XSOAR-Engineer Practice Questions

Question 1

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

Accepted Answer

Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.. The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder. Minimizing downtime is achieved by the sequential approach.

Answer

Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.

Answer

Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.

Answer

Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.

Question 2

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Accepted Answer

In indicator extraction settings or playbook conditional filters that check for private IP ranges (RFC 1918) before querying external APIs.. Indicator filters or classifier rules can be configured to ignore private, reserved, or internal IP ranges before sending queries to external commercial threat intel feeds.

Answer

By increasing the timeout value of the HTTP client.

Answer

By disabling all threat intelligence integrations entirely.

Answer

Within the user permission role definitions.

Question 3

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Accepted Answer

Open the indicator's details page and review the 'Sources' field, which lists all feeds and manual entries that reported the indicator.. The Sources field on an indicator's details page is the authoritative place to see all feeds and manual entries that have reported the indicator. It aggregates every source that contributed to the indicator's presence and reputation, enabling analysts to assess which threat intelligence sources consider the IP malicious. This is the most direct and accurate method.

Answer

Run the '!ip' command in the CLI to query the indicator and view its reputation score.

Answer

Navigate to the Threat Intel page and apply a filter by the indicator's value to see all related incidents.

Answer

Check the incident's War Room entries for any feed integration logs that mention the indicator.

Question 4

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?

Accepted Answer

In the integration instance configuration settings under mapper parameters.. Integration instance configuration settings provide the mapping interface between XSOAR incident fields and external ticketing system fields.

Answer

As part of the role-based access control (RBAC) permissions matrix.

Answer

Inside the Demisto system log file (/var/log/demisto/server.log).

Answer

Within the server health-check dashboard.

Question 5

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. In Cortex XSOAR, the widget creation wizard exposes a 'Widget Type' selector that includes Bar, Line, Pie, Number, Text, and others. A pie chart visualization is produced by selecting the Pie widget type, which renders incident counts grouped by a chosen field such as severity. This is the direct mapping between the desired visualization and the widget type option.

Answer

Bar

Answer

Number

Answer

Line

Question 6

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

Accepted Answer

By adding Notes or Task Descriptions in the task properties drawer. The playbook design interface in Cortex XSOAR provides a task properties drawer where engineers can add Notes and Task Descriptions to document business logic, conditional branches, and expected outcomes. These fields are stored with the task definition and are visible to anyone editing or reviewing the playbook, making them the correct place for inline documentation. This keeps documentation versioned alongside the playbook itself rather than in external channels.

Answer

By emailing the JSON export to the team

Answer

By writing comments inside the incident war room

Answer

By modifying the server's README.md file

Question 7

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Accepted Answer

Close incidents. The Incident WorkArea action menu is designed for incident lifecycle and response operations, so Close incidents (B) is correct because it lets analysts resolve selected incidents directly from the work area. Run playbook (C) is correct because playbooks are automated response workflows that can be triggered against selected incidents from that menu. Assign owner (E) is correct because reassigning incident ownership is a standard incident-management action available for selected incidents. Upgrade server operating system (A) and Format physical hard drives (D) are not incident work-area actions; they are infrastructure/OS-level operations performed through other management or deployment tooling, not from the incident action menu.

Answer

Upgrade server operating system

Answer

Format physical hard drives

Question 8

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

Accepted Answer

Incident closure layout with a required 'Close Notes' field for the relevant classification.. Closure layouts control the fields presented when closing an incident and can mark specific fields as required. Configuring the closure layout so Close Notes is mandatory for the False Positive classification ensures the rationale is captured before closure completes.

Answer

Incident field of type 'Long Text' with a validation regex that rejects empty values.

Answer

Playbook task that sends an email to the manager whenever an incident is closed.

Answer

Dashboard widget that counts incidents closed without notes and alerts the SOC manager.

