Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 151–219

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

When planning advanced playbook logic and data manipulation in XSOAR, which THREE methods can be used to extract, filter, or transform data within playbook tasks? (Choose THREE)

An XSOAR automation engineer is planning incident classification and routing for incoming multi-source alerts. Which THREE elements must be considered when designing the mapping between incoming raw event fields and XSOAR incident fields? (Choose THREE)

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

An automation engineer is designing a complex incident investigation workflow where sub-playbooks are invoked dynamically based on asset criticality extracted during enrichment. Which XSOAR playbook feature allows calling another playbook conditionally based on incident context?

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

An organization is planning an XSOAR use case for vulnerability management triage. Vulnerability scans produce hundreds of thousands of findings daily. To prevent XSOAR from running out of memory or overwhelming the database, what is the best practice for ingestion planning?

When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

An XSOAR implementation team is planning threat intelligence management workflows. Which THREE capabilities does XSOAR provide natively for managing and acting upon threat indicators? (Choose THREE)

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

An engineer has configured a Loop Task in a playbook to iterate over a list of 50 IP addresses. To prevent the playbook from timing out or overwhelming the external API, the engineer needs to execute batches of 10 items concurrently. Where is this concurrency setting configured?

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

Which TWO locations or methods can an administrator use to check the currently installed Cortex XSOAR server version? (Choose two)

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

When planning a new automation use case, an XSOAR analyst needs to reference documentation and example code for built-in automation scripts and commands. Where within the XSOAR UI can this reference library be accessed directly?

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

An administrator wants to create a dashboard widget that counts only incidents where the SLA has been breached. Which query syntax should be used in the widget definition?

An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?

Which TWO pieces of information are displayed prominently in the incident header by default?

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Which THREE parameters can be adjusted in the Cortex XSOAR Server Configuration to manage incident ingestion flow and prevent system overload during a major security alert storm? (Choose three)

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

An administrator is setting up Cortex XSOAR High Availability and notices that jobs (such as scheduled automations and recurring fetches) are executing multiple times concurrently across nodes. What must be configured to prevent split-brain execution of scheduled tasks?

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

An engineer is writing a playbook expression to filter a list of endpoints from context. They want to return only the endpoints where the 'OS' field equals 'Windows'. Which built-in transformer syntax is correct?

An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

An administrator wants to ensure that specific incident fields are automatically populated and marked as read-only once an incident reaches the 'Containment' phase. Where should this behavior be configured?

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

An administrator is troubleshooting an issue where Cortex XSOAR is unable to pull Docker images from a private container registry during integration execution. Where are private registry authentication credentials configured in Cortex XSOAR?

Which visual indicator on a playbook task in the canvas signifies that the task is configured as a starting point (the entry point) of the playbook?

An administrator needs to restrict access to a specific sensitive integration instance so that only members of the Tier 2 SOC team can execute commands using it. How can this be accomplished?

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

An administrator needs to ensure that Cortex XSOAR audit logs and incident data are securely archived for compliance purposes. Which THREE mechanisms or practices are recommended for long-term data management in Cortex XSOAR? (Choose three)

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

Which THREE actions can be performed using the Loop task configuration in a Cortex XSOAR playbook? (Choose three)

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?