XSOAR-Engineer Planning Installation And Maintenance — 25 Questions

Question 1

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

demisto-ctl backup. The officially supported and recommended method for backing up Cortex XSOAR application data (incident history, playbooks, configuration, and the internal database) is the demisto-ctl backup command. This utility is purpose-built to produce a consistent, restorable snapshot of the entire XSOAR deployment, coordinating the database and configuration files so they remain in sync. It is the method Palo Alto documents for both on-prem and self-managed environments.

Answer

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Answer

pg_dump demisto > backup.sql

Answer

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Question 2

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. For a zero-downtime upgrade of a Cortex XSOAR multinode HA deployment, the documented order is to upgrade the primary server first, then the secondary servers, and finally the engines. This sequence keeps the HA pair functional while the primary is upgraded and allows the secondaries to sync the new version before engines are touched. Engines are upgraded last because they are stateless workers that can be drained and restarted without affecting the application tier.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 3

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Accepted Answer

server.jvm.max.memory. The JVM heap size for the Cortex XSOAR server is controlled via the server configuration parameters, specifically server.jvm.max.memory or system environment variables like JAVA_OPTS.

Answer

demisto.engine.memory.limit

Answer

incident.ingestion.buffersize

Answer

python.max.worker.memory

Question 4

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > Debug Logs. Integration logs and API execution traces can be found within the Audit logs and specific integration instance debug logs available in Settings > About > Troubleshooting.

Answer

Incidents > Audit Trail

Answer

Dashboards > Server Metrics

Answer

Settings > Advanced > System Health

Question 5

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Images. In Cortex XSOAR, the active Docker image versions used by integrations are viewed under Settings > Integrations > Docker Images. This page lists each integration's Docker image, its tag/version, and whether it is the default or a custom image. Administrators use it to audit which container versions are running and to update or override images when a newer version is required.

Answer

Dashboards > Container Health

Answer

Incidents > Management > Containers

Answer

Settings > About > System Information

Question 6

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

Accepted Answer

Uploaded via Settings > About > Troubleshooting > Server Certificate (Custom Certificate). Custom CA certificates must be uploaded to Cortex XSOAR via Settings > About > Troubleshooting > Server Certificate, which injects them into the trust store used by integration containers.

Answer

Configured inside the PostgreSQL database connection string

Answer

In the host operating system's /etc/pki/ca-trust/source/anchors/ directory only

Answer

Inside each individual integration's Python script code

Question 7

An administrator is troubleshooting a scenario where the Cortex XSOAR server is unresponsive due to a high volume of long-running python integration scripts exhausting available Docker workers. Which configuration parameter limits the maximum concurrent execution threads for Python scripts?

Accepted Answer

python.worker.max.workers. The concurrency of Python script and integration execution is managed by server configuration keys such as python.worker.max.workers.

Answer

server.max.threads

Answer

integration.concurrency.limit

Answer

docker.container.pool.size

Question 8

An administrator needs to restrict access to a specific sensitive integration instance so that only members of the Tier 2 SOC team can execute commands using it. How can this be accomplished?

Accepted Answer

Configure integration instance roles in Settings > Integrations > Instances to restrict usage to specific user roles.. Integration permissions can be restricted using Role-Based Access Control (RBAC) by assigning specific roles to integration instances.

Answer

Disable the integration for all users except Tier 2 via server configuration keys.

Answer

Place the integration inside a restricted playbook folder.

Answer

Modify the integration Python code to check the logged-in user's username.

Question 9

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Registry Configuration. Private container registry credentials in Cortex XSOAR are configured centrally under Settings > Integrations > Docker Registry Configuration. This allows the XSOAR server and engines to authenticate to a private registry when pulling Docker images for integrations. The configuration includes the registry URL, username, and password.

Answer

Via the demisto-sdk registry-login command

Answer

In the individual integration instance settings under API Key

Answer

Inside the demisto.conf configuration file on the Linux host file system

Question 10

An administrator is setting up Cortex XSOAR High Availability and notices that jobs (such as scheduled automations and recurring fetches) are executing multiple times concurrently across nodes. What must be configured to prevent split-brain execution of scheduled tasks?

Accepted Answer

Ensure the server clustering configuration properly establishes a primary leader node with database-backed distributed locking.. In an HA cluster, scheduled tasks and fetching must be coordinated so that only the active leader or designated worker executes them, managed via cluster locking mechanisms and server configuration.

