XSOAR-Engineer Planning Installation And Maintenance Practice Test 2 — 15 Questions

Question 1

An administrator needs to ensure that Cortex XSOAR audit logs and incident data are securely archived for compliance purposes. Which THREE mechanisms or practices are recommended for long-term data management in Cortex XSOAR? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export daily encrypted database backups using 'demisto-ctl backup' to secure offsite storage.. Option B is correct because Cortex XSOAR supports encrypted database backups via the 'demisto-ctl backup' command, and storing these daily backups offsite provides a reliable, restorable archive of both audit logs and incident data for compliance. Option D is correct because Cortex XSOAR can forward audit logs in real time to an external SIEM over Syslog, ensuring tamper-resistant, centralized long-term retention independent of the local database. Option E is correct because configuring incident retention policies lets administrators automatically archive or delete closed incidents after a defined period, which is a recommended practice for managing long-term data lifecycle and compliance. Option A is not recommended because disabling WAL transaction logging risks data integrity and crash recovery rather than providing a valid archival mechanism. Option C is not recommended because manually printing incidents to PDF is not scalable, not automated, and does not preserve the structured audit or incident data needed for compliance.

Answer

Disable database transaction logging (WAL) to save disk space.

Answer

Manually export every incident into PDF format using browser print functions.

Question 2

An engineer is preparing to upgrade a Cortex XSOAR server from version 6.10 to 6.12. The server is deployed in a distributed architecture with a load balancer and multiple app servers. Before the upgrade, the engineer must ensure that all custom content is backed up. Which command should the engineer use to export all custom scripts and integrations from the server?

Accepted Answer

demisto-sdk download. Before upgrading a Cortex XSOAR server, it is essential to back up custom content. The Demisto SDK provides the download command to export all custom content from the server to a local directory. This includes scripts, integrations, playbooks, and other customizations. The upload command is for pushing content, init is for creating new content, and backup is not a valid command. Thus, demisto-sdk download is the correct choice.

Answer

demisto-sdk init

Answer

demisto-sdk upload

Answer

demisto-sdk backup

Question 3

An administrator is preparing a multi-tenant Cortex XSOAR deployment where each tenant requires strong isolation of incidents, playbooks, and integrations, and must be able to independently manage users and roles. Which deployment model should be used?

Accepted Answer

A single Cortex XSOAR server with multiple tenants configured via the Account Management section. Cortex XSOAR's multi-tenant architecture uses the Account Management section to create isolated tenants on a single server. Each tenant has its own incidents, playbooks, integrations, and user roles, providing the required separation and independent administration without deploying multiple servers. This is the standard and recommended approach for multi-tenant deployments.

Answer

A Cortex XSOAR engine cluster with each engine assigned to a different tenant

Answer

A single Cortex XSOAR server with all tenants sharing the same incident database and role assignments

Answer

Multiple independent Cortex XSOAR servers, one per tenant, with no shared infrastructure

Question 4

A Cortex XSOAR administrator is preparing to upgrade the server from version 6.8 to 6.9. The environment uses an external PostgreSQL database and an external Elasticsearch instance. The administrator must ensure the upgrade completes without data loss and can be rolled back if necessary. Which step should be performed before initiating the upgrade?

Accepted Answer

Run the built-in backup utility from the Cortex XSOAR settings to create a full system backup, including the PostgreSQL database and Elasticsearch indices.. Before upgrading Cortex XSOAR, a full system backup is essential, especially when external PostgreSQL and Elasticsearch are used. The built-in backup utility ensures that both the database and indices are captured, allowing restoration to the previous version if the upgrade fails. Other methods like CSV export or VM snapshots are incomplete because they do not cover external data stores.

Answer

Take a snapshot of the virtual machine hosting the Cortex XSOAR server and proceed with the upgrade.

Answer

Export all incidents to a CSV file using the Cortex XSOAR API and store it on a network share.

Answer

Disable all integrations and playbooks, then upgrade; the system will automatically create a restore point.

