Courseiva

CCNA Planning Installation And Maintenance Questions

48 questions · Planning Installation And Maintenance topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A security team wants to integrate Cortex XSOAR with their existing SAML 2.0 identity provider for single sign-on. The administrator needs to configure the server accordingly. Which step is required to enable SAML SSO?

A.Modify the server's hosts file to map the identity provider's domain to the Cortex XSOAR server IP.
B.Generate a self-signed certificate on the Cortex XSOAR server and provide it to the identity provider for encryption.
C.Upload the identity provider's metadata XML to the Cortex XSOAR server in the SAML configuration section.
D.Install the SAML integration from the Marketplace and configure it with the identity provider details.
AnswerC

Cortex XSOAR supports SAML SSO by allowing administrators to upload the identity provider's metadata XML. This metadata contains the necessary endpoints and certificates for establishing trust. Uploading it in the SAML configuration section is the correct step to enable SSO.

Why this answer

To enable SAML SSO in Cortex XSOAR, the administrator must upload the identity provider's metadata XML in the SAML configuration section. This metadata includes the necessary information for the server to trust and communicate with the identity provider, such as the SSO URL and signing certificate. This step is essential for establishing the SAML trust relationship.

Exam trap

The trap here is thinking that SAML SSO requires installing a separate integration or modifying DNS, when it is actually a built-in server configuration that relies on metadata exchange.

Practice this question →
2
Multi-Selecteasy

Which TWO methods are supported for authenticating API clients (such as SIEMs or custom scripts) connecting to the Cortex XSOAR REST API? (Choose two)

Select 2 answers
A.OAuth 2.0 client credentials grant type natively configured without user context
B.API Keys generated within user profile settings
C.Kerberos ticket-granting service tickets
D.Username and password credentials exchanged for a session cookie/token
E.Public key SSH key pairs
AnswersB, D

Cortex XSOAR supports API keys generated within each user's profile settings, which clients such as SIEMs and custom scripts present directly on REST API calls. This satisfies the stem's requirement for a supported authentication method without exchanging interactive credentials for a session.

Why this answer

Option B is correct because Cortex XSOAR allows users to generate API Keys from their user profile settings, and these keys are then used by external API clients (SIEMs, scripts) to authenticate to the REST API without interactive login. Option D is correct because the XSOAR REST API also supports authenticating with a username and password, which the client exchanges for a session token/cookie used on subsequent API calls. Option A is not supported: XSOAR does not natively implement the OAuth 2.0 client credentials grant for API client authentication without user context.

Option C is incorrect because Kerberos TGT-based authentication is not a supported mechanism for the XSOAR REST API. Option E is incorrect because SSH public/private key pairs are used for secure shell access, not for authenticating to the XSOAR REST API.

Exam trap

XSOAR-Engineer often tests the confusion between platform authentication (SSO/SAML for UI) and API authentication — candidates mistakenly assume OAuth 2.0 is supported natively for API clients when it is not.

Practice this question →
3
MCQmedium

An administrator needs to monitor Cortex XSOAR server performance and health metrics using an external SIEM. Which protocol and integration mechanism does Cortex XSOAR natively support for exporting audit and system logs?

A.Native Syslog forwarding (TCP/UDP) configured in Server Configuration
B.SNMP v3 Traps
C.NetFlow v9 streaming
D.WMI event subscription
AnswerA

Cortex XSOAR natively forwards audit and system logs to external collectors via Syslog over TCP or UDP, configured under Server Configuration. This built-in mechanism lets an external SIEM ingest health and performance telemetry without custom integrations.

Why this answer

Cortex XSOAR supports forwarding audit logs via Syslog (TCP/UDP) natively through server configuration settings.

Practice this question →
4
Multi-Selecthard

An administrator is troubleshooting an integration that fails to execute inside a Docker container on a Cortex XSOAR engine. Which THREE diagnostic steps or tools can be used to isolate the container execution failure? (Choose three)

Select 3 answers
A.Review the integration instance debug logs in Settings > Integrations > Instances for detailed Python stderr output.
B.Use engine troubleshooting tools or test container execution locally using the Docker CLI on the engine host.
C.Reinstall the core Linux operating system kernel on the server.
D.Verify Docker daemon status and connectivity on the host running the engine.
E.Modify the PostgreSQL database schema to enable container debugging tables.
AnswersA, B, D

Reviewing instance debug logs captures Python stderr from the integration's execution inside the Docker container, exposing import errors, missing dependencies or tracebacks that the engine's own logs omit. This directly satisfies the stem's need to isolate container execution failure, since stderr is streamed from the container process to the instance log.

