Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 76–150

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

An XSOAR architect is planning automated reporting and stakeholder notification workflows. Which THREE methods are supported for distributing reports or alert summaries to stakeholders outside the SOC? (Choose THREE)

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)

An administrator notices that Cortex XSOAR server memory consumption spikes and eventually crashes due to out-of-memory errors during heavy incident ingestion. Which server configuration parameter should be adjusted to control the maximum heap size allocated to the Java Virtual Machine (JVM)?

An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?

An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

An XSOAR engineer is designing a SOC workflow that ingests thousands of alerts per hour from a cloud security posture management tool. Many alerts represent duplicate or recurring findings for the same asset within a short window. How should the engineer design the ingestion and processing flow to prevent incident fatigue?

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

Which TWO actions can an analyst perform within the Incident War Room?

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?

An administrator observes that Python-based integrations are failing with SSL certificate verification errors when connecting to an internal API that uses a private enterprise Certificate Authority (CA). Where must the private CA certificate be installed so that all Cortex XSOAR integration containers trust it?

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

An administrator wants to ensure that specific sensitive incidents are restricted so that only members of the 'IncidentResponse' team can view or edit them. How should this be implemented?

An XSOAR architect is designing a SOC workflow where critical alerts from a SIEM must bypass the standard queue and immediately trigger an urgent page to the on-call engineer. Which integration category and playbook design pattern should be utilized?

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

An XSOAR architect is designing high availability and disaster recovery (HA/DR) architecture for an enterprise deployment. Which THREE architectural elements are critical for ensuring seamless failover and data integrity? (Choose THREE)

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

A security architect is designing an incident classification taxonomy in XSOAR for a multi-tenant MSSP environment. Different clients require different playbook execution paths based on their subscription tier. Where should the architect configure this logic?

An engineer is utilizing the 'Set' task to manipulate context data. They want to clear an existing context key named 'MaliciousIP' entirely so subsequent tasks do not read stale data. How should this be configured in the Set task?

Where can an administrator view the currently active Docker image versions used by integrations in Cortex XSOAR?

An XSOAR architect is designing an automated incident response workflow that requires human approval before executing destructive remediation actions. Which THREE design patterns or features should be incorporated to handle human interaction securely and effectively? (Choose THREE)

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

An engineer is troubleshooting a playbook where a task fails intermittently because an upstream integration command takes too long to return data. Which THREE configuration options or features can the engineer use to handle this timeout issue effectively? (Choose three)

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

A custom threat intelligence feed integration is returning timeout errors during large data fetches. Which integration parameter should the administrator adjust to handle large payloads?

An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

An administrator needs to back up the Cortex XSOAR application data, including incident history, playbooks, and configuration settings. Which tool is officially recommended for taking a consistent backup of the internal configuration and database?

During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?