Question 5

A security engineer is deploying a new Cortex XSOAR engine in a remote site to handle high-volume data ingestion from a local syslog server. The engine will be installed on a Linux server with no internet access. Which component must be present on the engine to allow it to communicate with the Cortex XSOAR server?

Accepted Answer

A configuration file containing the server's IP address and a unique engine key. A Cortex XSOAR engine must be configured with the server's address and a unique engine key to establish a secure connection. This configuration is typically stored in a file created during the engine installation process. The engine key authenticates the engine to the server, allowing it to receive and execute tasks. Other options like API keys, database copies, or license files are not used for this purpose.

Answer

A copy of the Cortex XSOAR server's database

Answer

A license file for the engine

Answer

A valid API key generated on the Cortex XSOAR server

Question 6

A Cortex XSOAR administrator needs to back up the server configuration and data to a remote SMB share on a Windows file server, without storing credentials in plaintext. The backup must run automatically every night at 02:00. Which backup configuration approach is correct?

Accepted Answer

Configure a backup destination of type SMB in Settings > Backup & Restore, supply the share path, username, and password, then schedule the backup using the server's built-in backup scheduler.. The correct approach uses Cortex XSOAR's native Backup & Restore configuration, which supports SMB destinations and includes a scheduler. This avoids custom scripts and plaintext credentials, and ensures a complete, restorable backup. Other methods either miss data, require external components, or do not meet the scheduling requirement.

Answer

Create a cron job that runs a shell script copying /var/lib/demisto to a locally mounted CIFS share using credentials stored in /etc/fstab.

Answer

Configure a backup destination of type S3 in Backup & Restore settings and use a lifecycle policy to replicate the data to an SMB share via a third-party tool.

Answer

Use the Cortex XSOAR REST API to export the configuration as a JSON file, then upload it to the SMB share using a Python automation running on a separate engine.

Question 7

An administrator is planning to install Cortex XSOAR on a Linux server and needs to ensure the underlying operating system meets the minimum requirements. Which of the following is a supported operating system for Cortex XSOAR server installation?

Accepted Answer

Ubuntu 20.04 LTS. Cortex XSOAR server installation is supported on specific Linux distributions, with Ubuntu 20.04 LTS being one of the officially supported operating systems. Using a supported OS ensures that all dependencies, such as Docker, are compatible and that the deployment is eligible for vendor support.

Answer

macOS Monterey

Answer

Windows Server 2019

Answer

CentOS 7

Question 8

An XSOAR engineer is planning to upgrade a production server to a new major version. The organization requires minimal downtime and the ability to roll back if the upgrade fails. Which approach should the engineer take?

Accepted Answer

Clone the production server to a staging environment, upgrade the staging server, and then switch over.. Cloning production to staging, upgrading staging, and then switching over minimizes downtime and provides a rollback path if the upgrade fails. This method allows thorough testing before affecting production. In-place upgrades and upgrades without backups are risky, and HA rolling upgrades are not supported for major versions.

Answer

Perform an in-place upgrade directly on the production server.

Answer

Apply the upgrade to a secondary node in a high-availability cluster and then fail over.

Answer

Upgrade the server during a maintenance window without a backup.

Question 9

An administrator is preparing to install a Cortex XSOAR engine in a demilitarized zone (DMZ) to collect logs from isolated network segments. The engine must communicate with the Cortex XSOAR server located in the internal network. Which two network requirements must be met for the engine to function properly? (Choose two.)

Accepted Answer

The engine must be able to initiate outbound connections to the Cortex XSOAR server on port 443 (HTTPS).. For a Cortex XSOAR engine in a DMZ to operate, it must initiate outbound HTTPS connections to the server on port 443 and have outbound access to a Docker registry to pull integration images. The engine does not accept inbound connections from the server, nor does it connect directly to the database. These two network requirements are critical for engine functionality and security.

Answer

The engine must be able to connect to the Cortex XSOAR server on port 5432 for direct database access.

Answer

The engine must have inbound access from the server on port 22 for SSH management.

Answer

The Cortex XSOAR server must be able to initiate inbound connections to the engine on port 443.

