XSOAR-Engineer Multiple Select — 40 Questions

Question 1

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 2

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Option A is correct because a clear, descriptive name that reflects the playbook's workflow purpose is essential for discoverability and for users to understand at a glance what the playbook does when browsing the organization-wide library. Option C is correct because documentation or a description explaining input requirements and expected outcomes ensures other analysts can correctly supply required inputs and understand what the playbook will produce, which is critical for reusable, organization-wide content. Option E is correct because associating the playbook with the appropriate Incident Types enables it to trigger automatically when relevant cases are created, which is the standard mechanism for mapping playbooks to case categories in platforms like Cortex XSOAR. Option B is not required because playbooks are defined as declarative workflows (YAML/JSON), not compiled binaries, and Windows execution is handled by integrations or scripts rather than an attached binary. Option D is incorrect and actively discouraged because hardcoding plain-text passwords violates security best practices; credentials should be stored in a secrets manager or credential store and referenced securely.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 3

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 4

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Current reputation and score. Option C is correct because the Indicator Details view in Cortex XSOAR prominently displays the indicator's current reputation (e.g., Good, Suspicious, Bad, Unknown) along with its calculated score, which reflects the aggregated threat intelligence verdict for that IOC. Option D is correct because the Indicator Details view lists the contributing feed sources (such as threat intel feeds and integrations) that supplied or enriched the indicator, allowing analysts to trace provenance and understand which sources influenced the reputation. Options A and B are incorrect because XSOAR does not expose administrator OS login passwords or the XSOAR server's raw BIOS serial numbers within an indicator record; those are unrelated to threat intelligence data. Option E is incorrect because physical GPS coordinates of a threat actor are not a standard field shown in an Indicator Details view, as indicators are technical artifacts (IPs, hashes, domains) rather than geolocation profiles of actors.

Answer

Administrator operating system login passwords

Answer

Raw BIOS serial numbers of the XSOAR server

Answer

Physical GPS coordinates of the threat actor

Question 5

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Accepted Answer

Identifying correct JSONPath expressions for indicator fields. Option D is correct because a non-standard JSON threat feed has no predefined parser, so you must determine the exact JSONPath expressions (e.g., $.data[].attributes.value) that locate each indicator field such as IP, domain, or hash within the nested JSON structure. Option E is correct because once values are extracted, they must be mapped to the standard XSOAR indicator schema attributes (e.g., ip, domain, filehash, or the relevant indicator type fields) so the platform can normalize, deduplicate, and enrich them correctly. Option A is incorrect because custom C++ kernel modules are unnecessary and inappropriate for parsing JSON feed data in XSOAR. Option B is incorrect because modifying the XSOAR source code repository is not required and would break supportability; custom mapping is done through configuration and integration code, not core source edits. Option C is incorrect because hardware load balancers address traffic distribution and availability, not indicator field extraction or schema mapping.

Answer

Writing custom C++ kernel modules for memory parsing

Answer

Modifying the XSOAR source code repository

Answer

Configuring hardware load balancers for the feed server

Question 6

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Option B (Widgets) is correct because a standard Cortex XSOAR dashboard is composed of configurable widgets that display security metrics, incident counts, SLA status, and other operational data pulled from the Cortex XSOAR data model. Option E (Dashboard title) is correct because each dashboard in Cortex XSOAR has a title/name that identifies it in the dashboard selector and appears at the top of the dashboard view. The unmarked options do not belong: kernel panic crash dumps (A) are OS-level diagnostics unrelated to the Cortex XSOAR web UI, raw Docker container logs (C) are infrastructure logs accessed outside the dashboard, and BIOS configuration utilities (D) are firmware-level tools with no role in the Cortex XSOAR dashboard.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 7

Which TWO pieces of information are displayed prominently in the incident header by default?

Accepted Answer

Incident ID. The incident header typically displays key metadata such as Incident Name/ID, Status, Owner, and Severity.

