XSOAR-Engineer Planning Installation And Maintenance — All Questions With Answers

Read the full Planning Installation And Maintenance explanation →

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Question 2hardmultiple choice

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Question 3hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Question 4easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Question 5easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Question 6mediummultiple choice

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

Question 7hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting a scenario where the Cortex XSOAR server is unresponsive due to a high volume of long-running python integration scripts exhausting available Docker workers. Which configuration parameter limits the maximum concurrent execution threads for Python scripts?

Question 8mediummultiple choice

An administrator needs to restrict access to a specific sensitive integration instance so that only members of the Tier 2 SOC team can execute commands using it. How can this be accomplished?

Question 9hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Question 10hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is setting up Cortex XSOAR High Availability and notices that jobs (such as scheduled automations and recurring fetches) are executing multiple times concurrently across nodes. What must be configured to prevent split-brain execution of scheduled tasks?

Question 11mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator wants to ensure that all modifications to playbooks and automations are tracked and synchronized with a remote Git repository for version control. Where is Git integration configured in Cortex XSOAR?

Question 12hardmultiple choice

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

Question 13easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Question 14mediummulti select

Read the full Planning Installation And Maintenance explanation →

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Question 15easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Question 16hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator needs to ensure that Cortex XSOAR audit logs and incident data are securely archived for compliance purposes. Which THREE mechanisms or practices are recommended for long-term data management in Cortex XSOAR? (Choose three)

Question 17hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An engineer is preparing to upgrade a Cortex XSOAR server from version 6.10 to 6.12. The server is deployed in a distributed architecture with a load balancer and multiple app servers. Before the upgrade, the engineer must ensure that all custom content is backed up. Which command should the engineer use to export all custom scripts and integrations from the server?

Question 18mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is preparing a multi-tenant Cortex XSOAR deployment where each tenant requires strong isolation of incidents, playbooks, and integrations, and must be able to independently manage users and roles. Which deployment model should be used?

Question 19mediummultiple choice

A Cortex XSOAR administrator is preparing to upgrade the server from version 6.8 to 6.9. The environment uses an external PostgreSQL database and an external Elasticsearch instance. The administrator must ensure the upgrade completes without data loss and can be rolled back if necessary. Which step should be performed before initiating the upgrade?

Question 20mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security engineer is deploying a new Cortex XSOAR engine in a remote site to handle high-volume data ingestion from a local syslog server. The engine will be installed on a Linux server with no internet access. Which component must be present on the engine to allow it to communicate with the Cortex XSOAR server?

Question 21mediummultiple choice

A Cortex XSOAR administrator needs to back up the server configuration and data to a remote SMB share on a Windows file server, without storing credentials in plaintext. The backup must run automatically every night at 02:00. Which backup configuration approach is correct?

Question 22easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install Cortex XSOAR on a Linux server and needs to ensure the underlying operating system meets the minimum requirements. Which of the following is a supported operating system for Cortex XSOAR server installation?

Question 23mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is planning to upgrade a production server to a new major version. The organization requires minimal downtime and the ability to roll back if the upgrade fails. Which approach should the engineer take?

Question 24hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is preparing to install a Cortex XSOAR engine in a demilitarized zone (DMZ) to collect logs from isolated network segments. The engine must communicate with the Cortex XSOAR server located in the internal network. Which two network requirements must be met for the engine to function properly? (Choose two.)

Question 25hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to upgrade a Cortex XSOAR server from version 6.5 to 6.8. The deployment includes a PostgreSQL database on a separate server and multiple engines. Which TWO actions are required before starting the upgrade? (Choose two.)

Question 26mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security team plans to deploy Cortex XSOAR on a single Linux server running Ubuntu 22.04 LTS. During the pre-installation planning, the administrator must ensure the host meets the minimum disk space requirement for the /var/lib/docker partition when using the default local Docker-based deployment. Which minimum free disk space should be allocated?

Question 27mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is performing a fresh installation of Cortex XSOAR on a RHEL 8 server. The server must be able to run Docker-based integrations and playbook tasks. Which prerequisite must be satisfied before running the Cortex XSOAR installation script?

