XSOAR-Engineer Planning Installation And Maintenance Practice Test 5 — 15 Questions

Question 1

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Native installer script. For installing Cortex XSOAR server on a Linux distribution like Ubuntu, Palo Alto Networks provides a native installer script. This script handles the installation of all necessary components and is the officially supported method. Other methods like Docker Compose, Helm charts, or manual compilation are not supported for the server component. Therefore, the native installer script is the correct choice.

Answer

Docker Compose deployment

Answer

Manual compilation from source code

Answer

Kubernetes Helm chart

Question 2

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

Accepted Answer

The host must have a supported container runtime installed and configured.. Docker-based integrations in XSOAR require a supported container runtime on the host. Without it, the server cannot execute containerized content. Other options list unnecessary or unrelated requirements such as GPU, Active Directory, or excessive RAM, which are not needed for this purpose.

Answer

The host must have a minimum of 1 TB of RAM.

Answer

The host must have a GPU available for accelerated computing.

Answer

The host must be joined to an Active Directory domain.

Question 3

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

Accepted Answer

Use the built-in backup and restore utility to create a full backup on the old server and restore it on the new cloud instance.. Migrating Cortex XSOAR requires preserving all data, configurations, and custom content. The built-in backup and restore utility is designed for this purpose, capturing the PostgreSQL database, Elasticsearch indices, and system settings. Restoring the backup on the new cloud instance ensures a complete and consistent migration with minimal downtime when done during a maintenance window.

Answer

Export all incidents and playbooks via the API, then import them on the new server after a fresh installation.

Answer

Manually copy the PostgreSQL database files and Elasticsearch data directory to the new server, then start the services.

Answer

Set up database replication between the old and new servers, then switch over after replication is complete.

Question 4

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

Accepted Answer

The engine must have outbound access to the Cortex XSOAR server on port 443.. The Cortex XSOAR engine initiates connections to both the Cortex XSOAR server and the SIEM. It requires outbound access to the server on port 443 to receive tasks and send results. It also requires outbound access to the SIEM on the appropriate port to fetch incidents. Inbound access to the engine is not needed for these communications, as the engine acts as a client in both cases.

Answer

The engine must have inbound access from the Cortex XSOAR server on port 22.

Answer

The engine must have inbound access from the SIEM on the required port.

Answer

The engine must have inbound access from the Cortex XSOAR server on port 443.

Question 5

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

Accepted Answer

Check the engine's logs for connection errors or authentication failures.. When an engine is disconnected despite basic network connectivity, the engine's logs are the best source of information. They can reveal authentication failures, TLS errors, or misconfigured server addresses. Other actions, such as restarting the server or checking hostname resolution, are either disruptive or redundant given the scenario.

Answer

Verify that the engine's hostname resolves correctly from the server.

Answer

Restart the XSOAR server to clear any temporary glitches.

Answer

Increase the engine's memory allocation to improve performance.

Question 6

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

Accepted Answer

Enable SSL on the PostgreSQL server and configure the Cortex XSOAR server to connect using the sslmode=require parameter in the database connection string.. The correct approach is to enable SSL on the PostgreSQL server and configure the Cortex XSOAR connection string with sslmode=require. This ensures that all database traffic is encrypted using TLS. The other options either do not provide transport encryption, introduce unsupported components, or would prevent the application from connecting to the database.

Answer

Set the PostgreSQL listen_addresses parameter to localhost and rely on the operating system's loopback interface for security.

Answer

Install a reverse proxy between the Cortex XSOAR server and PostgreSQL to terminate TLS and forward unencrypted traffic to the database.

Answer

Configure the Cortex XSOAR server to use the PostgreSQL native pgcrypto extension for column-level encryption.

Question 7

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Accepted Answer

Engines communicate with the Cortex XSOAR server over HTTPS on port 443 by default.. Cortex XSOAR engines are remote execution components that connect to the server over HTTPS on port 443. They enable integration execution in remote network segments, providing local access to resources. They do not store the incident database and require server connectivity to function, so the true statements are about remote deployment and secure communication.

Answer

Engines store a copy of the Cortex XSOAR incident database for offline access.

Answer

Engines can only run Docker-based integrations and cannot execute scripts directly on the host.

Answer

Engines automatically synchronize playbooks and integrations from the server and can execute them without server connectivity.

