Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 1–75

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

An XSOAR administrator is planning security and access controls for a multi-team SOC deployment. Which THREE components are essential when configuring Role-Based Access Control (RBAC) and data permissions? (Choose THREE)

Which TWO actions should an administrator perform before executing a major version upgrade of Cortex XSOAR in a production environment? (Choose two)

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

An XSOAR architect is designing an automated incident lifecycle where incidents that remain unresolved after 72 hours must be automatically escalated to senior management and assigned a specific tag. Which XSOAR feature is designed to execute logic based on time-based triggers or SLAs?

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

An administrator wants to ensure that all modifications to playbooks and automations are tracked and synchronized with a remote Git repository for version control. Where is Git integration configured in Cortex XSOAR?

Which TWO built-in fields are automatically populated when a new incident is created in Cortex XSOAR?

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

An enterprise XSOAR administrator is planning the deployment of remote engines (DEX - Demisto Execution Engines) across multiple isolated regional network zones. What is the primary architectural purpose of deploying remote engines in this scenario?

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

Where should an administrator look to review historical logs regarding integration execution errors and API timeouts in Cortex XSOAR?

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

You need to ensure that a playbook task execution fails gracefully if the underlying integration command returns an error, allowing the playbook to continue down an alternative error-handling path. Which setting must you configure on the task?

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

An XSOAR Engineer is configuring a playbook task and needs to reference the output of a previous task named 'Get Incident Details'. Which syntax is correct to access the 'ID' key from that task's output context?

An engineer has completed building a new playbook and wants to test it on a live incident without affecting production data. What is the recommended method to test playbook modifications?

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

An administrator is troubleshooting a scenario where the Cortex XSOAR server is unresponsive due to a high volume of long-running python integration scripts exhausting available Docker workers. Which configuration parameter limits the maximum concurrent execution threads for Python scripts?

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?

What is the primary purpose of deploying a Cortex XSOAR Engine?

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

What is the purpose of the Cortex XSOAR Health Check integration?

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

When planning an automated incident response workflow for endpoint isolation, an engineer wants to ensure that analysts receive immediate real-time desktop notifications whenever a critical incident requires manual intervention. Which XSOAR feature should be integrated into the playbook?

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

An XSOAR architect is designing incident data ingestion flows. Which TWO mechanisms can be used to filter or modify incoming raw events before they are officially created as XSOAR incidents? (Choose TWO)

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

An XSOAR architect is designing custom incident layouts for a new ransomware response use case. The SOC team needs to see critical file hashes, affected machine names, and containment status immediately upon opening an incident. Where should the architect configure these visual elements?

An administrator notices that Cortex XSOAR is consuming excessive disk space in the var/lib/demisto directory due to large debug log files and retained incident payloads. Which tool or command should be used safely to clean up old working files without corrupting the PostgreSQL database?

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

When planning the deployment of XSOAR integrations, which TWO configuration steps are typically required to connect an integration instance to an external product (e.g., a firewall or SIEM)? (Choose TWO)

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

An administrator needs to perform a zero-downtime upgrade of a Cortex XSOAR multinode high-availability deployment. In what order should the components be updated?

An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?

An administrator is troubleshooting a scheduled report that fails to email its PDF output to stakeholders. Where should the administrator check first to diagnose the delivery failure?

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?