Question 28hardmultiple choice

A security team is deploying a Cortex XSOAR engine in a remote DMZ to collect logs from a SIEM. The engine must initiate communication with the main server, but the DMZ firewall only permits outbound TCP 443. The administrator notices the engine shows as disconnected in the server UI. Which configuration should be verified first to allow the engine to establish its tunnel?

Question 29mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Question 30mediummultiple choice

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

Question 31easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Question 32easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Question 33easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the primary purpose of deploying a Cortex XSOAR Engine?

Question 34hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

Question 35mediummultiple choice

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

Question 36hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Question 37easymultiple choice

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Question 38hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Question 39mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Question 40easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Question 41easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

Question 42easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the purpose of the Cortex XSOAR Health Check integration?

Question 43mediummultiple choice

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

Question 44mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Question 45mediummulti select

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

Question 46easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Question 47hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Question 48mediummulti select

Read the full Planning Installation And Maintenance explanation →

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Question 49easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

Question 50hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Question 51mediummulti select

Read the full Planning Installation And Maintenance explanation →

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

Question 52hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Question 53easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

Question 54mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

Question 55mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Question 56easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

Question 57hardmulti select

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

Question 58hardmulti select

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Question 59hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

Question 60easymultiple choice

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

Question 61easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

Question 62easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

Question 63hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

Question 64hardmulti select

Read the full Planning Installation And Maintenance explanation →

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

Question 65hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

Question 66mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

Question 67mediummulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Question 68easymultiple choice

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Question 69hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

Question 70easymultiple choice

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

Question 71mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

Question 72hardmultiple choice

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Question 73easymultiple choice

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

Question 74easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

Question 75mediummulti select

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

Question 76mediummultiple choice

An administrator is planning to scale a Cortex XSOAR deployment by adding multiple engines to distribute playbook task load. The organization uses a load balancer in front of the main server. Which configuration on the engines is required to ensure they connect through the load balancer rather than directly to a server node?

Question 1mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Question 2hardmultiple choice

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Question 3hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Question 4easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Question 5easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Question 6mediummultiple choice

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

Question 7hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting a scenario where the Cortex XSOAR server is unresponsive due to a high volume of long-running python integration scripts exhausting available Docker workers. Which configuration parameter limits the maximum concurrent execution threads for Python scripts?

Question 8mediummultiple choice

An administrator needs to restrict access to a specific sensitive integration instance so that only members of the Tier 2 SOC team can execute commands using it. How can this be accomplished?

Question 9hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Question 10hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is setting up Cortex XSOAR High Availability and notices that jobs (such as scheduled automations and recurring fetches) are executing multiple times concurrently across nodes. What must be configured to prevent split-brain execution of scheduled tasks?

Question 11mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator wants to ensure that all modifications to playbooks and automations are tracked and synchronized with a remote Git repository for version control. Where is Git integration configured in Cortex XSOAR?

Question 12hardmultiple choice

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

Question 13easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Question 14mediummulti select

Read the full Planning Installation And Maintenance explanation →

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Question 15easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Question 16hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator needs to ensure that Cortex XSOAR audit logs and incident data are securely archived for compliance purposes. Which THREE mechanisms or practices are recommended for long-term data management in Cortex XSOAR? (Choose three)

Question 17hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An engineer is preparing to upgrade a Cortex XSOAR server from version 6.10 to 6.12. The server is deployed in a distributed architecture with a load balancer and multiple app servers. Before the upgrade, the engineer must ensure that all custom content is backed up. Which command should the engineer use to export all custom scripts and integrations from the server?

Question 18mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is preparing a multi-tenant Cortex XSOAR deployment where each tenant requires strong isolation of incidents, playbooks, and integrations, and must be able to independently manage users and roles. Which deployment model should be used?

Question 19mediummultiple choice

A Cortex XSOAR administrator is preparing to upgrade the server from version 6.8 to 6.9. The environment uses an external PostgreSQL database and an external Elasticsearch instance. The administrator must ensure the upgrade completes without data loss and can be rolled back if necessary. Which step should be performed before initiating the upgrade?