Why this answer

Option A is correct because Cortex XSOAR surfaces integration execution errors, including Python tracebacks and stderr, in the instance debug logs under Settings > Integrations > Instances, which is the first place to identify why a script fails inside the container. Option B is correct because running the container manually with the Docker CLI on the engine host (or using engine troubleshooting utilities) lets you reproduce the execution outside XSOAR and isolate whether the failure is in the image, dependencies, or engine runtime. Option D is correct because if the Docker daemon is stopped, unreachable, or misconfigured on the engine host, containers cannot be launched at all, so verifying daemon status and connectivity is a fundamental isolation step.

Option C is not appropriate because reinstalling the Linux kernel is a drastic host-level action unrelated to containerized integration failures and would not isolate the issue. Option E is not appropriate because PostgreSQL schema changes are unsupported and irrelevant to container execution debugging; XSOAR does not use database tables to enable container debugging.

Practice this question →
5
MCQeasy

An administrator needs to ensure that Cortex XSOAR can send email notifications for incidents. The environment uses an internal SMTP server that requires authentication. Which configuration should the administrator perform?

A.Install and configure the Mail Sender integration instance with the SMTP server details.
B.Configure the SMTP settings in the Server Configuration, including the SMTP server address, port, username, and password.
C.Create a playbook that triggers on incident creation and uses the 'send-mail' command with hardcoded SMTP details.
D.Modify the docker environment variables to include SMTP credentials for the notification service.
AnswerB

Cortex XSOAR's Server Configuration includes SMTP settings where you specify the server address, port, and credentials. This is the standard method to enable email notifications for incidents. Without these settings, the server cannot authenticate to the internal SMTP server and send notifications.

Why this answer

To enable email notifications for incidents in Cortex XSOAR, the administrator must configure the SMTP settings in the Server Configuration. This includes the SMTP server address, port, and authentication credentials. This configuration allows the server to send notifications automatically, ensuring that incidents are communicated to the appropriate teams.

Exam trap

The trap here is confusing the Mail Sender integration, which is used within playbooks, with the server's global SMTP configuration for incident notifications.

Practice this question →
6
Multi-Selectmedium

Which TWO configuration steps are required when setting up a Cortex XSOAR Engine to communicate with the primary server through a load balancer? (Choose two)

Select 2 answers
A.Generate and configure the engine communication key on the Cortex XSOAR server and apply it to the engine.
B.Configure the engine to run with root privileges to bypass load balancer port restrictions.
C.Configure the engine's configuration file (conf.json) with the primary server or load balancer URL and authentication key.
D.Install a dedicated PostgreSQL database instance locally on the engine host.
E.Open inbound port 22 on the load balancer for engine heartbeat monitoring.
AnswersA, C

The engine authenticates to the primary server using a communication key generated on the Cortex XSOAR server and applied during engine configuration. Without this shared key, the engine cannot establish trust through the load balancer, so it is a required step.

Why this answer

Option A is correct because the engine must authenticate to the Cortex XSOAR server using a communication key generated on the server, which is then applied to the engine during setup so it can register and establish the trust relationship through the load balancer. Option C is correct because the engine's conf.json must be edited to point to the primary server or load balancer URL and to include the authentication key, which is how the engine knows where to connect and how to authenticate. Options B, D, and E are not required: the engine does not need root privileges to bypass load balancer port restrictions, it does not require a local PostgreSQL instance (the database resides on the Cortex XSOAR server), and inbound port 22 on the load balancer is not used for engine heartbeat monitoring.

Practice this question →
7
MCQeasy

An administrator needs to review the audit trail of user actions and playbook executions in Cortex XSOAR for a compliance audit. Where can the administrator find this information within the platform?

A.In the /var/log/demisto/server.log file on the Cortex XSOAR server, which contains the full audit trail.
B.In the Settings > Audit Log page, which records user actions, playbook runs, and configuration changes with timestamps.
C.In the Cortex XSOAR Marketplace under the Content Packs tab, which logs all administrative actions.
D.In the incident War Room of each incident, where all user and playbook actions are permanently archived.
AnswerB

Cortex XSOAR provides an Audit Log under Settings that captures user activity, playbook executions, and configuration changes with timestamps and user attribution. This is the built-in compliance and troubleshooting resource. It is distinct from incident war rooms and system logs, and it is the correct place to review an audit trail for compliance purposes without accessing the underlying operating system.

Why this answer

Cortex XSOAR includes a dedicated Audit Log under Settings that records user actions, playbook executions, and configuration changes with timestamps and user attribution. This built-in feature is designed for compliance and troubleshooting, unlike server.log which holds runtime messages, the incident-scoped War Room, or the Marketplace which manages content packs.

Exam trap

The trap here is confusing technical runtime logs or incident timelines with the structured, platform-wide audit trail that Cortex XSOAR provides for compliance.

Practice this question →
8
MCQeasy

What is the primary purpose of deploying a Cortex XSOAR Engine?

