XSOAR-Engineer Multiple Select — 50 Questions

Question 1

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Accepted Answer

Incident Type playbook association settings. Playbook triggering depends on Incident Type mapping, Playbook auto-assignment settings on the incident type, and integration mapper configurations.

Answer

The BIOS version of the underlying hypervisor host

Answer

Browser cookie expiration settings in client workstations

Question 2

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Accepted Answer

Excel (XLSX). The Incident WorkArea supports exporting data to formats like CSV and Excel (XLSX).

Answer

Windows Registry hive file (.HIV)

Answer

Direct binary memory dump (.DMP)

Question 3

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Accepted Answer

Execution schedule / frequency. Scheduled reports require a defined report template/definition and a schedule/recurrence setting.

Answer

Elasticsearch cluster shard allocation count

Answer

Raw SSH credentials of the target email relay

Answer

Active Directory bind password for report viewers

Question 4

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The WorkArea allows bulk actions such as assigning owners, changing incident types, closing incidents, and running playbooks in bulk.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 5

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Accepted Answer

Severity. Widgets query incidents using standard fields such as severity, status, owner, and incident type.

Answer

Ethernet MAC address

Answer

CPU cache size

Question 6

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Accepted Answer

Auto-extract indicator settings. Custom incident types can be associated with default playbooks, custom layouts, and specific auto-extract settings.

Answer

Motherboard BIOS serial number

Answer

RAID array stripe size

Question 7

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. XSOAR supports various widget types including Pie, Bar, Line, and Number/Counter widgets.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 8

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Accepted Answer

Tabs. Layouts can include custom fields, tabs, widgets, and sections to structure the incident view.

Answer

Kernel Modules

Answer

Firmware ROM flashing tools

Question 9

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Dashboards consist of customizable widgets and layout containers.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 10

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Accepted Answer

Active. Standard incident statuses in XSOAR include Pending, Active, Closed, and to some extent custom or built-in states like Assigned. Specifically, Active and Closed are core built-in statuses.

Answer

Archived

Answer

Quarantined

Answer

Locked

Question 11

Which TWO actions can an analyst perform within the Incident War Room?

Accepted Answer

Add analyst notes and comments. Analysts can execute integration commands and post notes/comments in the War Room.

Answer

Provision new cloud virtual machines

Answer

Configure physical firewall port speeds

Answer

Update XSOAR server SSL certificates

Question 12

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Administrators can configure custom tabs to organize fields logically and add custom Markdown fields or HTML sections to display instructions or contextual notes.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 13

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Accepted Answer

Settings > About in the Cortex XSOAR Web UI. The server version can be verified via the Web UI under Settings > About and via the server command line using demisto-ctl version or querying server status.

Answer

Settings > Integrations > Server Version

Answer

Checking the Apache HTTP server header response

Answer

The server file system path /var/lib/demisto/VERSION

Question 14

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Accepted Answer

API Keys generated within user profile settings. Cortex XSOAR API authentication supports API Keys generated by users and standard user credentials (username/password) to obtain session tokens.

Answer

OAuth 2.0 client credentials grant type natively configured without user context

Answer

Kerberos ticket-granting service tickets

Answer

Public key SSH key pairs

Question 15

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. High availability and disaster recovery best practices include deploying an external replicated PostgreSQL database, utilizing active-active server clusters with a load balancer, and scheduling automated offsite backups.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 16

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Accepted Answer

Verify content pack compatibility against the target XSOAR server version. Before major upgrades, administrators must back up the application database and configuration using demisto-ctl backup, and verify that all installed content packs and integrations are compatible with the target version.

Answer

Stop all inbound email fetching and incident ingestion streams

Answer

Uninstall all third-party marketplace content packs to prevent schema conflicts

Answer

Re-initialize the PostgreSQL database schema from scratch

Question 17

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Accepted Answer

sys.internal.limits.max.fetch.incidents. Incident ingestion rate and flow can be managed using configuration keys that control fetch limits, batch sizes, and throttling intervals.

Answer

server.jvm.garbage.collection.interval

Answer

docker.max.container.lifespan

Question 18

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Accepted Answer

Configuring custom branch labels for different outcomes. Conditional tasks allow evaluating expressions, defining custom labels for branches, and setting a default fallback path.

Answer

Compiling Python source code into machine bytecode

Answer

Directly modifying firewall access control lists without commands

Question 19

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

Accepted Answer

Conditional Task. Playbook task types include Automation, Conditional, Manual, Sub-playbook, and Data Collection tasks.

Answer

Firewall Task

Answer

Database Task

Answer

Router Task

Question 20

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Accepted Answer

Dynamic context path references using ${} syntax. Task arguments can be populated with static text strings or dynamic context references enclosed in ${}.

Answer

Direct SQL queries executed against the internal PostgreSQL database

Answer

Direct memory pointer addresses in C syntax

Answer

Local environment variables via bash export commands