Question 20mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security engineer is deploying a new Cortex XSOAR engine in a remote site to handle high-volume data ingestion from a local syslog server. The engine will be installed on a Linux server with no internet access. Which component must be present on the engine to allow it to communicate with the Cortex XSOAR server?

Question 21mediummultiple choice

A Cortex XSOAR administrator needs to back up the server configuration and data to a remote SMB share on a Windows file server, without storing credentials in plaintext. The backup must run automatically every night at 02:00. Which backup configuration approach is correct?

Question 22easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install Cortex XSOAR on a Linux server and needs to ensure the underlying operating system meets the minimum requirements. Which of the following is a supported operating system for Cortex XSOAR server installation?

Question 23mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is planning to upgrade a production server to a new major version. The organization requires minimal downtime and the ability to roll back if the upgrade fails. Which approach should the engineer take?

Question 24hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is preparing to install a Cortex XSOAR engine in a demilitarized zone (DMZ) to collect logs from isolated network segments. The engine must communicate with the Cortex XSOAR server located in the internal network. Which two network requirements must be met for the engine to function properly? (Choose two.)

Question 25hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to upgrade a Cortex XSOAR server from version 6.5 to 6.8. The deployment includes a PostgreSQL database on a separate server and multiple engines. Which TWO actions are required before starting the upgrade? (Choose two.)

Question 26mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security team plans to deploy Cortex XSOAR on a single Linux server running Ubuntu 22.04 LTS. During the pre-installation planning, the administrator must ensure the host meets the minimum disk space requirement for the /var/lib/docker partition when using the default local Docker-based deployment. Which minimum free disk space should be allocated?

Question 27mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is performing a fresh installation of Cortex XSOAR on a RHEL 8 server. The server must be able to run Docker-based integrations and playbook tasks. Which prerequisite must be satisfied before running the Cortex XSOAR installation script?

Question 28hardmultiple choice

A security team is deploying a Cortex XSOAR engine in a remote DMZ to collect logs from a SIEM. The engine must initiate communication with the main server, but the DMZ firewall only permits outbound TCP 443. The administrator notices the engine shows as disconnected in the server UI. Which configuration should be verified first to allow the engine to establish its tunnel?

Question 29mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Question 30mediummultiple choice

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

Question 31easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Question 32easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Question 33easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the primary purpose of deploying a Cortex XSOAR Engine?

Question 34hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

Question 35mediummultiple choice

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

Question 36hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Question 37easymultiple choice

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Question 38hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Question 39mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Question 40easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Question 41easymultiple choice

Read the full Planning Installation And Maintenance explanation →

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

Question 42easymultiple choice

Read the full Planning Installation And Maintenance explanation →

What is the purpose of the Cortex XSOAR Health Check integration?

Question 43mediummultiple choice

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

Question 44mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Question 45mediummulti select

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

Question 46easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Question 47hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Question 48mediummulti select

Read the full Planning Installation And Maintenance explanation →

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Question 49easymulti select

Read the full Planning Installation And Maintenance explanation →

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

Question 50hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Question 51mediummulti select

Read the full Planning Installation And Maintenance explanation →

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

Question 52hardmulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Question 53easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

Question 54mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

Question 55mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Question 56easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

Question 57hardmulti select

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

Question 58hardmulti select

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Question 59hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

Question 60easymultiple choice

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

Question 61easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

Question 62easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

Question 63hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

Question 64hardmulti select

Read the full Planning Installation And Maintenance explanation →

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

Question 65hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

Question 66mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

Question 67mediummulti select

Read the full Planning Installation And Maintenance explanation →

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Question 68easymultiple choice

Read the full Planning Installation And Maintenance explanation →

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Question 69hardmultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

Question 70easymultiple choice

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

Question 71mediummultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

Question 72hardmultiple choice

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Question 73easymultiple choice

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

Question 74easymultiple choice

Read the full Planning Installation And Maintenance explanation →

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

Question 75mediummulti select

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

Question 76mediummultiple choice