XSOAR-Engineer Use Case Planning And Development Practice Test 3 — 15 Questions

Question 1

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In indicator extraction settings or playbook conditional filters that check for private IP ranges (RFC 1918) before querying external APIs.. Indicator filters or classifier rules can be configured to ignore private, reserved, or internal IP ranges before sending queries to external commercial threat intel feeds.

Answer

By increasing the timeout value of the HTTP client.

Answer

By disabling all threat intelligence integrations entirely.

Answer

Within the user permission role definitions.

Question 2

An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?

Accepted Answer

Configure a polling loop with a wait/sleep task that periodically checks the sandbox job status until completion.. Using a timer/sleep task or polling loop combined with a wait-for-results mechanism (or callback/webhook) allows the playbook to check status periodically without wasting continuous active processing time.

Answer

Increase the server RAM allocation to allow blocking threads.

Answer

Run an infinite loop with zero delay checking the API every millisecond.

Answer

Terminate the playbook immediately and require manual review for all files.

Question 3

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

Accepted Answer

Define script arguments in the script settings and access them via demisto.args() in Python.. XSOAR automation scripts receive runtime parameters through script arguments, which are declared in the script's settings (YAML/metadata) and retrieved inside Python via demisto.args(). This allows administrators to configure values like thresholds per-task or per-playbook without editing source code. It is the standard, supported pattern for parameterizing automation.

Answer

Hardcode the threshold value directly as a global variable in every script file.

Answer

Write the value to the server's /etc/passwd configuration file.

Answer

Store the threshold inside a browser cookie on the analyst's machine.

Question 4

An XSOAR architect is designing an automated incident lifecycle where incidents that remain unresolved after 72 hours must be automatically escalated to senior management and assigned a specific tag. Which XSOAR feature is designed to execute logic based on time-based triggers or SLAs?

Accepted Answer

Incident SLAs and timer/scheduled automation rules configured for SLA breach actions.. SLAs (Service Level Agreements) and timer tasks or automated scheduled scripts/rules can track incident duration and trigger escalation workflows when time thresholds are breached.

Answer

Integration instance polling frequency parameters.

Answer

Standard browser session timeout settings.

Answer

The daily database backup cron schedule.

Question 5

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

Accepted Answer

XSOAR Dashboards and Reports with built-in widget templates for metrics and automation ROI.. XSOAR Dashboards and Reports provide native widgets and reporting templates specifically designed to visualize SOC metrics, automation ROI, and incident statistics.

Answer

The user role permissions matrix table.

Answer

The integration instance health status indicator.

Answer

Linux system kernel logs viewable via SSH.

Question 6

An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?

Accepted Answer

Using demisto.getLastRun() and demisto.setLastRun() to persist cursor timestamps between execution cycles.. In XSOAR custom integrations, the fetch-incidents command must persist state between polling cycles to avoid missing or duplicating incidents. The demisto.getLastRun() and demisto.setLastRun() functions are specifically designed for this purpose, storing a JSON object that persists across executions. Using these ensures the cursor timestamp is reliably saved and retrieved, enabling correct incremental fetching.

Answer

Writing the cursor value to a global environment variable in the operating system shell.

Answer

Storing the cursor in the browser local storage of the administrator who configured the instance.

Answer

Hardcoding the timestamp directly into the integration YAML source code.

Question 7

When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)

Accepted Answer

The steps are well-defined, repeatable, and follow a standard operating procedure.. Option D is correct because XSOAR playbooks and automation tasks depend on deterministic, documented workflows: well-defined, repeatable steps that follow a standard operating procedure can be translated into tasks, conditional branches, and scripts, whereas ambiguous or ad hoc processes cannot be reliably automated. Option E is correct because high execution frequency maximizes the return on automation investment, as XSOAR can execute the playbook consistently at scale, reducing analyst workload and MTTR for frequently recurring incidents. Options A, B, and C are not appropriate: a task performed once every five years (A) offers negligible ROI and would likely become stale before reuse; processes requiring constant creative intuition and subjective executive judgment (B) are not deterministic and should remain human-driven; and systems with completely undocumented, unsupported proprietary APIs (C) lack the integration surface XSOAR needs to reliably execute automated actions.