Answer

Disable scheduled tasks on all secondary servers via crontab.

Answer

Configure a shared Redis cache for job locking.

Answer

Set each secondary server to 'Read-Only Mode' in the server configuration.

Question 11

An administrator wants to ensure that all modifications to playbooks and automations are tracked and synchronized with a remote Git repository for version control. Where is Git integration configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Servers and Services > Git. Git integration for content management is configured under Settings > Integrations > Servers and Services > Git.

Answer

Incidents > Configuration > Version Control

Answer

Dashboards > Git Sync

Answer

Settings > About > Repository Settings

Question 12

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

Accepted Answer

Run 'demisto-ctl clean-history' to purge old logs and temporary files.. The demisto-ctl tool provides administrative utilities, and housekeeping configurations handle file pruning, while direct manual file deletion can cause corruption.

Answer

Drop the PostgreSQL temporary tables using psql.

Answer

Restart the demisto service with the '--purge-cache' flag.

Answer

Execute 'rm -rf /var/lib/demisto/tmp/*' directly from the Linux shell.

Question 13

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Accepted Answer

Verify content pack compatibility against the target XSOAR server version. Option A is correct because content packs are version-dependent, and Palo Alto Networks requires verifying that installed packs are compatible with the target XSOAR server version before upgrading, since incompatible packs can break playbooks, integrations, and automations after the upgrade. Option E is correct because taking a full application backup with the demisto-ctl backup command (or the equivalent backup mechanism) preserves the database, configuration, and content so the environment can be restored if the major version upgrade fails or introduces regressions. Option B is not required as a pre-upgrade step; while it may be prudent to pause ingestion to avoid data loss during the maintenance window, it is not one of the documented mandatory pre-upgrade actions and XSOAR handles queued ingestion. Option C is wrong because uninstalling all third-party content packs is not required and would unnecessarily remove functionality; only incompatible packs need attention, not wholesale removal. Option D is wrong because re-initializing the PostgreSQL schema from scratch would destroy existing data and is never part of a supported upgrade procedure.

Answer

Stop all inbound email fetching and incident ingestion streams

Answer

Uninstall all third-party marketplace content packs to prevent schema conflicts

Answer

Re-initialize the PostgreSQL database schema from scratch

Question 14

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Accepted Answer

sys.internal.limits.max.fetch.incidents. Option A, sys.internal.limits.max.fetch.incidents, is correct because it sets a hard cap on the number of incidents the server will fetch per fetch cycle, directly throttling ingestion volume during an alert storm. Option C, incident.ingestion.batch.size, is correct because it controls how many incidents are processed in a single ingestion batch, allowing the server to spread the workload and avoid being overwhelmed. Option D, integration.fetch.timeout.seconds, is correct because it bounds how long a fetch from an integration may run, preventing a slow or backlogged integration from tying up ingestion resources and cascading into overload. Option B, server.jvm.garbage.collection.interval, is not a valid XSOAR server configuration key for tuning ingestion flow, and Option E, docker.max.container.lifespan, governs container lifecycle for sandboxed integrations rather than incident ingestion throughput.

Answer

server.jvm.garbage.collection.interval

Answer

docker.max.container.lifespan

Question 15

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Accepted Answer

Settings > About in the Cortex XSOAR Web UI. Option B is correct because the Cortex XSOAR Web UI exposes the installed server version under Settings > About, where the platform displays build and version details for the tenant. Option C is correct because the server CLI provides version information through management commands such as 'demisto-ctl version' or by querying the server status, which reports the running XSOAR build. Option A is incorrect because Settings > Integrations manages integration instances and does not display the server version. Option D is incorrect because the Apache HTTP server header reflects the web server, not the Cortex XSOAR application version. Option E is incorrect because /var/lib/demisto/VERSION is not the documented location for checking the installed Cortex XSOAR server version.