Question 9

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

Accepted Answer

A clear, descriptive name reflecting the playbook's workflow purpose. Option A is correct because a clear, descriptive name that reflects the playbook's workflow purpose is essential for discoverability and for users to understand at a glance what the playbook does when browsing the organization-wide library. Option C is correct because documentation or a description explaining input requirements and expected outcomes ensures other analysts can correctly supply required inputs and understand what the playbook will produce, which is critical for reusable, organization-wide content. Option E is correct because associating the playbook with the appropriate Incident Types enables it to trigger automatically when relevant cases are created, which is the standard mechanism for mapping playbooks to case categories in platforms like Cortex XSOAR. Option B is not required because playbooks are defined as declarative workflows (YAML/JSON), not compiled binaries, and Windows execution is handled by integrations or scripts rather than an attached binary. Option D is incorrect and actively discouraged because hardcoding plain-text passwords violates security best practices; credentials should be stored in a secrets manager or credential store and referenced securely.

Answer

An attached compiled binary file for Windows execution

Answer

Hardcoded passwords for external API integrations stored in plain text

Question 10

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. In Cortex XSOAR, dashboards are shared via the built-in sharing mechanism. Clicking the share icon on a dashboard opens a dialog where you can assign view or edit permissions to specific roles, users, or everyone. Selecting the 'Tier2-SOC' role restricts visibility to only members of that role. This is the standard, supported method for role-based dashboard sharing.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 11

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Accepted Answer

Reviewing task execution details and results by clicking on the task node in the incident's Playbook tab. Execution history and audit trails can be inspected via the War Room and the task's specific execution details modal in the incident investigation screen.

Answer

Analyzing the server's physical power supply status LEDs

Answer

Inspecting the client browser's DNS cache settings

Answer

Reviewing the local SMTP mail server queue

Question 12

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

Accepted Answer

Define script arguments in the script settings and access them via demisto.args() in Python.. XSOAR automation scripts receive runtime parameters through script arguments, which are declared in the script's settings (YAML/metadata) and retrieved inside Python via demisto.args(). This allows administrators to configure values like thresholds per-task or per-playbook without editing source code. It is the standard, supported pattern for parameterizing automation.

Answer

Hardcode the threshold value directly as a global variable in every script file.

Answer

Write the value to the server's /etc/passwd configuration file.

Answer

Store the threshold inside a browser cookie on the analyst's machine.

Question 13

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

Accepted Answer

Type the note in the War Room text box and use Markdown table syntax. The War Room note editor supports Markdown, which includes table syntax. By typing the note using Markdown table syntax, the analyst can create a formatted table that renders in the War Room, making the indicators easily readable. This is the most direct and standard method for adding formatted notes.

Answer

Use the 'Add Note' button and select the 'Table' option from the formatting toolbar

Answer

Attach a CSV file containing the indicators

Answer

Create a dashboard widget with the indicators and link it in the note

Question 14

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Accepted Answer

The Cortex XSOAR server. The Cortex XSOAR server is the central component that distributes incidents and tasks to engines. It manages incident state, playbook execution, and engine communication. Load balancers, message queues, and engine hierarchy do not play a role in task distribution.

Answer

The load balancer

Answer

The message queue service

Answer

The engine that was installed first

Question 15

An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?

Accepted Answer

Use the ${incident.id} and ${incident.severity} placeholders in the Slack message text.. The ${incident.id} and ${incident.severity} placeholders allow the playbook to dynamically insert the incident's ID and severity into the Slack message. This ensures each notification contains the relevant details for that specific incident, enabling effective communication without manual intervention.

Answer

Use a script task to retrieve incident details and store them in the context, then reference the context in the Slack message.

Answer

Configure the Slack integration to automatically append incident details to all messages.

Answer

Create a custom incident field that concatenates the ID and severity, then use that field in the Slack message.

Certified XSOAR Engineer XSOAR-Engineer practice test

Three ways to study

Study XSOAR-Engineer by domain

Study XSOAR-Engineer by topic

Incident Interactions And Reporting practice questions

Threat Intelligence Management practice questions

Use Case Planning And Development practice questions

Playbook Development practice questions

Planning Installation And Maintenance practice questions

XSOAR-Engineer fundamentals practice questions

XSOAR-Engineer scenario practice questions

XSOAR-Engineer troubleshooting practice questions

Certified XSOAR Engineer (XSOAR-Engineer) practice questions