XSOAR-Engineer Planning Installation And Maintenance — Timed 15 Questions

Question 1

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

15 minute time limit — choose an answer to begin.

Accepted Answer

demisto-ctl backup. The officially supported and recommended method for backing up Cortex XSOAR application data (incident history, playbooks, configuration, and the internal database) is the demisto-ctl backup command. This utility is purpose-built to produce a consistent, restorable snapshot of the entire XSOAR deployment, coordinating the database and configuration files so they remain in sync. It is the method Palo Alto documents for both on-prem and self-managed environments.

Answer

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Answer

pg_dump demisto > backup.sql

Answer

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Question 2

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

Accepted Answer

Upgrade the primary server first, then secondary servers, and finally the engines.. For a zero-downtime upgrade of a Cortex XSOAR multinode HA deployment, the documented order is to upgrade the primary server first, then the secondary servers, and finally the engines. This sequence keeps the HA pair functional while the primary is upgraded and allows the secondaries to sync the new version before engines are touched. Engines are upgraded last because they are stateless workers that can be drained and restarted without affecting the application tier.

Answer

Upgrade all components simultaneously using the orchestrated installer.

Answer

Upgrade secondary servers first, then the primary server, and lastly the engines.

Answer

Upgrade the engines first, then secondary servers, and finally the primary server.

Question 3

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

Accepted Answer

server.jvm.max.memory. The JVM heap size for the Cortex XSOAR server is controlled via the server configuration parameters, specifically server.jvm.max.memory or system environment variables like JAVA_OPTS.

Answer

demisto.engine.memory.limit

Answer

incident.ingestion.buffersize

Answer

python.max.worker.memory

Question 4

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > Debug Logs. Integration logs and API execution traces can be found within the Audit logs and specific integration instance debug logs available in Settings > About > Troubleshooting.

Answer

Incidents > Audit Trail

Answer

Dashboards > Server Metrics

Answer

Settings > Advanced > System Health

Question 5

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Images. In Cortex XSOAR, the active Docker image versions used by integrations are viewed under Settings > Integrations > Docker Images. This page lists each integration's Docker image, its tag/version, and whether it is the default or a custom image. Administrators use it to audit which container versions are running and to update or override images when a newer version is required.

Answer

Dashboards > Container Health

Answer

Incidents > Management > Containers

Answer

Settings > About > System Information

Question 6

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

Accepted Answer

Uploaded via Settings > About > Troubleshooting > Server Certificate (Custom Certificate). Custom CA certificates must be uploaded to Cortex XSOAR via Settings > About > Troubleshooting > Server Certificate, which injects them into the trust store used by integration containers.

Answer

Configured inside the PostgreSQL database connection string

Answer

In the host operating system's /etc/pki/ca-trust/source/anchors/ directory only

Answer

Inside each individual integration's Python script code

Question 7

An administrator is troubleshooting a scenario where the Cortex XSOAR server is unresponsive due to a high volume of long-running python integration scripts exhausting available Docker workers. Which configuration parameter limits the maximum concurrent execution threads for Python scripts?

Accepted Answer

python.worker.max.workers. The concurrency of Python script and integration execution is managed by server configuration keys such as python.worker.max.workers.

Answer

server.max.threads

Answer

integration.concurrency.limit

Answer

docker.container.pool.size

Question 8

An administrator needs to restrict access to a specific sensitive integration instance so that only members of the Tier 2 SOC team can execute commands using it. How can this be accomplished?

Accepted Answer

Configure integration instance roles in Settings > Integrations > Instances to restrict usage to specific user roles.. Integration permissions can be restricted using Role-Based Access Control (RBAC) by assigning specific roles to integration instances.

Answer

Disable the integration for all users except Tier 2 via server configuration keys.

Answer

Place the integration inside a restricted playbook folder.

Answer

Modify the integration Python code to check the logged-in user's username.

Question 9

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Docker Registry Configuration. Private container registry credentials in Cortex XSOAR are configured centrally under Settings > Integrations > Docker Registry Configuration. This allows the XSOAR server and engines to authenticate to a private registry when pulling Docker images for integrations. The configuration includes the registry URL, username, and password.

Answer

Via the demisto-sdk registry-login command

Answer

In the individual integration instance settings under API Key

Answer

Inside the demisto.conf configuration file on the Linux host file system

Question 10

An administrator is setting up Cortex XSOAR High Availability and notices that jobs (such as scheduled automations and recurring fetches) are executing multiple times concurrently across nodes. What must be configured to prevent split-brain execution of scheduled tasks?