Answer

Active database connection pool size

Answer

CPU temperature of the XSOAR server

Answer

SSL certificate expiration date of the remote mail server

Question 8

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 9

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

Accepted Answer

Automating repetitive tasks to reduce Mean Time to Respond (MTTR). Option B is correct because Cortex XSOAR playbooks execute automated workflows that handle repetitive SOC tasks such as enrichment, triage, and containment actions, which directly reduces Mean Time to Respond (MTTR). Option D is correct because playbooks encode a defined, repeatable sequence of steps so that every analyst handles the same incident type consistently, standardizing incident response across the team. Option A is incorrect because playbooks do not permanently disable all external network connections during any alert; containment actions are typically scoped, conditional, and reversible. Option C is incorrect because XSOAR is designed to augment analysts, not eliminate human oversight; human-in-the-loop approvals and analyst judgment remain essential. Option E is incorrect because XSOAR does not replace SIEM databases with flat text files; it integrates with SIEMs and other tools rather than substituting their data stores.

Answer

Permanently disabling all external network connections during any alert

Answer

Eliminating the need for any human oversight in security operations

Answer

Replacing all SIEM databases with flat text files

Question 10

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Accepted Answer

Related incidents list. Option C (Related incidents list) is correct because Cortex XSOAR correlates indicators from threat feeds with existing incidents, letting analysts pivot from an indicator to all incidents that reference it and quickly assess prior investigations and impact. Option D (Indicator relationship graphs and mappings) is correct because XSOAR builds relationships between indicators (for example, domain-to-IP, file-to-C2) and renders them as graphs, and its indicator type mappings normalize feed data so analysts can visualize and traverse these connections during an investigation. The other options do not belong: A (HTML email template designer) is a phishing/notification formatting feature unrelated to indicator investigation, B (Global LDAP user directory sync) only provisions users and roles for authentication, and E (Automatic hypervisor backup scheduling) is not a Cortex XSOAR capability at all.

Answer

HTML email template designer

Answer

Global LDAP user directory sync

Answer

Automatic hypervisor backup scheduling

Question 11

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. In a playbook Conditional Task, option B is correct because you can configure custom branch labels that name each possible outcome, allowing subsequent tasks to be routed based on which branch is taken. Option C is correct because the core of a Conditional Task is defining conditional expressions that evaluate incident fields or context data to determine which branch executes. Option E is correct because a Conditional Task supports a default (else) fallback path that runs when none of the specified conditions evaluate to true. Option A is not a playbook Conditional Task setting; compiling Python source into bytecode is a Python runtime/build operation, not a playbook configuration. Option D is not a Conditional Task setting either, since directly modifying firewall ACLs without commands is not a supported configuration mechanism in a Conditional Task.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 12

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

Accepted Answer

Free-text keyword search. WorkArea searches support free text search and structured key-value query filters (e.g., severity:high, status:active).

Answer

SQL JOIN statements

Answer

Regular expressions evaluated against raw disk sectors

Answer

Bash pipe commands

Question 13

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Accepted Answer

Engines communicate with the Cortex XSOAR server over HTTPS on port 443 by default.. Cortex XSOAR engines are remote execution components that connect to the server over HTTPS on port 443. They enable integration execution in remote network segments, providing local access to resources. They do not store the incident database and require server connectivity to function, so the true statements are about remote deployment and secure communication.

Answer

Engines store a copy of the Cortex XSOAR incident database for offline access.

Answer

Engines can only run Docker-based integrations and cannot execute scripts directly on the host.

Answer

Engines automatically synchronize playbooks and integrations from the server and can execute them without server connectivity.

Question 14

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Accepted Answer

The 'TAXII2 Server' integration, which exposes a TAXII endpoint for consumers to pull indicators.. Sharing indicators outward is accomplished with the TAXII2 Server integration, which exposes a pull endpoint for external consumers, and with the Export Indicators command, which writes indicators to STIX, CSV, or JSON files for downstream systems. Both are supported export capabilities. The Get, Add, and Delete Indicators commands operate inward or on lifecycle management and do not deliver indicator data to external systems, so they do not meet the sharing requirement.

Answer

The 'Add Indicators' command, which inserts new indicators into the database from external sources.

Answer

The 'Delete Indicators' command, which removes indicators after they are shared.

Answer

The 'Get Indicators' command, which retrieves indicators from the database for review.