Answer

The task is performed exactly once every five years.

Answer

The process requires constant creative intuition and subjective executive judgment.

Answer

The underlying systems have completely undocumented and unsupported proprietary APIs.

Question 8

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

Accepted Answer

Pass password parameters to the file extraction task, or design a prompt for an analyst to supply known container passwords.. XSOAR's file extraction tasks (e.g., the 'Extract Archive' or 'Unzip File' commands) accept a password parameter that allows the playbook to programmatically supply known passwords, such as the common 'infected' password used in malware analysis. Additionally, when the password is unknown, the playbook can use an analyst prompt task (e.g., 'Ask' or 'Manual Task') to request the password from a human analyst, enabling dynamic handling of password-protected archives. This approach balances automation with human intervention, ensuring that encrypted files are properly processed without data loss.

Answer

Convert all archive files into plain text PDF documents automatically.

Answer

Restart the XSOAR server container to clear encryption keys.

Answer

Instantly delete any file ending in a .zip extension without inspection.

Question 9

An XSOAR architect is designing a SOC workflow where critical alerts from a SIEM must bypass the standard queue and immediately trigger an urgent page to the on-call engineer. Which integration category and playbook design pattern should be utilized?

Accepted Answer

PagerDuty/On-call alerting integration tasks placed on a high-priority incident routing path.. PagerDuty or on-call alerting integrations combined with high-priority conditional playbook branching ensure urgent notifications are dispatched instantly.

Answer

A scheduled weekly email summary report sent to department heads.

Answer

A pre-processing rule that archives all critical alerts.

Answer

A database index optimization job.

Question 10

An XSOAR architect is designing incident data ingestion flows. Which TWO mechanisms can be used to filter or modify incoming raw events before they are officially created as XSOAR incidents? (Choose TWO)

Accepted Answer

Integration instance configuration filters and mapper settings.. Option C is correct because integration instance configuration in XSOAR allows you to define fetch filters (e.g., query parameters, incident type filters, and fetch limits) and classifier/mapper settings that determine which raw events are ingested and how their fields are transformed into incident fields before the incident is created. Option D is correct because pre-processing rules (Pre-Process Rules) in XSOAR settings are evaluated on incoming events and can drop, filter, or modify events—including changing fields or linking to existing incidents—before an incident is officially created. Option A is incorrect because nightly PostgreSQL backups are a database maintenance/DR activity and have no role in filtering or transforming incoming events. Option B is incorrect because playbook post-processing tasks run after an incident exists (and after closure), so they cannot affect pre-creation ingestion. Option E is incorrect because browser CSS stylesheets only affect the visual rendering of the login page and have no bearing on event ingestion logic.

Answer

Nightly PostgreSQL database backup snapshots.

Answer

Playbook post-processing tasks that run after incident closure.

Answer

Browser CSS stylesheets applied to the login page.

Question 11

When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)

Accepted Answer

Implement error handling and alternative paths (such as timeout or failure branches) for critical integration tasks.. Option A is correct because implementing error handling and alternative paths (timeout or failure branches) for critical integration tasks makes playbooks resilient and easier to maintain, since failures are handled explicitly rather than causing silent or cascading errors. Option C is correct because utilizing sub-playbooks to modularize complex or repeated workflow logic reduces duplication, isolates changes to one place, and improves readability of the parent playbook. Option E is correct because giving playbook tasks clear, descriptive names instead of leaving default integration command names makes the workflow self-documenting and far easier for other analysts and architects to understand and maintain. Option B is not appropriate because hardcoding API authentication tokens into task descriptions exposes credentials and creates a maintenance burden whenever tokens rotate; credentials should be stored in XSOAR credentials or integration instances. Option D is not appropriate because combining all enrichment, containment, and reporting steps into a single massive, unbranched task destroys modularity, makes troubleshooting and reuse difficult, and violates the maintainability and readability goals of the scenario.