A.To act as a primary database replica for high availability
B.To handle user authentication and single sign-on (SSO) requests
C.To execute integrations and playbooks in isolated network segments and reduce server load
D.To store long-term incident archives for compliance reporting
AnswerC

An Engine runs integrations and playbook tasks inside remote network segments, so it reaches isolated or restricted assets without exposing the main server. It also distributes execution load away from the central server, satisfying both the segmentation and load-reduction constraints in the scenario.

Why this answer

Cortex XSOAR Engines are lightweight execution components that run integrations, scripts, and playbook tasks. They are typically deployed in remote or isolated network segments (e.g., DMZ, OT networks) so that the engine can reach internal resources without exposing the main XSOAR server. Offloading execution to engines also reduces load on the main application server.

Exam trap

XSOAR-Engineer often tests the misconception that engines are used for high availability or authentication, when their primary role is distributed execution and network isolation.

How to eliminate wrong answers

Option A is wrong because database replication is handled by the underlying PostgreSQL/Elasticsearch infrastructure, not by XSOAR Engines. Option B is wrong because authentication and SSO are handled by the XSOAR server itself, not by engines. Option D is wrong because long-term incident archives are stored in the XSOAR database or external storage, not on engines.

Practice this question →
9
MCQeasy

What is the purpose of the Cortex XSOAR Health Check integration?

A.To monitor system resources, database connectivity, and platform operational metrics
B.To test outbound internet connectivity for Docker Hub
C.To scan endpoints for malware and vulnerabilities
D.To validate syntax in custom Python automation scripts
AnswerA

The Health Check integration probes platform operational metrics, including CPU and memory usage, database connectivity and disk space, surfacing degradation before it affects incident response. This satisfies the requirement to monitor system resources and database connectivity across the Cortex XSOAR deployment.

Why this answer

The Health Check integration monitors the operational status of the XSOAR server, database connectivity, license expiration, and integration health.

Practice this question →
10
MCQmedium

You are configuring a Cortex XSOAR engine behind a strict corporate firewall. Which outbound port must be opened on the firewall for the engine to communicate securely with the Cortex XSOAR server via HTTPS?

A.TCP 443
B.TCP 8443
C.TCP 22
D.TCP 6222
AnswerA

TCP 443 carries the HTTPS traffic the engine requires to reach the Cortex XSOAR server, satisfying the strict-firewall constraint in the stem. Because the engine initiates all communication outbound over TLS on this single port, no additional inbound rules are needed, and firewall policy can remain restrictive.

Why this answer

Cortex XSOAR engines communicate with the main server via HTTPS over TCP port 443 by default.

Practice this question →
11
MCQmedium

An administrator is troubleshooting a Cortex XSOAR engine that is not processing playbook tasks. The engine appears in the server's engine list as 'Disconnected'. The administrator has verified that the engine service is running and the network allows outbound HTTPS to the server. Which action should the administrator take next to diagnose the issue?

A.Verify that the engine has inbound access from the server on port 443.
B.Restart the Cortex XSOAR server to re-establish the connection.
C.Check the engine's log files for errors related to authentication or certificate validation.
D.Increase the engine's allocated memory and CPU resources.
AnswerC

When an engine shows as disconnected despite network connectivity, common causes include authentication failures, expired certificates, or misconfigured engine keys. Reviewing the engine logs (e.g., /var/log/demisto/engine.log) can reveal specific errors such as 'invalid token' or 'certificate verify failed'. This is the logical next step to pinpoint the root cause.

Why this answer

The engine's log files are the best source of information for diagnosing connection issues. Errors related to authentication, certificates, or configuration will be recorded there. Since network connectivity is already verified, the next step is to examine logs for specific failure reasons.

Other actions like restarting the server or checking inbound access are not appropriate for this scenario.

Exam trap

The trap here is assuming that a disconnected engine indicates a network problem, when it could be an authentication or certificate issue that requires log analysis.

Practice this question →
12
Multi-Selectmedium

An administrator is preparing a maintenance window for a Cortex XSOAR production server. The goal is to minimize downtime and avoid data loss during the upgrade to a newer version. Which TWO actions should be performed before starting the upgrade? (Choose two.)

Select 2 answers
A.Delete all old incidents to reduce database size and speed up the upgrade process.
B.Disable all integration instances to stop inbound alert ingestion during the maintenance window.
C.Back up the Cortex XSOAR database and configuration using the built-in backup mechanism or a supported snapshot.
D.Review the release notes and verify that the target version is a supported upgrade path from the current version.
E.Uninstall all content packs to prevent version conflicts during the upgrade.
AnswersC, D

A full backup of the database and configuration is essential before any version upgrade. The built-in backup or a supported snapshot captures incidents, playbooks, integrations, and settings, allowing rollback if the upgrade fails. Without a verified backup, a failed upgrade could result in irreversible data loss, making this a mandatory pre-upgrade step for production maintenance.

