layouts, kernel-level memory dump inspectors (C) are forensic tooling outside the layout editor, and embedded firewall policy modification wizards (E) are not a Cortex XSOAR layout component.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 14

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

Accepted Answer

The user role viewing the dashboard lacks permissions to access the underlying data or indices.. Option A is correct because XSOAR dashboard widgets execute queries against underlying data (incidents, indicators, or Elasticsearch indices) under the permissions of the viewing user's role; if that role lacks the required RBAC permissions to those data sources, the widget query is rejected and the widget fails to render. Option D is correct because custom widgets are driven by incident or indicator queries (often written in XSOAR's Lucene-style query syntax), and a malformed query with syntax errors will cause the widget's data fetch to fail and return an error. Option B is not relevant because SMTP port blocking only affects email notifications and mail integrations, not dashboard widget data retrieval. Option C is not relevant because swap space sizing affects general server performance/stability, not the specific failure of a widget query. Option E is not relevant because an expired SSL certificate on a firewall integration would break that integration's connectivity, not the dashboard widget's query execution.

Answer

The SMTP server port is blocked by a local firewall.

Answer

The Linux kernel swap space on the XSOAR server is configured below 512MB.

Answer

The SSL certificate of the active firewall integration has expired.

Question 15

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

Accepted Answer

In the War Room entry's three-dot menu, choose 'Add Tag' and enter the label.. War Room entries support per-entry tags applied through the entry's context menu. This lets analysts classify individual notes, command outputs, or playbook actions so they can be filtered or referenced later without altering incident-level fields or playbook logic.

Answer

In the incident's Settings, enable 'Entry Tagging' and select the label from the predefined list.

Answer

In the incident's Details tab, edit the 'Tags' field and add the label.

Answer

In the playbook editor, add a 'Tag Entry' task immediately after the relevant automation task.