troubleshooting

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

A Cortex XSOAR engineer needs to ensure that a specific internal IP range used by the company's vulnerability scanners is never treated as malicious by any feed, even if a public feed later reports one of those IPs as bad. Which TIM mechanism should the engineer configure to guarantee this exclusion?

An XSOAR administrator is planning security and access controls for a multi-team SOC deployment. Which THREE components are essential when configuring Role-Based Access Control (RBAC) and data permissions? (Choose THREE)

An XSOAR engineer is designing a playbook that interacts with an external sandbox API to analyze suspicious file attachments. The sandbox analysis can take anywhere from 2 to 15 minutes to complete. How should the playbook be designed to handle this asynchronous delay without locking up an execution thread?

An XSOAR engineer is planning a new playbook for automated incident response. The playbook needs to run different branches based on the severity of the incident: if severity is 'High', it should trigger a full response; if 'Medium', a partial response; and if 'Low', just a notification. Which playbook task type should be used to implement this branching logic?

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

A SOC is designing a new use case for XSOAR that must automatically enrich every newly created incident with data from an internal CMDB. The CMDB integration can only be queried by hostname, and the hostname is stored in a custom incident field named 'affectedhost'. The enrichment must run exactly once per incident and must not block the rest of the playbook if the CMDB is unreachable. Which XSOAR design element should the engineer use to meet these requirements?

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

An XSOAR architect is designing an automated incident lifecycle where incidents that remain unresolved after 72 hours must be automatically escalated to senior management and assigned a specific tag. Which XSOAR feature is designed to execute logic based on time-based triggers or SLAs?

An engineer wants to test a playbook that is still in development. The playbook should only be triggered for incidents with the type 'Phishing' and severity 'High'. Which configuration ensures the playbook runs only under these conditions?

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

An XSOAR administrator is designing a multi-tenant use case where different departments share the same XSOAR instance but require strict isolation of incident data and playbooks. Which combination of XSOAR features should be planned to achieve proper data segregation?

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must extract indicators from email attachments and then conditionally block malicious hashes on a firewall. The engineer wants to ensure that the playbook does not fail when an attachment is missing or when the firewall integration is unreachable. Which design approach best meets these requirements?

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

An XSOAR engineer is planning a playbook to handle phishing incidents. The playbook must send an email notification to the SOC manager only when the incident severity is 'High' and the phishing email contains at least one malicious attachment. Which approach should the engineer use to implement this conditional notification?

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

An enterprise XSOAR administrator is planning the deployment of remote engines (DEX - Demisto Execution Engines) across multiple isolated regional network zones. What is the primary architectural purpose of deploying remote engines in this scenario?

A security team is planning an XSOAR playbook that must dynamically route incidents to different sub-playbooks based on the severity of the incident, which is stored in a custom incident field named 'incidentseverity'. The playbook should evaluate this field and then call the appropriate sub-playbook. Which XSOAR feature should the engineer use to implement this conditional branching?

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

An organization is scoping their first XSOAR implementation. They have identified fifty potential security use cases. According to best practices for use case prioritization, which factor should be weighted highest when selecting the initial pilot use cases?

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

An engineer wants a playbook to dynamically decide the next task based on a severity value that is computed at runtime by a script. The playbook must branch to different tasks depending on whether the computed severity is 'High', 'Medium', or 'Low'. Which task type should be used to achieve this dynamic branching?

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

A security team wants to ensure that indicators ingested from a newly integrated MISP feed are automatically tagged with a specific label for easier filtering and correlation. Which configuration on the MISP feed instance in Cortex XSOAR allows the engineer to apply a custom tag to all indicators from this feed?

During an active incident, an analyst wants to tag the incident with a custom label 'VIP-Customer' so that other team members can quickly filter and find it later. Where should the analyst add this label in Cortex XSOAR?

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

A Cortex XSOAR engineer is designing a playbook that must enrich an IP indicator with data from a premium TIM feed only when the indicator's current score is Suspicious or Bad. The playbook uses a task that queries the indicator via the TIM API. Which approach ensures the enrichment task runs only for indicators meeting the score condition?

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

An analyst is investigating a live incident and needs to share a set of indicators with an external partner without exposing internal notes or the full incident timeline. The analyst must produce a file that the partner can import into their own Cortex XSOAR instance. What should the analyst do?