Why this answer

Before upgrading a production Cortex XSOAR server, a verified backup of the database and configuration protects against data loss and enables rollback. Reviewing release notes and confirming a supported upgrade path prevents issues caused by skipping required intermediate versions. Deleting incidents, uninstalling content packs, or disabling all integrations are not prerequisites and can cause harm or operational gaps.

Exam trap

The trap here is assuming that reducing database size or removing content packs will make the upgrade safer, when the actual prerequisites are a verified backup and a supported upgrade path.

Practice this question →
13
Multi-Selecthard

An engineer is configuring a new Cortex XSOAR engine in a DMZ to fetch incidents from a third-party SIEM. The engine must be able to communicate with both the Cortex XSOAR server in the internal network and the SIEM in the DMZ. Which two network configurations are required to allow this communication? (Choose two.)

Select 2 answers
A.The engine must have outbound access to the Cortex XSOAR server on port 443.
B.The engine must have inbound access from the Cortex XSOAR server on port 22.
C.The engine must have inbound access from the SIEM on the required port.
D.The engine must have inbound access from the Cortex XSOAR server on port 443.
E.The engine must have outbound access to the SIEM on the required port.
AnswersA, E

The engine initiates a connection to the Cortex XSOAR server to receive tasks and send results. This communication typically occurs over port 443 (HTTPS). Therefore, outbound access from the engine to the server on port 443 is required. Without this, the engine cannot register or operate.

Why this answer

The Cortex XSOAR engine initiates connections to both the Cortex XSOAR server and the SIEM. It requires outbound access to the server on port 443 to receive tasks and send results. It also requires outbound access to the SIEM on the appropriate port to fetch incidents.

Inbound access to the engine is not needed for these communications, as the engine acts as a client in both cases.

Exam trap

The trap here is assuming that the server initiates connections to the engine, leading to unnecessary inbound firewall rules.

Practice this question →
14
MCQeasy

An administrator is planning to back up a Cortex XSOAR deployment. The backup must include the application configuration, playbooks, and all incident data. Which backup method should the administrator use to capture a consistent snapshot of the entire system?

A.Perform a file-level backup of the /var/lib/docker directory to capture all containers and volumes.
B.Take a snapshot of the virtual machine hosting Cortex XSOAR using the hypervisor's snapshot feature.
C.Export each playbook and integration individually through the Cortex XSOAR UI and save the JSON files.
D.Use the built-in backup and restore mechanism in Cortex XSOAR to create a backup file that includes the database and configuration.
AnswerD

Cortex XSOAR provides a built-in backup and restore feature that captures the database (including incidents, playbooks, and configurations) and relevant files. This is the recommended method for a consistent full-system backup. It ensures that all components are backed up together and can be restored reliably, meeting the administrator's requirements.

Why this answer

The built-in backup and restore mechanism is designed to create a consistent backup of the Cortex XSOAR database and configuration, including incidents, playbooks, and settings. Other methods either capture only partial data, risk inconsistency, or are not supported for full-system recovery. Using the native tool ensures a reliable and restorable backup.

Exam trap

The trap here is assuming that a hypervisor snapshot or file-level copy is sufficient for a consistent application backup, when it may miss database consistency or critical configuration.

Practice this question →
15
MCQeasy

An XSOAR engineer is planning the installation of a new Cortex XSOAR server in a data center. The organization requires that the server be able to run Docker-based integrations. Which prerequisite must be met on the host?

A.The host must have a minimum of 1 TB of RAM.
B.The host must have a supported container runtime installed and configured.
C.The host must have a GPU available for accelerated computing.
D.The host must be joined to an Active Directory domain.
AnswerB

XSOAR uses Docker containers to run integrations and automations in isolated environments. Therefore, a supported container runtime, such as Docker, must be installed and running on the host. This is a fundamental prerequisite for the server to execute containerized content, directly addressing the requirement.

Why this answer

Docker-based integrations in XSOAR require a supported container runtime on the host. Without it, the server cannot execute containerized content. Other options list unnecessary or unrelated requirements such as GPU, Active Directory, or excessive RAM, which are not needed for this purpose.

Exam trap

The trap here is overcomplicating the prerequisites and overlooking that a container runtime is the essential component for Docker-based integrations.

Practice this question →
16
Multi-Selecthard

An XSOAR engineer is preparing a maintenance plan for a production server. The plan must ensure that the server can be restored to a consistent state after a failed upgrade, including all custom content and configuration. Which TWO actions should be included in the backup strategy? (Choose two.)

