XSOAR-Engineer Planning Installation And Maintenance — 10 Questions

Question 1

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Accepted Answer

Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.. Air-gapped installations require pre-downloading or embedding the required Python wheels or using a local PyPI mirror configured via Cortex XSOAR configuration settings.

Answer

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Answer

Configure the server to tunnel through an unauthenticated proxy.

Answer

Run 'demisto-sdk download-dependencies' from the CLI.

Question 2

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Accepted Answer

demisto-ctl backup. The demisto-ctl script includes built-in backup routines to safely export the system state and database.

Answer

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Answer

pg_dump demisto > backup.sql

Answer

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Question 3

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

Accepted Answer

TCP 443. Cortex XSOAR engines communicate with the main server via HTTPS over TCP port 443 by default.

Answer

TCP 8443

Answer

TCP 22

Answer

TCP 6222

Question 4

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. When upgrading a high-availability Cortex XSOAR environment, the primary server must be updated first, followed by secondary servers, and finally engines.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 5

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Accepted Answer

server.jvm.max.memory. The JVM heap size for the Cortex XSOAR server is controlled via the server configuration parameters, specifically server.jvm.max.memory or system environment variables like JAVA_OPTS.

Answer

demisto.engine.memory.limit

Answer

incident.ingestion.buffersize

Answer

python.max.worker.memory

Question 6

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > Debug Logs. Integration logs and API execution traces can be found within the Audit logs and specific integration instance debug logs available in Settings > About > Troubleshooting.

Answer

Incidents > Audit Trail

Answer

Dashboards > Server Metrics

Answer

Settings > Advanced > System Health

Question 7

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Accepted Answer

systemctl restart demisto. Cortex XSOAR runs as a systemd service named 'demisto' on RHEL systems.

Answer

demisto-ctl restart

Answer

systemctl restart cortex-xsoar

Answer

service xsoar-server restart

Question 8

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Accepted Answer

PostgreSQL. Cortex XSOAR utilizes an external PostgreSQL database for server clustering and state management to ensure high availability across multiple engine and server instances.

Answer

MySQL

Answer

Microsoft SQL Server

Answer

MongoDB

Question 9

What is the primary purpose of deploying a Cortex XSOAR Engine?

Accepted Answer

To execute integrations and playbooks in isolated network segments and reduce server load. Cortex XSOAR engines allow the platform to execute integrations and playbooks within isolated network segments (such as DMZs or internal subnets) and offload processing from the main server.

Answer

To act as a primary database replica for high availability

Answer

To handle user authentication and single sign-on (SSO) requests

Answer

To store long-term incident archives for compliance reporting

Question 10

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Images. Docker image details and container management are located in Settings > Integrations > Docker Images.

Answer

Dashboards > Container Health

Answer

Incidents > Management > Containers

Answer

Settings > About > System Information