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

An XSOAR engineer is designing a playbook that must handle incidents from a SIEM integration. The playbook needs to run a specific enrichment task only when the incident severity is High and the source IP is external. Which XSOAR feature should be used to implement this conditional logic within the playbook?

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

A SOC team wants XSOAR to automatically create a case in their case management system whenever a high-severity incident is opened, and to close that case when the XSOAR incident is closed. The engineer is planning the use case and needs to identify the two lifecycle events that must be mapped. Which pair of XSOAR incident lifecycle events should the engineer plan for?

An engineer is designing a playbook that must iterate over a list of IP addresses stored in the incident context under the key 'IPs'. For each IP, the playbook should run a reputation check and then add a note to the incident. Which playbook task type should be used to loop over the list and execute the sub-tasks for each item?

When planning a new XSOAR automation use case for compromised credentials, an engineer must decide whether to automate the entire remediation lifecycle or keep a human-in-the-loop. Which scenario represents the best candidate for fully automated remediation?

What is the primary purpose of deploying a Cortex XSOAR Engine?

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

What is the purpose of the Cortex XSOAR Health Check integration?

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

An administrator wants to ensure that when an incident is closed in Cortex XSOAR, a summary report is automatically generated and attached to the incident as a text file. Which feature should the administrator configure to achieve this?

When planning an automated incident response workflow for endpoint isolation, an engineer wants to ensure that analysts receive immediate real-time desktop notifications whenever a critical incident requires manual intervention. Which XSOAR feature should be integrated into the playbook?

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

You are creating a playbook that includes a task to query a threat intelligence integration. The integration command returns a list of indicators, but you only want to proceed if the list is not empty. Which playbook task configuration should you use to evaluate the result and branch accordingly?

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

An XSOAR engineer is designing a playbook that needs to extract the source IP address from an incident's details and then enrich it using a threat intelligence integration. The IP address is stored in the incident field 'sourceip'. Which XSOAR feature allows the playbook to pass this field value as an input to the integration command?

An XSOAR implementation team is designing a workflow that handles sensitive Personally Identifiable Information (PII). Compliance requirements dictate that PII must not be stored long-term in XSOAR context data or incident fields. What is the recommended strategy during use case design?

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

An XSOAR architect is designing incident data ingestion flows. Which TWO mechanisms can be used to filter or modify incoming raw events before they are officially created as XSOAR incidents? (Choose TWO)

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

An XSOAR architect is designing custom incident layouts for a new ransomware response use case. The SOC team needs to see critical file hashes, affected machine names, and containment status immediately upon opening an incident. Where should the architect configure these visual elements?

A security team is planning a new use case in XSOAR to automate the response to malware detections from an endpoint protection platform. The playbook must isolate the infected endpoint, collect forensic data, and notify the incident response team. Which initial step should the engineer take to ensure the playbook can execute these actions?

An XSOAR engineer is building a playbook for a new use case: automatically enriching IP addresses from a SIEM alert using a threat intelligence integration. The engineer wants to ensure that the playbook can be easily reused for different incident types. Which approach should the engineer take?

A Cortex XSOAR administrator wants to provide analysts with a quick way to view all open incidents that are assigned to them and have a severity of 'High' or 'Critical'. Which built-in feature should the administrator configure?

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

When planning the deployment of XSOAR integrations, which TWO configuration steps are typically required to connect an integration instance to an external product (e.g., a firewall or SIEM)? (Choose TWO)

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

An automation engineer is designing an integration script using Python in XSOAR. Which TWO built-in Demisto Python API methods are commonly used within integration or automation scripts for interacting with the platform? (Choose TWO)

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

An XSOAR architect is designing a disaster recovery and high availability (HA/DR) strategy for a mission-critical SOC automation deployment. Which component must be properly planned and synchronized to ensure seamless failover?

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

When designing SOC workflows and playbooks in XSOAR, which THREE best practices should an architect follow to ensure maintainability and readability? (Choose THREE)

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

An XSOAR architect is planning automated reporting and stakeholder notification workflows. Which THREE methods are supported for distributing reports or alert summaries to stakeholders outside the SOC? (Choose THREE)

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

An XSOAR engineer is designing a playbook to handle phishing incidents. The playbook must automatically extract all indicators from the incident, enrich them using multiple threat intelligence integrations, and then calculate a severity score based on the enrichment results. The engineer wants to ensure that the playbook can be reused across different phishing incident types without modification. Which approach best meets these requirements?

