XSOAR-Engineer Planning Installation And Maintenance Practice Test 4 — 15 Questions

Question 1

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Accepted Answer

API Keys generated within user profile settings. Option B is correct because Cortex XSOAR allows users to generate API Keys from their user profile settings, and these keys are then used by external API clients (SIEMs, scripts) to authenticate to the REST API without interactive login. Option D is correct because the XSOAR REST API also supports authenticating with a username and password, which the client exchanges for a session token/cookie used on subsequent API calls. Option A is not supported: XSOAR does not natively implement the OAuth 2.0 client credentials grant for API client authentication without user context. Option C is incorrect because Kerberos TGT-based authentication is not a supported mechanism for the XSOAR REST API. Option E is incorrect because SSH public/private key pairs are used for secure shell access, not for authenticating to the XSOAR REST API.

Answer

OAuth 2.0 client credentials grant type natively configured without user context

Answer

Kerberos ticket-granting service tickets

Answer

Public key SSH key pairs

Question 2

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Accepted Answer

Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.. Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans. Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Answer

Increase the Docker container memory limit for the PostgreSQL database container.

Answer

Delete all historical audit logs directly from the file system to free up database index space.

Answer

Run 'demisto-sdk analyze-db' from the command line interface.

Question 3

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Accepted Answer

How role-based access control (RBAC) restricts users to their specific tenant accounts.. Option B is correct because in a multi-tenant Cortex XSOAR deployment, RBAC is the mechanism that scopes users to their own tenant account, ensuring that analysts in one child tenant cannot view or act on incidents, playbooks, or data belonging to another tenant. Option D is correct because content packs are managed and distributed from the root (parent) tenant down to child tenants, so the administrator must plan how packs are pushed and which tenants receive them. Option E is correct because a key design decision is whether integrations (and their instances) are configured once at the root level and shared, or configured individually within each tenant account, which affects credential isolation and management overhead. Option A is not correct because tenants are logical partitions within the XSOAR application, not separate containers each requiring their own Linux kernel. Option C is not correct because multi-tenancy is a logical separation feature and does not require a dedicated physical server per child tenant.

Answer

Configuring independent Linux kernels for each tenant container.

Answer

Allocating a separate physical server for each child tenant.

Question 4

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

Accepted Answer

Reviewing system audit logs and health check dashboards for anomalies. Option A is correct because routine Cortex XSOAR maintenance includes monitoring system audit logs and health check dashboards (e.g., the System Health and Audit Logs views) to detect anomalies such as failed playbook runs, integration errors, or resource exhaustion before they impact incident response. Option E is correct because keeping content packs and integrations current via the Cortex XSOAR Marketplace is a standard maintenance task that delivers bug fixes, new commands, and updated detection logic, and is typically managed through the Marketplace or the Content Management interface. Option B is not a maintenance task because the Python interpreter ships with the platform and is upgraded through official Cortex XSOAR releases, not by manually recompiling binaries. Option C is not performed because disk formatting is destructive and only done during initial deployment or disaster recovery, not weekly. Option D is not routine because SSL certificates are replaced on a scheduled expiration cycle (typically annually or per organizational policy), not daily.

Answer

Manually recompiling the Python interpreter binary

Answer

Formatting the server storage disks weekly

Answer

Replacing the SSL certificate daily

Question 5

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Accepted Answer

Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.. Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step. Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Answer

Reinstall the core Linux operating system kernel on the server.

Answer

Modify the PostgreSQL database schema to enable container debugging tables.

Question 6

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

Accepted Answer

HTTP/HTTPS proxy server settings for outbound integration traffic. Option A is correct because the Cortex XSOAR server configuration file (and the Server Configuration UI) exposes proxy settings, allowing outbound integration and content traffic to be routed through an HTTP/HTTPS proxy. Option C is correct because session timeout duration for inactivity is a tunable server setting that controls how long an idle user session remains valid before re-authentication is required. Option D is correct because logging verbosity levels can be adjusted per module to increase or decrease log detail for troubleshooting purposes. Option B is not correct because physical RAM allocation is a hardware/hypervisor-level resource, not a setting in the XSOAR server configuration file or UI. Option E is not correct because CPU clock speed is determined by the underlying hypervisor or hardware and cannot be customized through the XSOAR server configuration.

Answer

The physical RAM allocation size of the host server motherboard

Answer

The CPU clock speed of the underlying hypervisor

Question 7

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Accepted Answer

Schedule automated regular backups of both configuration and database files to secondary storage.. Option B is correct because Cortex XSOAR's supported disaster-recovery practice is to schedule automated backups of both the configuration and the database (e.g., via the built-in backup mechanism or scripts) and store them on secondary/off-box storage so the environment can be restored after node or site failure. Option C is correct because for high availability and DR, production deployments should use an external highly available PostgreSQL cluster (e.g., streaming replication with automatic failover) instead of the embedded database, which is single-node and unsuitable for HA. Option E is correct because placing a load balancer in front of multiple Cortex XSOAR application server nodes distributes traffic, enables health-check-based failover, and removes the application server as a single point of failure. Option A does not belong because running integration Docker containers in privileged root mode is a security anti-pattern and is not required for HA/DR. Option D does not belong because disabling database persistence sacrifices durability and would prevent recovery, directly contradicting disaster-recovery requirements.