Answer

Settings > Integrations > Server Version

Answer

Checking the Apache HTTP server header response

Answer

The server file system path /var/lib/demisto/VERSION

Question 16

An administrator needs to ensure that Cortex XSOAR audit logs and incident data are securely archived for compliance purposes. Which THREE mechanisms or practices are recommended for long-term data management in Cortex XSOAR? (Choose three)

Accepted Answer

Export daily encrypted database backups using 'demisto-ctl backup' to secure offsite storage.. Option B is correct because Cortex XSOAR supports encrypted database backups via the 'demisto-ctl backup' command, and storing these daily backups offsite provides a reliable, restorable archive of both audit logs and incident data for compliance. Option D is correct because Cortex XSOAR can forward audit logs in real time to an external SIEM over Syslog, ensuring tamper-resistant, centralized long-term retention independent of the local database. Option E is correct because configuring incident retention policies lets administrators automatically archive or delete closed incidents after a defined period, which is a recommended practice for managing long-term data lifecycle and compliance. Option A is not recommended because disabling WAL transaction logging risks data integrity and crash recovery rather than providing a valid archival mechanism. Option C is not recommended because manually printing incidents to PDF is not scalable, not automated, and does not preserve the structured audit or incident data needed for compliance.

Answer

Disable database transaction logging (WAL) to save disk space.

Answer

Manually export every incident into PDF format using browser print functions.

Question 17

An engineer is preparing to upgrade a Cortex XSOAR server from version 6.10 to 6.12. The server is deployed in a distributed architecture with a load balancer and multiple app servers. Before the upgrade, the engineer must ensure that all custom content is backed up. Which command should the engineer use to export all custom scripts and integrations from the server?

Accepted Answer

demisto-sdk download. Before upgrading a Cortex XSOAR server, it is essential to back up custom content. The Demisto SDK provides the download command to export all custom content from the server to a local directory. This includes scripts, integrations, playbooks, and other customizations. The upload command is for pushing content, init is for creating new content, and backup is not a valid command. Thus, demisto-sdk download is the correct choice.

Answer

demisto-sdk init

Answer

demisto-sdk upload

Answer

demisto-sdk backup

Question 18

An administrator is preparing a multi-tenant Cortex XSOAR deployment where each tenant requires strong isolation of incidents, playbooks, and integrations, and must be able to independently manage users and roles. Which deployment model should be used?

Accepted Answer

A single Cortex XSOAR server with multiple tenants configured via the Account Management section. Cortex XSOAR's multi-tenant architecture uses the Account Management section to create isolated tenants on a single server. Each tenant has its own incidents, playbooks, integrations, and user roles, providing the required separation and independent administration without deploying multiple servers. This is the standard and recommended approach for multi-tenant deployments.

Answer

A Cortex XSOAR engine cluster with each engine assigned to a different tenant

Answer

A single Cortex XSOAR server with all tenants sharing the same incident database and role assignments

Answer

Multiple independent Cortex XSOAR servers, one per tenant, with no shared infrastructure

Question 19

A Cortex XSOAR administrator is preparing to upgrade the server from version 6.8 to 6.9. The environment uses an external PostgreSQL database and an external Elasticsearch instance. The administrator must ensure the upgrade completes without data loss and can be rolled back if necessary. Which step should be performed before initiating the upgrade?

Accepted Answer

Run the built-in backup utility from the Cortex XSOAR settings to create a full system backup, including the PostgreSQL database and Elasticsearch indices.. Before upgrading Cortex XSOAR, a full system backup is essential, especially when external PostgreSQL and Elasticsearch are used. The built-in backup utility ensures that both the database and indices are captured, allowing restoration to the previous version if the upgrade fails. Other methods like CSV export or VM snapshots are incomplete because they do not cover external data stores.

Answer

Take a snapshot of the virtual machine hosting the Cortex XSOAR server and proceed with the upgrade.

Answer

Export all incidents to a CSV file using the Cortex XSOAR API and store it on a network share.

Answer

Disable all integrations and playbooks, then upgrade; the system will automatically create a restore point.

Question 20

A security engineer is deploying a new Cortex XSOAR engine in a remote site to handle high-volume data ingestion from a local syslog server. The engine will be installed on a Linux server with no internet access. Which component must be present on the engine to allow it to communicate with the Cortex XSOAR server?

Accepted Answer

A configuration file containing the server's IP address and a unique engine key. A Cortex XSOAR engine must be configured with the server's address and a unique engine key to establish a secure connection. This configuration is typically stored in a file created during the engine installation process. The engine key authenticates the engine to the server, allowing it to receive and execute tasks. Other options like API keys, database copies, or license files are not used for this purpose.

Answer

A copy of the Cortex XSOAR server's database

Answer

A license file for the engine

Answer

A valid API key generated on the Cortex XSOAR server