Select 2 answers
A.Export only the integration instances and their credentials.
B.Export all custom playbooks, automations, and integrations using the server's backup and restore mechanism.
C.Manually copy the /var/log/demisto directory to a remote share.
D.Take a snapshot of the virtual machine or volume hosting the XSOAR server.
E.Schedule a daily report of all incidents to be emailed to the administrator.
AnswersB, D

XSOAR provides a built-in backup and restore feature that captures custom content, configuration, and the database. Using this mechanism ensures a consistent snapshot that can be restored after a failed upgrade. It includes playbooks, automations, integrations, and system settings, making it the most reliable way to meet the requirement.

Why this answer

A robust backup strategy for XSOAR includes both the built-in backup and restore mechanism, which captures custom content and configuration, and a full VM or volume snapshot for complete system recovery. These two together ensure that all necessary components can be restored after a failed upgrade. Other options are either partial or unrelated to backup and restore.

Exam trap

The trap here is assuming that copying logs or exporting only integrations is sufficient for a full restore, when a comprehensive backup must include custom content and system state.

Practice this question →
17
MCQmedium

An XSOAR engineer plans to deploy a new engine in a remote site behind a strict firewall. The firewall only allows outbound traffic to the main XSOAR server on TCP 443, and the engineer wants the engine to register without exposing inbound ports. Which configuration should be used?

A.Deploy the engine as a Docker container on the XSOAR server and use the loopback interface.
B.Set the engine to use a reverse tunnel over HTTPS to the server.
C.Configure the engine to connect outbound to the server on port 443 using the engine key.
D.Open inbound port 443 on the firewall to allow the server to push tasks to the engine.
AnswerC

Engines initiate outbound connections to the XSOAR server on the configured port (default 443) and authenticate with an engine key. This design requires no inbound firewall openings, exactly matching the scenario. The server does not need to reach back to the engine, so outbound-only rules are sufficient for registration and operation.

Why this answer

Engines connect outbound to the XSOAR server on the configured port, authenticating with an engine key. This allows deployment in restricted networks where only outbound TCP 443 is permitted. The server does not initiate connections to the engine, so no inbound rules are needed.

Other options either misstate the communication direction or propose unsupported mechanisms.

Exam trap

The trap here is assuming the server must reach the engine inbound, when in fact engines initiate outbound connections and poll for tasks.

Practice this question →
18
MCQhard

An administrator needs to back up the Cortex XSOAR server configuration and data to facilitate disaster recovery. The backup must include incidents, playbooks, integrations, and system settings, and be restorable to a different server. Which backup method should be used?

A.Perform a file-level backup of the /var/lib/docker directory and the Cortex XSOAR installation directory
B.Use a third-party database backup tool to back up the MongoDB database only
C.Export each playbook and integration individually via the Cortex XSOAR UI and manually recreate incidents
D.Use the built-in backup and restore mechanism available in the Cortex XSOAR settings, which creates a full backup file
AnswerD

Cortex XSOAR provides a built-in backup and restore feature that captures the full server state, including incidents, playbooks, integrations, and system settings. This backup can be restored to another server, making it the correct method for disaster recovery. It is designed specifically for this purpose and ensures consistency.

Why this answer

The built-in backup and restore mechanism in Cortex XSOAR is specifically designed to create a comprehensive backup that includes incidents, playbooks, integrations, and system settings. It produces a restorable file that can be used to recover the server or migrate to a different server, ensuring all critical data is preserved.

Exam trap

The trap here is assuming that backing up the MongoDB database or Docker volumes is sufficient, when Cortex XSOAR's built-in backup is required to capture all components in a restorable format.

Practice this question →
19
MCQeasy

An administrator is planning to install a Cortex XSOAR server on a Linux host. The host has 32 GB of RAM and 8 CPU cores. According to best practices, which additional resource should be allocated to ensure optimal performance?

A.A dedicated GPU for accelerated playbook execution.
B.At least 500 GB of SSD storage for the database and Docker images.
C.A second network interface for out-of-band management.
D.At least 64 GB of RAM to support the Java heap size.
AnswerB

Cortex XSOAR requires sufficient disk space for its database, Docker images, and logs. Best practices recommend SSD storage for performance, and 500 GB is a common minimum for production deployments. This allocation ensures that the server can handle data growth and container images without running out of space.

Why this answer

For a Cortex XSOAR server with 32 GB of RAM and 8 CPU cores, best practices recommend allocating at least 500 GB of SSD storage. This space is needed for the database, Docker images, and logs. Insufficient storage can lead to performance degradation and failures, so proper disk allocation is essential for optimal operation.

Exam trap

The trap here is assuming that additional RAM or specialized hardware like GPUs are required, when the more critical resource for this configuration is adequate SSD storage.