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

An XSOAR Engineer is designing a playbook that must handle multiple branches based on indicator reputation. The engineer wants to ensure that certain tasks only execute when the indicator's reputation is 'Bad' or 'Suspicious'. Which TWO methods can be used to implement this conditional logic in the playbook? (Choose two.)

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

An XSOAR engineer is planning a use case where a playbook must pause and wait for an analyst to approve a destructive containment action before continuing. The approval may take hours, and the playbook must resume automatically once the analyst responds. Which XSOAR task type should the engineer use to implement this wait-and-resume behavior?

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

An engineer is designing a playbook that includes a sub-playbook to perform IP enrichment. The sub-playbook returns a list of enriched IPs in its context under the key 'EnrichedIPs'. The engineer wants to access this list in the parent playbook to use in a subsequent task. Which syntax should be used to reference the list in the parent playbook task?

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

An engineer is building a playbook that calls a sub-playbook to enrich indicators. The sub-playbook returns a list of enriched indicators in the context key 'EnrichedIndicators'. The engineer needs to pass this list to a subsequent task that expects a comma-separated string of indicator values. Which transformer should be used to convert the list to a comma-separated string?

When planning a new XSOAR automation use case, which TWO factors are most important to evaluate to determine if a manual SOC process is a good candidate for automation? (Choose TWO)

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

You are building a playbook that must run a series of tasks in parallel to save time. After all parallel branches complete, you need to consolidate their outputs and continue with a single task. Which task type should you use to wait for all parallel branches to finish before proceeding?

An XSOAR developer is planning a workflow that requires data enrichment from three different threat intelligence platforms (TIPs) simultaneously. To optimize playbook execution time, how should the tasks be structured?

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

An XSOAR engineer is designing a SOC workflow that ingests thousands of alerts per hour from a cloud security posture management tool. Many alerts represent duplicate or recurring findings for the same asset within a short window. How should the engineer design the ingestion and processing flow to prevent incident fatigue?

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

A security engineer is integrating a new TAXII 2.1 feed into Cortex XSOAR. The feed requires authentication using a client certificate and a private key. After configuring the integration instance with the correct certificate and key, the engineer notices that no indicators are being fetched, and the integration logs show 'SSL certificate verification failed'. The TAXII server uses a self-signed certificate. What should the engineer do to resolve this issue while maintaining security best practices?

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

Which TWO actions can an analyst perform within the Incident War Room?

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

A Cortex XSOAR administrator is building a custom dashboard widget that must show the number of open incidents grouped by severity for the current week, updating automatically as incidents change. Which widget configuration should the administrator use?

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

An XSOAR architect is designing an automation workflow for incoming phishing alerts. Before building the playbook, the team needs to determine the average time to triage and resolve phishing emails manually. Which metric is most critical to establish as a baseline for this use case?

An analyst is reviewing a closed phishing incident and wants to see, in the War Room, which playbook tasks executed and in what order, including the inputs and outputs of each task. Which War Room tab should the analyst use to review this structured, step-by-step record of the playbook run?

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

An engineer needs Cortex XSOAR to enrich every newly ingested indicator from an external feed by querying an internal WHOIS service before the indicator is stored, and to block ingestion if enrichment fails. The WHOIS service is exposed through a custom integration. Which approach best meets this requirement?

A playbook task is configured to run a command that returns a large JSON object. The engineer wants to store only a specific nested field from the command result into the incident context for later use. Which task configuration should be used?

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

An XSOAR engineer is designing a playbook that must decide whether to auto-remediate or escalate based on a risk score returned by an external scoring API. The API occasionally returns HTTP 500 errors, and the playbook must not silently proceed with a default branch when that happens. Which playbook design approach best satisfies this requirement?

An XSOAR architect is designing a SOC workflow where critical alerts from a SIEM must bypass the standard queue and immediately trigger an urgent page to the on-call engineer. Which integration category and playbook design pattern should be utilized?

