XSOAR-Engineer Planning Installation And Maintenance Practice Test 3 — 15 Questions

Question 1

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

Accepted Answer

systemctl restart demisto. Cortex XSOAR runs as a systemd service named 'demisto' on RHEL systems.

Answer

demisto-ctl restart

Answer

systemctl restart cortex-xsoar

Answer

service xsoar-server restart

Question 2

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

Accepted Answer

PostgreSQL. Cortex XSOAR utilizes an external PostgreSQL database for server clustering and state management to ensure high availability across multiple engine and server instances.

Answer

MySQL

Answer

Microsoft SQL Server

Answer

MongoDB

Question 3

What is the primary purpose of deploying a Cortex XSOAR Engine?

Accepted Answer

To execute integrations and playbooks in isolated network segments and reduce server load. Cortex XSOAR Engines are lightweight execution components that run integrations, scripts, and playbook tasks. They are typically deployed in remote or isolated network segments (e.g., DMZ, OT networks) so that the engine can reach internal resources without exposing the main XSOAR server. Offloading execution to engines also reduces load on the main application server.

Answer

To act as a primary database replica for high availability

Answer

To handle user authentication and single sign-on (SSO) requests

Answer

To store long-term incident archives for compliance reporting

Question 4

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

Accepted Answer

Use the Marketplace interface to select the specific content pack and downgrade to the previous stable version.. Cortex XSOAR Marketplace allows administrators to manage installed content pack versions and roll back to previous versions directly from the Marketplace view.

Answer

Delete the content pack folder from the file system and restart the server.

Answer

Run 'demisto-sdk downgrade' from the CLI.

Answer

Restore the entire server from the last nightly database backup.

Question 5

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

Accepted Answer

Native Syslog forwarding (TCP/UDP) configured in Server Configuration. Cortex XSOAR supports forwarding audit logs via Syslog (TCP/UDP) natively through server configuration settings.

Answer

SNMP v3 Traps

Answer

NetFlow v9 streaming

Answer

WMI event subscription

Question 6

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Accepted Answer

Account-based segregation with role-based access control (RBAC) on the central server. In Cortex XSOAR multi-tenancy, accounts and roles manage data segregation between tenants on a single central server.

Answer

Individual PostgreSQL database instances per tenant schema

Answer

Dedicated Docker containers per tenant

Answer

Physical server separation linked via API gateways

Question 7

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role in Cortex XSOAR holds full administrative privileges across the entire platform, including user management, system settings, integrations, and content. It is the highest-privilege built-in role and is the only one that can modify global configuration and manage other users. This makes it the correct answer for a question about full platform-wide administrative control.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 8

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

Accepted Answer

The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.. Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Answer

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Answer

The user's email address contains uppercase characters.

Answer

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Question 9

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Accepted Answer

Settings > Advanced > Server Configuration. Data retention, incident archiving, and cleanup schedules are managed under Settings > Advanced > Server Configuration.

Answer

Incidents > Retention Policies

Answer

Dashboards > Maintenance Settings

Answer

Settings > Integrations > Database Maintenance

Question 10

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Accepted Answer

To package related integrations, playbooks, scripts, and dashboards into a single installable unit. A Cortex XSOAR Content Pack is a versioned, installable bundle that packages related integrations, playbooks, scripts, dashboards, incident types, fields, and layouts into a single unit. It enables one-click installation and dependency management from the Marketplace. This is the primary mechanism for distributing and deploying XSOAR content.

Answer

To compile raw source code into executable binary binaries

Answer

To manage Docker container images for offline deployment

Answer

To store encrypted user passwords and API keys securely

Question 11

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

Accepted Answer

/var/log/demisto/demisto.log. On a Linux-based Cortex XSOAR server, the primary application runtime logs — including stdout and stderr from the demisto server process — are written to /var/log/demisto/demisto.log. This file captures server startup, integration execution errors, and core application events, making it the first place to check for runtime issues.

Answer

/var/log/postgresql/postgresql.log

Answer

/var/log/messages

Answer

/var/log/nginx/access.log

Question 12

What is the purpose of the Cortex XSOAR Health Check integration?

Accepted Answer

To monitor system resources, database connectivity, and platform operational metrics. The Health Check integration monitors the operational status of the XSOAR server, database connectivity, license expiration, and integration health.

Answer

To test outbound internet connectivity for Docker Hub

Answer

To scan endpoints for malware and vulnerabilities

Answer

To validate syntax in custom Python automation scripts

Question 13

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

Accepted Answer

UDP, TCP, and TLS (Encrypted TCP). Cortex XSOAR Syslog integration supports UDP, TCP, and TLS-secured TCP connections for log forwarding.

Answer

UDP only

Answer

UDP and TCP (Plaintext only)

Answer

HTTPS REST API only

Question 14

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

Accepted Answer

Settings > Import / Export > Import. Settings > Import / Export > Import. This is the built-in Cortex XSOAR UI feature specifically designed to import a previously exported content bundle (a .zip file containing playbooks, scripts, layouts, and other custom content) from one environment into another. It handles dependency resolution and version compatibility, making it the standard method for migrating custom content between development and production instances.

Answer

demisto-ctl import-content

Answer

Settings > Integrations > Content Transfer

Answer

Marketplace > Upload Custom Pack

Question 15

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

Accepted Answer

Generate and configure the engine communication key on the Cortex XSOAR server and apply it to the engine.. Option A is correct because the engine must authenticate to the Cortex XSOAR server using a communication key generated on the server, which is then applied to the engine during setup so it can register and establish the trust relationship through the load balancer. Option C is correct because the engine's conf.json must be edited to point to the primary server or load balancer URL and to include the authentication key, which is how the engine knows where to connect and how to authenticate. Options B, D, and E are not required: the engine does not need root privileges to bypass load balancer port restrictions, it does not require a local PostgreSQL instance (the database resides on the Cortex XSOAR server), and inbound port 22 on the load balancer is not used for engine heartbeat monitoring.

Answer

Configure the engine to run with root privileges to bypass load balancer port restrictions.

Answer

Install a dedicated PostgreSQL database instance locally on the engine host.

Answer

Open inbound port 22 on the load balancer for engine heartbeat monitoring.