Question 8

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Accepted Answer

The Cortex XSOAR server. The Cortex XSOAR server is the central component that distributes incidents and tasks to engines. It manages incident state, playbook execution, and engine communication. Load balancers, message queues, and engine hierarchy do not play a role in task distribution.

Answer

The load balancer

Answer

The message queue service

Answer

The engine that was installed first

Question 9

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

Accepted Answer

Download the content pack from another Cortex XSOAR instance with internet access and manually upload the pack file via the Marketplace interface.. In an air-gapped environment, content packs can be installed by manually uploading a pack file obtained from a connected system or the support portal. This is the supported offline installation method. Proxy configuration, SDK commands, or non-existent offline mode settings do not work when all outbound access is blocked.

Answer

Use the command-line tool 'demisto-sdk download' to fetch the pack directly on the server.

Answer

Configure a proxy server in Cortex XSOAR settings to allow Marketplace access.

Answer

Enable the 'Offline Mode' checkbox in the Marketplace settings, which allows installation from a local repository.

Question 10

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

Accepted Answer

Use the built-in backup and restore mechanism in Cortex XSOAR to create a backup file that includes the database and configuration.. The built-in backup and restore mechanism is designed to create a consistent backup of the Cortex XSOAR database and configuration, including incidents, playbooks, and settings. Other methods either capture only partial data, risk inconsistency, or are not supported for full-system recovery. Using the native tool ensures a reliable and restorable backup.

Answer

Perform a file-level backup of the /var/lib/docker directory to capture all containers and volumes.

Answer

Take a snapshot of the virtual machine hosting Cortex XSOAR using the hypervisor's snapshot feature.

Answer

Export each playbook and integration individually through the Cortex XSOAR UI and save the JSON files.

Question 11

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

Accepted Answer

Check the engine's log files for errors related to authentication or certificate validation.. The engine's log files are the best source of information for diagnosing connection issues. Errors related to authentication, certificates, or configuration will be recorded there. Since network connectivity is already verified, the next step is to examine logs for specific failure reasons. Other actions like restarting the server or checking inbound access are not appropriate for this scenario.

Answer

Verify that the engine has inbound access from the server on port 443.

Answer

Restart the Cortex XSOAR server to re-establish the connection.

Answer

Increase the engine's allocated memory and CPU resources.

Question 12

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Accepted Answer

Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.. The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder. Minimizing downtime is achieved by the sequential approach.

Answer

Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.

Answer

Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.

Answer

Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.

Question 13

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

Accepted Answer

Use the Backup and Restore page in the Settings section of the Cortex XSOAR UI.. The Backup and Restore page in the Cortex XSOAR Settings provides a supported way to export a complete configuration snapshot, including playbooks, integrations, and system settings. This snapshot can be downloaded and used to restore the system if a content update introduces problems. Other methods either target development workflows or produce incomplete or inconsistent backups.

Answer

Copy the /usr/local/demisto directory to an external drive.

Answer

Run the demisto-sdk backup command on the server.

Answer

Execute the pg_dump utility against the PostgreSQL database.

Question 14

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

Accepted Answer

In the Settings > Audit Log page, which records user actions, playbook runs, and configuration changes with timestamps.. Cortex XSOAR includes a dedicated Audit Log under Settings that records user actions, playbook executions, and configuration changes with timestamps and user attribution. This built-in feature is designed for compliance and troubleshooting, unlike server.log which holds runtime messages, the incident-scoped War Room, or the Marketplace which manages content packs.

Answer

In the /var/log/demisto/server.log file on the Cortex XSOAR server, which contains the full audit trail.

Answer

In the Cortex XSOAR Marketplace under the Content Packs tab, which logs all administrative actions.

Answer

In the incident War Room of each incident, where all user and playbook actions are permanently archived.

Question 15

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

Accepted Answer

Back up the Cortex XSOAR database and configuration using the built-in backup mechanism or a supported snapshot.. Before upgrading a production Cortex XSOAR server, a verified backup of the database and configuration protects against data loss and enables rollback. Reviewing release notes and confirming a supported upgrade path prevents issues caused by skipping required intermediate versions. Deleting incidents, uninstalling content packs, or disabling all integrations are not prerequisites and can cause harm or operational gaps.

Answer

Delete all old incidents to reduce database size and speed up the upgrade process.

Answer

Disable all integration instances to stop inbound alert ingestion during the maintenance window.

Answer

Uninstall all content packs to prevent version conflicts during the upgrade.