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

An XSOAR engineer is planning a custom integration fetch-incidents mechanism using REST API polling. The target API uses cursor-based pagination with timestamp markers. How must the integration code store the pagination state between polling intervals to ensure no incidents are missed?

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

An engineer is building a playbook that must route incidents to different analysts based on severity. The severity is stored in the incident field 'severity' and can be 'Low', 'Medium', 'High', or 'Critical'. The engineer wants to assign the incident to the 'Tier1' team for Low and Medium, and to the 'Tier2' team for High and Critical. What is the most efficient way to implement this routing in the playbook?

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

An engineer is developing a playbook that includes a task to run an integration command. The command returns a JSON object with a field 'result' that contains a list of indicators. The engineer wants to iterate over each indicator in the list and perform a sub-playbook for each one. Which playbook feature should the engineer use to accomplish this?

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

An XSOAR architect is designing an automated incident response workflow that requires human approval before executing destructive remediation actions. Which THREE design patterns or features should be incorporated to handle human interaction securely and effectively? (Choose THREE)

An XSOAR architect is planning a playbook for automated malware analysis. The playbook must submit files to a sandbox, retrieve the analysis report, and extract indicators. The sandbox integration may take variable time to return results, and the playbook must avoid blocking other tasks. Which TWO design elements are most appropriate to achieve this? (Choose two.)

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

An XSOAR engineer is designing a playbook to automate phishing email triage using the Phishing incident type. The team wants each incoming phishing report to automatically trigger a sub-playbook that extracts indicators and checks reputation across configured threat intel integrations. Which XSOAR component should be configured to launch this sub-playbook automatically for every new phishing incident?

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

An organization is implementing an XSOAR use case for insider threat detection. The workflow requires correlating alerts from HR systems, file integrity monitoring, and proxy logs. During playbook design, how should context data from these disparate sources be merged for analysis?

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

During SOC workflow design for malware containment, an engineer wants to ensure that analysts are prompted for approval before an isolation command is issued to endpoints. Which XSOAR playbook component accomplishes this?

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

When planning advanced playbook logic and data manipulation in XSOAR, which THREE methods can be used to extract, filter, or transform data within playbook tasks? (Choose THREE)

An XSOAR automation engineer is planning incident classification and routing for incoming multi-source alerts. Which THREE elements must be considered when designing the mapping between incoming raw event fields and XSOAR incident fields? (Choose THREE)

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

An automation engineer is designing a complex incident investigation workflow where sub-playbooks are invoked dynamically based on asset criticality extracted during enrichment. Which XSOAR playbook feature allows calling another playbook conditionally based on incident context?

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

An organization is planning an XSOAR use case for vulnerability management triage. Vulnerability scans produce hundreds of thousands of findings daily. To prevent XSOAR from running out of memory or overwhelming the database, what is the best practice for ingestion planning?

When planning an XSOAR incident response use case, which TWO core data constructs are fundamental for organizing and displaying incident information to analysts? (Choose TWO)

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

An administrator is planning to scale a Cortex XSOAR deployment by adding multiple engines to distribute playbook task load. The organization uses a load balancer in front of the main server. Which configuration on the engines is required to ensure they connect through the load balancer rather than directly to a server node?

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

An XSOAR engineer is planning a playbook to handle malware incidents. The playbook must extract indicators from the incident, enrich them, and then decide whether to block them. The engineer wants to ensure that the playbook is modular and reusable across different incident types. Which TWO design approaches should the engineer use? (Choose two.)

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

An engineer is debugging a playbook that occasionally fails when a task calls an automation script. The script expects a JSON string as input, but the engineer is passing a context object directly. The playbook sometimes works and sometimes fails, depending on the data. Which action should the engineer take to ensure the automation receives the correct input type?

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

An XSOAR developer is planning a playbook task that runs a custom Python script. The script needs to accept a dynamic threshold value configured by the administrator without hardcoding it into the script source code. How should the developer design this?

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

An XSOAR engineer is designing a playbook that must send a notification to a Slack channel when a critical incident is detected. The Slack integration instance is already configured. The engineer wants to ensure that the notification includes the incident ID and severity. Which XSOAR feature allows the playbook to dynamically include incident details in the Slack message?

