How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the XSOAR-Engineer exam, each with detailed explanations and wrong-answer analysis.

How should I approach XSOAR-Engineer scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified XSOAR Engineer (XSOAR-Engineer) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified XSOAR Engineer (XSOAR-Engineer) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

XSOAR-Engineer

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Read the full Ansible explanation →

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

A
Incident Type playbook association settings
If the incident type is not linked to a default playbook, no playbook will trigger automatically.
B
The BIOS version of the underlying hypervisor host
Why wrong: Hypervisor BIOS version has no bearing on XSOAR playbook execution logic.
C
Browser cookie expiration settings in client workstations
Why wrong: Browser cookies do not affect server-side playbook automation triggers.
D
Incoming mapper rules ensuring correct incident type classification
Incorrect classification prevents the incident from being assigned the proper type that triggers the playbook.
E
Global server playbook automation toggle settings
Playbook automation can be globally enabled or disabled in server settings.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related XSOAR-Engineer topic practice pages

Incident Interactions And Reporting practice questions

Threat Intelligence Management practice questions

Use Case Planning And Development practice questions

Playbook Development practice questions

Planning Installation And Maintenance practice questions

XSOAR-Engineer fundamentals practice questions

XSOAR-Engineer scenario practice questions

XSOAR-Engineer troubleshooting practice questions

Practice scenarios

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Which TWO actions can an analyst perform within the Incident War Room?

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)