Sample questions
Certified XSOAR Engineer (XSOAR-Engineer) practice questions
An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?
An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configure…
An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?
An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?
When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?
When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?
During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Ro…
An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?
When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?
An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?
An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?
An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive t…
An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?
Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?
An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's quer…
Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?
Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?
What is the primary function of the Cortex XSOAR Content Pack mechanism?
An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?
When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?
An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?
An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for tak…
Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?
Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?