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

An XSOAR implementation team is planning threat intelligence management workflows. Which THREE capabilities does XSOAR provide natively for managing and acting upon threat indicators? (Choose THREE)

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

An engineer is building a playbook that must run a set of enrichment tasks only when the incident severity is at least 'High'. The severity field is already populated in the incident context. The engineer wants to avoid duplicating tasks for each possible severity value. Which approach is most appropriate?

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

What is the primary function of the Cortex XSOAR Content Pack mechanism?

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

An organization is planning an automated threat intelligence enrichment use case. When indicators are extracted from an incident, the architect wants to ensure that internal private IP addresses and loopback addresses are excluded from external threat intel queries. Where should this filtering logic be planned?

An XSOAR engineer is scoping a new use case that ingests alerts from a SIEM into XSOAR for automated triage. The SOC lead wants to know which native mechanism should be used to define how many alerts per minute XSOAR accepts and how the ingestion source is authenticated, without writing custom polling logic. Which XSOAR component should the engineer configure to meet this requirement?

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

An XSOAR engineer is planning a use case that must deduplicate alerts arriving from a cloud workload protection platform before they become incidents, so that repeated alerts about the same resource within a short window are merged. Which TWO design elements should the engineer include in the plan? (Choose two.)

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

An organization wants to implement an XSOAR use case where indicators extracted from threat reports are automatically shared with perimeter firewalls. During the workflow design phase, the architect must ensure that only indicators with a high confidence score are blocked. Where should this filtering logic be applied in the playbook?

Which TWO pieces of information are displayed prominently in the incident header by default?

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

An XSOAR developer is planning a playbook that processes file attachments. Some attachments may be password-protected archives (e.g., .zip files with passwords). How should the playbook handle extracting files when a password is required?

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

A Cortex XSOAR engineer needs a recurring report that delivers a PDF summarizing incident metrics to an external distribution list every Monday at 08:00. The engineer creates a scheduled report and must now ensure the recipient addresses, format, and recurrence are all honored. Which configuration element in the scheduled report definition controls the recurring schedule?

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

An XSOAR engineer is planning a playbook for a new use case that must process incidents arriving from a third-party SIEM. The SIEM sends incidents with a severity value as a string ('low', 'medium', 'high') and the SOC wants the playbook to route incidents to different sub-playbooks based on that value, but also wants to be able to change the mapping later without editing the playbook. Which design approach best meets these requirements?

An XSOAR automation developer is building a custom script that processes a large list of IP addresses. To ensure the script adheres to best practices and does not block the XSOAR server event loop, how should the script be implemented?

An organization is planning to measure the success of their XSOAR implementation. Which dashboard and reporting feature should the team configure to track metrics such as total incidents processed, automation rate, and average resolution time over the last quarter?

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

An engineer is creating a playbook that needs to send an email notification to the security team when a high-severity incident is detected. The engineer wants to include the incident ID and severity in the email body. Which task type should be used to compose and send the email?

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

An XSOAR engineer is planning a new playbook for malware analysis. The playbook should run a series of tasks, and the engineer wants to ensure that if any task fails, the playbook continues to the next task without stopping. Which playbook setting should be configured to achieve this behavior?

An XSOAR engineer is designing a playbook that integrates with a ticketing system to create tickets for high-severity incidents. The playbook must avoid creating duplicate tickets if the incident is updated multiple times. Which method should the engineer use to track whether a ticket has already been created?

A large enterprise is using XSOAR to manage security incidents. The SOC manager wants to ensure that when a critical incident is created, an email notification is sent to the on-call team, and a Slack message is posted to the security channel. The notifications should include a link to the incident in XSOAR. The engineer needs to choose the most efficient way to implement this in a playbook. Which approach should the engineer take?

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

When designing an automated SOC use case for ticket synchronization with ServiceNow, an engineer needs to map XSOAR incident fields to ServiceNow incident fields. Where are field mappings between XSOAR and integrations typically configured?

A Cortex XSOAR engineer configures a TAXII 2.1 feed integration and confirms the server connection succeeds, but the Threat Intel page shows no indicators. The collection browser returns STIX 2.1 objects with type 'indicator' and 'observed-data'. The engineer then runs the fetch command manually and sees objects returned in the raw response. Which configuration element most likely prevents the indicators from being created in the Threat Intel database?