Answer

Run all integration Docker containers in privileged root mode across all nodes.

Answer

Disable database persistence to maximize disk I/O performance.

Question 8

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

Accepted Answer

Configure the SMTP settings in the Server Configuration, including the SMTP server address, port, username, and password.. To enable email notifications for incidents in Cortex XSOAR, the administrator must configure the SMTP settings in the Server Configuration. This includes the SMTP server address, port, and authentication credentials. This configuration allows the server to send notifications automatically, ensuring that incidents are communicated to the appropriate teams.

Answer

Install and configure the Mail Sender integration instance with the SMTP server details.

Answer

Create a playbook that triggers on incident creation and uses the 'send-mail' command with hardcoded SMTP details.

Answer

Modify the docker environment variables to include SMTP credentials for the notification service.

Question 9

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

Accepted Answer

Upload the identity provider's metadata XML to the Cortex XSOAR server in the SAML configuration section.. To enable SAML SSO in Cortex XSOAR, the administrator must upload the identity provider's metadata XML in the SAML configuration section. This metadata includes the necessary information for the server to trust and communicate with the identity provider, such as the SSO URL and signing certificate. This step is essential for establishing the SAML trust relationship.

Answer

Modify the server's hosts file to map the identity provider's domain to the Cortex XSOAR server IP.

Answer

Generate a self-signed certificate on the Cortex XSOAR server and provide it to the identity provider for encryption.

Answer

Install the SAML integration from the Marketplace and configure it with the identity provider details.

Question 10

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Accepted Answer

Configure the engine to connect outbound to the server on port 443 using the engine key.. Engines connect outbound to the XSOAR server on the configured port, authenticating with an engine key. This allows deployment in restricted networks where only outbound TCP 443 is permitted. The server does not initiate connections to the engine, so no inbound rules are needed. Other options either misstate the communication direction or propose unsupported mechanisms.

Answer

Deploy the engine as a Docker container on the XSOAR server and use the loopback interface.

Answer

Set the engine to use a reverse tunnel over HTTPS to the server.

Answer

Open inbound port 443 on the firewall to allow the server to push tasks to the engine.

Question 11

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

Accepted Answer

At least 500 GB of SSD storage for the database and Docker images.. For a Cortex XSOAR server with 32 GB of RAM and 8 CPU cores, best practices recommend allocating at least 500 GB of SSD storage. This space is needed for the database, Docker images, and logs. Insufficient storage can lead to performance degradation and failures, so proper disk allocation is essential for optimal operation.

Answer

A dedicated GPU for accelerated playbook execution.

Answer

A second network interface for out-of-band management.

Answer

At least 64 GB of RAM to support the Java heap size.

Question 12

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

Accepted Answer

Export all custom playbooks, automations, and integrations using the server's backup and restore mechanism.. A robust backup strategy for XSOAR includes both the built-in backup and restore mechanism, which captures custom content and configuration, and a full VM or volume snapshot for complete system recovery. These two together ensure that all necessary components can be restored after a failed upgrade. Other options are either partial or unrelated to backup and restore.

Answer

Export only the integration instances and their credentials.

Answer

Manually copy the /var/log/demisto directory to a remote share.

Answer

Schedule a daily report of all incidents to be emailed to the administrator.

Question 13

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the engine to use a direct connection to the main server over port 443 with a valid SSL certificate.. To deploy an engine for high-volume ingestion, secure and reliable communication with the main server is essential, typically via port 443 with SSL. Additionally, adequate CPU and memory must be allocated to handle the load, and monitoring ensures ongoing performance. These two actions address connectivity and processing capacity, which are critical for the engine's role.

Answer

Enable the engine to act as a standalone server to reduce dependency on the main server.

Answer

Configure the engine to use a proxy server for all outbound communication to the main server.

Answer

Install the engine on a Windows server instead of Linux to improve performance.

Question 14

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

Accepted Answer

Use the built-in backup and restore mechanism available in the Cortex XSOAR settings, which creates a full backup file. The built-in backup and restore mechanism in Cortex XSOAR is specifically designed to create a comprehensive backup that includes incidents, playbooks, integrations, and system settings. It produces a restorable file that can be used to recover the server or migrate to a different server, ensuring all critical data is preserved.

Answer

Perform a file-level backup of the /var/lib/docker directory and the Cortex XSOAR installation directory

Answer

Use a third-party database backup tool to back up the MongoDB database only

Answer

Export each playbook and integration individually via the Cortex XSOAR UI and manually recreate incidents

Question 15

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

Accepted Answer

The server must have outbound HTTPS access to the Cortex XSOAR update servers on port 443.. Automatic updates for Cortex XSOAR content packs and system components are fetched over HTTPS on port 443. The server must have outbound access to the update servers to download these updates. Other protocols like SSH, FTP, or DNS alone do not support the update mechanism and would fail to deliver the necessary files.

Answer

The server must have outbound SSH access on port 22 to the update servers.

Answer

The server must have outbound DNS access on port 53 only; updates are pulled via DNS queries.

Answer

The server must have outbound FTP access on port 21 to download update packages.