Planning Installation And Maintenance

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

What is the primary purpose of deploying a Cortex XSOAR Engine?

What is the purpose of the Cortex XSOAR Health Check integration?

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

An administrator is planning to scale a Cortex XSOAR deployment by adding multiple engines to distribute playbook task load. The organization uses a load balancer in front of the main server. Which configuration on the engines is required to ensure they connect through the load balancer rather than directly to a server node?

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?