Practice this question →
20
MCQhard

During a routine maintenance window, an administrator upgrades a content pack from the Marketplace, which causes several existing playbooks to fail due to a breaking schema change in a custom automation script. What is the fastest method to revert the content pack to the previously working version?

A.Delete the content pack folder from the file system and restart the server.
B.Run 'demisto-sdk downgrade' from the CLI.
C.Restore the entire server from the last nightly database backup.
D.Use the Marketplace interface to select the specific content pack and downgrade to the previous stable version.
AnswerD

The Marketplace retains prior pack versions, so selecting the pack and downgrading restores the previous schema immediately without rebuilding scripts or playbooks. This directly satisfies the stem's fastest-revert constraint, since the breaking schema change is undone at source rather than patched downstream.

Why this answer

Cortex XSOAR Marketplace allows administrators to manage installed content pack versions and roll back to previous versions directly from the Marketplace view.

Practice this question →
21
Multi-Selecthard

A Cortex XSOAR engineer is planning to deploy a new engine in a remote site to handle high-volume incident ingestion from a SIEM. The engine will run on a Linux server with limited resources. The engineer must ensure the engine can communicate with the main server and process incidents efficiently. Which two actions should the engineer take to meet these requirements? (Choose two.)

Select 2 answers
A.Configure the engine to use a direct connection to the main server over port 443 with a valid SSL certificate.
B.Allocate sufficient CPU and memory resources to the engine based on the expected incident volume, and monitor resource usage.
C.Enable the engine to act as a standalone server to reduce dependency on the main server.
D.Configure the engine to use a proxy server for all outbound communication to the main server.
E.Install the engine on a Windows server instead of Linux to improve performance.
AnswersA, B

Using port 443 with SSL ensures secure communication between the engine and the main server. This is the default and recommended method for engine-server communication, providing encryption and authentication. It also simplifies firewall configuration, as port 443 is commonly open. This action directly addresses the requirement for reliable and secure connectivity.

Why this answer

To deploy an engine for high-volume ingestion, secure and reliable communication with the main server is essential, typically via port 443 with SSL. Additionally, adequate CPU and memory must be allocated to handle the load, and monitoring ensures ongoing performance. These two actions address connectivity and processing capacity, which are critical for the engine's role.

Exam trap

The trap here is assuming that changing the operating system or making the engine standalone can improve performance, when the key factors are secure connectivity and proper resource allocation.

Practice this question →
22
MCQhard

A Cortex XSOAR administrator is planning to migrate the server from an on-premises deployment to a cloud instance. The current server uses an external PostgreSQL database and stores incidents in Elasticsearch. The administrator must ensure that all data, configurations, and custom content are preserved and that the migration can be completed with minimal downtime. Which approach should be taken?

A.Export all incidents and playbooks via the API, then import them on the new server after a fresh installation.
B.Manually copy the PostgreSQL database files and Elasticsearch data directory to the new server, then start the services.
C.Use the built-in backup and restore utility to create a full backup on the old server and restore it on the new cloud instance.
D.Set up database replication between the old and new servers, then switch over after replication is complete.
AnswerC

The built-in backup utility captures the entire system state, including the PostgreSQL database, Elasticsearch indices, and configurations. Restoring this backup on the new instance ensures all data and custom content are preserved. This method is designed for migration and minimizes downtime when performed during a maintenance window.

Why this answer

Migrating Cortex XSOAR requires preserving all data, configurations, and custom content. The built-in backup and restore utility is designed for this purpose, capturing the PostgreSQL database, Elasticsearch indices, and system settings. Restoring the backup on the new cloud instance ensures a complete and consistent migration with minimal downtime when done during a maintenance window.

Exam trap

The trap here is assuming that copying database files or using API exports is sufficient, when the backup utility is the only method that captures the full system state.

Practice this question →
23
MCQmedium

An administrator needs to schedule a periodic database maintenance task to optimize storage and prune old audit logs. Where are data retention and housekeeping settings configured in Cortex XSOAR?

A.Incidents > Retention Policies
B.Dashboards > Maintenance Settings
C.Settings > Advanced > Server Configuration
D.Settings > Integrations > Database Maintenance
AnswerC

Data retention and housekeeping parameters, including audit log pruning and storage optimisation schedules, live under Settings > Advanced > Server Configuration. This location holds the server-level configuration keys that govern periodic maintenance behaviour, matching the administrator's requirement to schedule recurring database upkeep.

Why this answer

Data retention, incident archiving, and cleanup schedules are managed under Settings > Advanced > Server Configuration.

Practice this question →
24
MCQeasy

Which log file on a Linux-based Cortex XSOAR server contains the primary application runtime logs (stdout/stderr of the server process)?