Answer

Hardcode all API authentication tokens directly into every playbook task description.

Answer

Combine all enrichment, containment, and reporting steps into a single massive, unbranched task.

Question 12

An XSOAR administrator is planning security and access controls for a multi-team SOC deployment. Which THREE components are essential when configuring Role-Based Access Control (RBAC) and data permissions? (Choose THREE)

Accepted Answer

Assigning users to specific Roles that define permissions for incident types, war room access, and settings.. RBAC roles, incident query filters (incident restriction queries), and role-based permissions on playbooks/integrations ensure secure multi-team segregation.

Answer

Sharing a single Administrator account credentials among all seventy SOC analysts.

Answer

Disabling authentication entirely on the XSOAR server API endpoints.

Question 13

When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)

Accepted Answer

Incident Fields and Layouts that structure and display data attributes in the UI.. Option A is correct because Incident Fields define the individual data attributes captured on an incident (such as severity, source IP, or detection time), and Layouts determine how those fields are grouped, ordered, and displayed in the analyst UI, making them the fundamental constructs for structuring and presenting incident information. Option B is correct because Incident Types classify the category of security event (for example, Phishing, Malware, or Brute Force) and drive the associated playbook, field set, and layout, so they are essential for organizing incidents into meaningful categories. Options C, D, and E are incorrect because physical rack elevations, browser extension manifests, and Linux kernel module parameters are unrelated to XSOAR's incident data model and play no role in organizing or displaying incident information to analysts.

Answer

Physical server rack elevation diagrams.

Answer

Browser extension plugin manifests.

Answer

Linux kernel module compilation parameters.

Question 14

An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)

Accepted Answer

demisto.args() for retrieving argument values passed into the script or command.. Option A is correct because demisto.args() is a standard Demisto Python API method that returns a dictionary of the arguments passed into the automation or integration command, allowing the script to read input parameters such as command arguments. Option D is correct because demisto.results() is the canonical method for returning outputs from a script, including human-readable entries, context data, and errors, back to the Cortex XSOAR war room. The remaining options are not part of the Demisto API: os.format_disk() (B) is not a real Python os function and would be destructive host-level behavior irrelevant to XSOAR scripting, demisto.shutdown_server() (C) does not exist in the API and would be an inappropriate destructive action, and sys.reboot_engine() (E) is not a Demisto method and does not relate to network switch management.

Answer

os.format_disk() for repartitioning the host server's root drive.

Answer

demisto.shutdown_server() to permanently kill the production database.

Answer

sys.reboot_engine() for restarting physical network switches.

Question 15

An XSOAR implementation team is planning threat intelligence management workflows. Which THREE capabilities does XSOAR provide natively for managing and acting upon threat indicators? (Choose THREE)

Accepted Answer

Indicator matching against active incidents to detect historical compromise.. Option A is correct because XSOAR's threat intel management includes indicator relationships and search that let you match indicators against existing and closed incidents, enabling retroactive/historical compromise hunting. Option B is correct because XSOAR natively performs indicator extraction (via the built-in extractIndicators/Indicator Extraction rules and regex-based extractors) from unstructured fields such as email bodies and incident descriptions. Option D is correct because XSOAR computes a DBot score for indicators on a 0-3 scale (Unknown, Good, Suspicious, Bad), which drives reputation-based decisions and playbook branching. Option C is not a XSOAR capability; it is a data center/DCIM or ITSM function, not threat intel management. Option E is also not provided by XSOAR; exploit compilation is an offensive security/development task outside the platform's native threat intel workflows.

Answer

Physical hardware asset tracking and automated server rack cooling adjustment.

Answer

Direct compilation of proprietary operating system kernel exploits.