Question 10

An administrator is planning to upgrade a Cortex XSOAR server from version 6.5 to 6.8. The deployment includes a PostgreSQL database on a separate server and multiple engines. Which TWO actions are required before starting the upgrade? (Choose two.)

Accepted Answer

Take a full backup of the Cortex XSOAR server, including the configuration and data.. Before upgrading, you must back up the server and verify PostgreSQL compatibility. Engines are upgraded after the server, and disabling integrations or migrating the database is not required. These two actions ensure a safe upgrade path.

Answer

Migrate the PostgreSQL database to the same server as Cortex XSOAR to simplify the upgrade.

Answer

Upgrade all engines to the same version as the server before upgrading the server.

Answer

Disable all integrations and playbooks to prevent data corruption during the upgrade.

Question 11

A security team plans to deploy Cortex XSOAR on a single Linux server running Ubuntu 22.04 LTS. During the pre-installation planning, the administrator must ensure the host meets the minimum disk space requirement for the /var/lib/docker partition when using the default local Docker-based deployment. Which minimum free disk space should be allocated?

Accepted Answer

100 GB. The Cortex XSOAR installation documentation specifies a minimum of 100 GB free disk space for the Docker data directory when deploying on a single Linux host. This space covers container images, the internal database, search indices, and incident attachments. Choosing a smaller value risks installation failure or rapid capacity exhaustion, while a much larger value is not the stated minimum.

Answer

50 GB

Answer

20 GB

Answer

500 GB

Question 12

An administrator is performing a fresh installation of Cortex XSOAR on a RHEL 8 server. The server must be able to run Docker-based integrations and playbook tasks. Which prerequisite must be satisfied before running the Cortex XSOAR installation script?

Accepted Answer

Docker Engine and Docker Compose must be installed and the demisto service account must be added to the docker group.. A standalone Cortex XSOAR server on RHEL 8 relies on Docker to execute integrations and playbook tasks in isolated containers. The installer expects Docker Engine and Docker Compose to be present, and the demisto service account it creates must belong to the docker group so it can manage containers. Kubernetes, Active Directory, and a separately licensed MongoDB Enterprise are not prerequisites for this deployment model.

Answer

The server must be joined to an Active Directory domain and the demisto account must be a domain service account.

Answer

A licensed copy of MongoDB Enterprise must be installed and configured with replica sets before the installer runs.

Answer

A Kubernetes cluster must be initialized with kubectl and the Cortex XSOAR namespace pre-created.

Question 13

A security team is deploying a Cortex XSOAR engine in a remote DMZ to collect logs from a SIEM. The engine must initiate communication with the main server, but the DMZ firewall only permits outbound TCP 443. The administrator notices the engine shows as disconnected in the server UI. Which configuration should be verified first to allow the engine to establish its tunnel?

Accepted Answer

The engine's conf.json must specify the correct server URL using the https:// scheme and the engine must trust the server certificate.. Engine-to-server communication uses an outbound HTTPS tunnel on port 443 initiated by the engine. For the tunnel to establish, the engine's configuration must reference the server with an https:// URL and trust the server's certificate. A correct firewall rule alone is insufficient if the URL scheme is wrong or the certificate is not trusted, which is why those settings should be verified first when an engine shows as disconnected.

Answer

The engine must be added to the server's engines list with a matching engine ID and the API key must be regenerated.

Answer

The server must be configured to listen on port 8443 for engine connections instead of the default port.

Answer

Inbound TCP 443 must be opened from the server to the engine so the server can push playbook tasks.

Question 14

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Accepted Answer

Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.. For an air-gapped Cortex XSOAR installation on RHEL, the supported method is to use the offline installation bundle, which includes pre-packaged Python dependencies and local wheels. This bundle is designed for environments without internet access and ensures all required libraries are available for integrations.

Answer

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Answer

Configure the server to tunnel through an unauthenticated proxy.

Answer

Run 'demisto-sdk download-dependencies' from the CLI.

Question 15

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

Accepted Answer

TCP 443. Cortex XSOAR engines communicate with the main server via HTTPS over TCP port 443 by default.

Answer

TCP 8443

Answer

TCP 22

Answer

TCP 6222