A./var/log/postgresql/postgresql.log
B./var/log/demisto/demisto.log
C./var/log/messages
D./var/log/nginx/access.log
AnswerB

The demisto.log file under /var/log/demisto captures the server process's stdout and stderr, making it the primary runtime log for troubleshooting application-level faults. Other logs cover audit, playbook or Docker activity, so this path uniquely satisfies the stem's requirement for core server runtime output.

Why this answer

On a Linux-based Cortex XSOAR server, the primary application runtime logs — including stdout and stderr from the demisto server process — are written to /var/log/demisto/demisto.log. This file captures server startup, integration execution errors, and core application events, making it the first place to check for runtime issues.

Exam trap

The trap is assuming the general system log (/var/log/messages) or the database log contains application output — candidates often pick the most familiar Linux log path instead of the XSOAR-specific demisto.log.

How to eliminate wrong answers

Option A is wrong because /var/log/postgresql/postgresql.log contains database engine logs, not application runtime output. Option C is wrong because /var/log/messages is the general system log (syslog) for OS-level events, not XSOAR application logs. Option D is wrong because /var/log/nginx/access.log records HTTP access requests handled by the nginx reverse proxy, not the demisto server process output.

Practice this question →
25
MCQhard

An administrator is deploying Cortex XSOAR in a high-security environment where all outbound internet access is blocked. The administrator needs to install content packs from the Marketplace. Which method should be used?

A.Download the content pack from another Cortex XSOAR instance with internet access and manually upload the pack file via the Marketplace interface.
B.Use the command-line tool 'demisto-sdk download' to fetch the pack directly on the server.
C.Configure a proxy server in Cortex XSOAR settings to allow Marketplace access.
D.Enable the 'Offline Mode' checkbox in the Marketplace settings, which allows installation from a local repository.
AnswerA

Cortex XSOAR supports offline installation of content packs by uploading a pack file (a zip archive) through the Marketplace interface. This method is designed for air-gapped environments. The administrator can download the pack from a connected instance or from the Palo Alto Networks Customer Support Portal and then upload it to the isolated server.

Why this answer

In an air-gapped environment, content packs can be installed by manually uploading a pack file obtained from a connected system or the support portal. This is the supported offline installation method. Proxy configuration, SDK commands, or non-existent offline mode settings do not work when all outbound access is blocked.

Exam trap

The trap here is assuming that a proxy or SDK can bypass a complete network block, when the only supported method is manual upload of a pack file.

Practice this question →
26
MCQmedium

You are installing Cortex XSOAR on an offline (air-gapped) RHEL Linux server. Which method should you use to install required Python dependencies for integrations without internet access?

A.Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.
B.Configure the server to tunnel through an unauthenticated proxy.
C.Run 'demisto-sdk download-dependencies' from the CLI.
D.Use the offline installation bundle containing pre-packaged Python dependencies and local wheels.
AnswerD

The offline installation bundle ships pre-packaged Python dependencies and local wheels, letting pip resolve and install integrations without reaching PyPI. This satisfies the air-gapped RHEL constraint, since no internet access is available for dependency downloads.

Why this answer

For an air-gapped Cortex XSOAR installation on RHEL, the supported method is to use the offline installation bundle, which includes pre-packaged Python dependencies and local wheels. This bundle is designed for environments without internet access and ensures all required libraries are available for integrations.

Exam trap

The trap is assuming standard online tools (demisto-sdk, pip) work in air-gapped environments — candidates often pick the SDK command because it sounds official, but it requires internet access.

How to eliminate wrong answers

Option A is wrong because manually copying pip packages into site-packages bypasses dependency resolution and can lead to version conflicts or missing transitive dependencies. Option B is wrong because tunneling through an unauthenticated proxy is insecure and not a supported offline installation method. Option C is wrong because 'demisto-sdk download-dependencies' requires internet access to fetch packages from PyPI, which is unavailable in an air-gapped environment.

Practice this question →
27
MCQeasy

An administrator is planning to install a Cortex XSOAR server on a physical server running Ubuntu 20.04. The server will be used for a small team of 10 analysts. Which installation method is officially supported and recommended by Palo Alto Networks for this scenario?

A.Docker Compose deployment
B.Manual compilation from source code
C.Kubernetes Helm chart
D.Native installer script
AnswerD

Palo Alto Networks provides a native installer script for Linux-based installations of Cortex XSOAR server. This script automates the installation of dependencies, the server application, and required services. It is the recommended method for installing on a supported Linux distribution like Ubuntu 20.04.

Why this answer

For installing Cortex XSOAR server on a Linux distribution like Ubuntu, Palo Alto Networks provides a native installer script. This script handles the installation of all necessary components and is the officially supported method. Other methods like Docker Compose, Helm charts, or manual compilation are not supported for the server component.

Therefore, the native installer script is the correct choice.