Question 15

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 16

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Option B is correct because Cortex XSOAR incident layouts support custom tabs, which let administrators group related fields into logical sections such as Triage or Containment, reducing scrolling and making it faster for analysts to find and enter the data relevant to each phase of an investigation. Option D is correct because Markdown fields are a supported layout element that renders formatted text, so administrators can embed analyst instructions, response checklists, or contextual details directly in the incident form to guide data entry and standardize workflows. The remaining options do not belong: Active Directory domain controller synchronization schedules (A) are configured through integrations and jobs rather than incident layouts, kernel-level memory dump inspectors (C) are forensic tooling outside the layout editor, and embedded firewall policy modification wizards (E) are not a Cortex XSOAR layout component.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 17

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. In Cortex XSOAR's custom dashboard widget builder, the natively supported chart/widget types include Line (B), Number (C), and Pie (E). Line (B) is correct because XSOAR provides a line chart widget for plotting trends of a selected query over time. Number (C) is correct because the Number widget displays a single aggregated value (such as a count or severity metric) from a query. Pie (E) is correct because XSOAR offers a pie chart widget to visualize proportional distribution of results by a chosen field. The unmarked options do not belong: 3D-Scatter (A) and Heatmap-Matrix (D) are not among the built-in widget types offered in the Cortex XSOAR custom dashboard widget creation interface.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 18

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Accepted Answer

Executing the sub-playbook either synchronously or asynchronously. Option B is correct because Cortex XSOAR sub-playbooks can be invoked with the 'RunAsynchronously' setting, allowing the parent playbook to either wait for the sub-playbook to finish (synchronous) or continue execution while the sub-playbook runs in parallel (asynchronous). Option C is correct because the sub-playbook task configuration includes an 'Inputs' section where parent playbook context keys are mapped to the sub-playbook's defined input arguments, enabling data to flow into the sub-playbook. Option E is correct because the sub-playbook task also has an 'Outputs' section that maps the sub-playbook's output keys back into the parent playbook context, making the results available to subsequent tasks in the parent. Option A is incorrect because Cortex XSOAR playbooks operate at the orchestration layer and cannot directly modify OS kernel parameters. Option D is incorrect because sub-playbooks are interpreted automation content within the XSOAR engine, not compiled into native binary executables.

Answer

Directly modifying the underlying OS kernel parameters

Answer

Compiling the sub-playbook into a native binary executable file

Question 19

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Accepted Answer

'ToLower' to convert string characters to lowercase. Option A ('ToLower') is correct because Cortex XSOAR's built-in transformer set includes string transformers such as ToLower, which converts all characters in a given string value to lowercase within a context expression. Option D ('concat') is correct because concat is a built-in transformer that joins multiple string values together, allowing playbook authors to assemble composite strings from separate context fields. Option E ('uniq') is correct because uniq is a built-in list transformer that removes duplicate elements from a list, which is a standard list-manipulation operation in XSOAR context expressions. Option B ('CompileToMachineCode') is not a real XSOAR transformer; XSOAR does not compile context data into native x86 assembly. Option C ('EncryptDatabase') is also not a built-in transformer; XSOAR does not expose a transformer that secures SQL storage, as database encryption is not a context-expression string or list manipulation.

Answer

'CompileToMachineCode' to convert context into native x86 assembly

Answer

'EncryptDatabase' to secure SQL storage

Question 20

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

Accepted Answer

Integration dependencies or required integration commands.. Option A is correct because a Content Pack must declare its integration dependencies (or the specific integration commands the playbook invokes) so that the target production environment has the required integrations installed and configured before the playbook runs. Option D is correct because custom automation scripts and transformers referenced by playbook tasks are not built-in and must be packaged or referenced in the pack, otherwise tasks will fail with missing-script errors. Option E is correct because any dependent sub-playbooks called by the main playbook must also be included or referenced in the pack, since sub-playbooks are separate content items and will not resolve automatically in the target environment. Option B is not correct because war room chat logs are runtime artifacts of the development environment, not deployable content, and are irrelevant to pack installation or execution. Option C is not correct because analyst credentials and password hashes are environment-specific secrets that should never be exported in a Content Pack and are not required for the playbook to install or run.

Answer

Active incident war room chat logs from the development environment.

Answer

Local analyst user account credentials and password hashes.