XSOAR-Engineer Timed Practice Test 3 — 10 Questions

Question 1

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. Dashboards can be shared with specific roles or users via dashboard sharing settings.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 2

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

Accepted Answer

demisto-ctl backup. The demisto-ctl script includes built-in backup routines to safely export the system state and database.

Answer

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Answer

pg_dump demisto > backup.sql

Answer

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Question 3

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

Accepted Answer

Administrator. The Administrator role has comprehensive, unrestricted access to all settings, users, and configurations in Cortex XSOAR.

Answer

Incident Analyst

Answer

Playbook Designer

Answer

Auditor

Question 4

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Accepted Answer

Line. XSOAR supports various widget types including Pie, Bar, Line, and Number/Counter widgets.

Answer

3D-Scatter

Answer

Heatmap-Matrix

Question 5

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Accepted Answer

Tabs. Layouts can include custom fields, tabs, widgets, and sections to structure the incident view.

Answer

Kernel Modules

Answer

Firmware ROM flashing tools

Question 6

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Accepted Answer

Widgets. Dashboards consist of customizable widgets and layout containers.

Answer

Kernel panic crash dumps

Answer

Raw Docker container logs

Answer

BIOS configuration utilities

Question 7

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Accepted Answer

Active. Standard incident statuses in XSOAR include Pending, Active, Closed, and to some extent custom or built-in states like Assigned. Specifically, Active and Closed are core built-in statuses.

Answer

Archived

Answer

Quarantined

Answer

Locked

Question 8

Which TWO actions can an analyst perform within the Incident War Room?

Accepted Answer

Add analyst notes and comments. Analysts can execute integration commands and post notes/comments in the War Room.

Answer

Provision new cloud virtual machines

Answer

Configure physical firewall port speeds

Answer

Update XSOAR server SSL certificates

Question 9

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Accepted Answer

Custom tabs to organize fields into logical groupings (e.g., Triage, Containment).. Administrators can configure custom tabs to organize fields logically and add custom Markdown fields or HTML sections to display instructions or contextual notes.

Answer

Active Directory domain controller synchronization schedules.

Answer

Direct kernel-level memory dump inspectors.

Answer

Embedded firewall policy modification wizards.

Question 10

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

Accepted Answer

/var/log/demisto/demisto.log. Server runtime logs are typically directed to the system journal via systemd or stored in standard log paths like /var/log/demisto/demisto.log.

Answer

/var/log/postgresql/postgresql.log

Answer

/var/log/messages

Answer

/var/log/nginx/access.log