Accepted Answer

Ensure the server clustering configuration properly establishes a primary leader node with database-backed distributed locking.. In an HA cluster, scheduled tasks and fetching must be coordinated so that only the active leader or designated worker executes them, managed via cluster locking mechanisms and server configuration.

Answer

Disable scheduled tasks on all secondary servers via crontab.

Answer

Configure a shared Redis cache for job locking.

Answer

Set each secondary server to 'Read-Only Mode' in the server configuration.

Question 11

An administrator wants to ensure that all modifications to playbooks and automations are tracked and synchronized with a remote Git repository for version control. Where is Git integration configured in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Servers and Services > Git. Git integration for content management is configured under Settings > Integrations > Servers and Services > Git.

Answer

Incidents > Configuration > Version Control

Answer

Dashboards > Git Sync

Answer

Settings > About > Repository Settings

Question 12

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

Accepted Answer

Run 'demisto-ctl clean-history' to purge old logs and temporary files.. The demisto-ctl tool provides administrative utilities, and housekeeping configurations handle file pruning, while direct manual file deletion can cause corruption.

Answer

Drop the PostgreSQL temporary tables using psql.

Answer

Restart the demisto service with the '--purge-cache' flag.

Answer

Execute 'rm -rf /var/lib/demisto/tmp/*' directly from the Linux shell.

Question 13

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Accepted Answer

Verify content pack compatibility against the target XSOAR server version. Option A is correct because content packs are version-dependent, and Palo Alto Networks requires verifying that installed packs are compatible with the target XSOAR server version before upgrading, since incompatible packs can break playbooks, integrations, and automations after the upgrade. Option E is correct because taking a full application backup with the demisto-ctl backup command (or the equivalent backup mechanism) preserves the database, configuration, and content so the environment can be restored if the major version upgrade fails or introduces regressions. Option B is not required as a pre-upgrade step; while it may be prudent to pause ingestion to avoid data loss during the maintenance window, it is not one of the documented mandatory pre-upgrade actions and XSOAR handles queued ingestion. Option C is wrong because uninstalling all third-party content packs is not required and would unnecessarily remove functionality; only incompatible packs need attention, not wholesale removal. Option D is wrong because re-initializing the PostgreSQL schema from scratch would destroy existing data and is never part of a supported upgrade procedure.

Answer

Stop all inbound email fetching and incident ingestion streams

Answer

Uninstall all third-party marketplace content packs to prevent schema conflicts

Answer

Re-initialize the PostgreSQL database schema from scratch

Question 14

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Accepted Answer

sys.internal.limits.max.fetch.incidents. Option A, sys.internal.limits.max.fetch.incidents, is correct because it sets a hard cap on the number of incidents the server will fetch per fetch cycle, directly throttling ingestion volume during an alert storm. Option C, incident.ingestion.batch.size, is correct because it controls how many incidents are processed in a single ingestion batch, allowing the server to spread the workload and avoid being overwhelmed. Option D, integration.fetch.timeout.seconds, is correct because it bounds how long a fetch from an integration may run, preventing a slow or backlogged integration from tying up ingestion resources and cascading into overload. Option B, server.jvm.garbage.collection.interval, is not a valid XSOAR server configuration key for tuning ingestion flow, and Option E, docker.max.container.lifespan, governs container lifecycle for sandboxed integrations rather than incident ingestion throughput.

Answer

server.jvm.garbage.collection.interval

Answer

docker.max.container.lifespan

Question 15

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Accepted Answer

Settings > About in the Cortex XSOAR Web UI. Option B is correct because the Cortex XSOAR Web UI exposes the installed server version under Settings > About, where the platform displays build and version details for the tenant. Option C is correct because the server CLI provides version information through management commands such as 'demisto-ctl version' or by querying the server status, which reports the running XSOAR build. Option A is incorrect because Settings > Integrations manages integration instances and does not display the server version. Option D is incorrect because the Apache HTTP server header reflects the web server, not the Cortex XSOAR application version. Option E is incorrect because /var/lib/demisto/VERSION is not the documented location for checking the installed Cortex XSOAR server version.

Answer

Settings > Integrations > Server Version

Answer

Checking the Apache HTTP server header response

Answer

The server file system path /var/lib/demisto/VERSION