Exam trap

The trap here is assuming that containerized deployments like Docker Compose or Kubernetes are supported for the server, when they are not officially recommended.

Practice this question →
28
MCQhard

An administrator is planning to upgrade a Cortex XSOAR deployment from version 6.5 to 6.8. The environment includes a production server and two engines. The administrator wants to minimize downtime and ensure a rollback path. Which upgrade approach should the administrator take?

A.Skip the backup because Cortex XSOAR upgrades are always reversible, and upgrade engines first to test compatibility.
B.Upgrade all engines simultaneously, then upgrade the server, to ensure version compatibility across the board.
C.Upgrade the server and engines simultaneously during a maintenance window to reduce overall downtime.
D.Perform a full backup, upgrade the server first, then upgrade each engine one at a time, verifying functionality before proceeding.
AnswerD

The recommended upgrade order is to back up first, then upgrade the server, and finally upgrade engines sequentially. This minimizes downtime because the server can be upgraded while engines continue to run (though they may be temporarily disconnected). Upgrading engines one at a time allows verification and rollback if issues arise. This approach aligns with Cortex XSOAR best practices.

Why this answer

The correct upgrade sequence is to back up the system, upgrade the server, and then upgrade engines one by one. This order ensures version compatibility, allows for verification at each step, and provides a rollback point via the backup. Upgrading engines first or simultaneously risks incompatibility and makes troubleshooting harder.

Minimizing downtime is achieved by the sequential approach.

Exam trap

The trap here is assuming that upgrading engines first or simultaneously is faster and safe, when in fact the server must be upgraded first and a backup is essential for rollback.

Practice this question →
29
Multi-Selecthard

An administrator is troubleshooting high CPU usage and slow incident search performance on a Cortex XSOAR server. Which TWO actions or tools can be used to diagnose and resolve database-related bottlenecks? (Choose two)

Select 2 answers
A.Increase the Docker container memory limit for the PostgreSQL database container.
B.Delete all historical audit logs directly from the file system to free up database index space.
C.Run 'demisto-sdk analyze-db' from the command line interface.
D.Query the PostgreSQL 'pg_stat_activity' view to identify long-running or locked queries.
E.Review database execution plans using EXPLAIN and ensure proper indexing on custom incident fields used in search filters.
AnswersD, E

pg_stat_activity exposes active sessions, query states, wait events and lock waits, revealing long-running or blocked queries causing CPU and search slowness. It targets the PostgreSQL layer where the bottleneck resides, unlike application logs or network tools.

Why this answer

Option D is correct because querying PostgreSQL's pg_stat_activity view reveals currently executing queries, their runtimes, wait events, and lock contention, which directly exposes long-running or blocked queries causing high CPU and slow incident searches on the Cortex XSOAR database. Option E is correct because using EXPLAIN to review execution plans identifies sequential scans and missing indexes, and adding proper indexes on custom incident fields used in search filters eliminates full-table scans that drive up CPU and latency. Option A is not appropriate because raising the PostgreSQL container memory limit does not diagnose or fix query-level bottlenecks such as missing indexes or inefficient plans.

Option B is wrong because deleting audit logs from the file system bypasses database integrity and does not address index bloat or query performance. Option C is incorrect because 'demisto-sdk analyze-db' is not a valid Cortex XSOAR database diagnostic command.

Practice this question →
30
Multi-Selectmedium

Which THREE configuration settings can be customized in the Cortex XSOAR server configuration file (or Server Configuration UI) to tune system behavior? (Choose three)

Select 3 answers
A.HTTP/HTTPS proxy server settings for outbound integration traffic
B.The physical RAM allocation size of the host server motherboard
C.User session timeout duration for inactivity
D.Logging verbosity levels for troubleshooting specific modules
E.The CPU clock speed of the underlying hypervisor
AnswersA, C, D

Outbound integration traffic often traverses a corporate proxy, so the server configuration exposes HTTP and HTTPS proxy host, port, and authentication values. Setting these lets integrations reach external APIs through the approved egress path, tuning system behaviour without editing individual integration code.

Why this answer

Option A is correct because the Cortex XSOAR server configuration file (and the Server Configuration UI) exposes proxy settings, allowing outbound integration and content traffic to be routed through an HTTP/HTTPS proxy. Option C is correct because session timeout duration for inactivity is a tunable server setting that controls how long an idle user session remains valid before re-authentication is required. Option D is correct because logging verbosity levels can be adjusted per module to increase or decrease log detail for troubleshooting purposes.

Option B is not correct because physical RAM allocation is a hardware/hypervisor-level resource, not a setting in the XSOAR server configuration file or UI. Option E is not correct because CPU clock speed is determined by the underlying hypervisor or hardware and cannot be customized through the XSOAR server configuration.

Practice this question →
31
Multi-Selecthard

An administrator is deploying Cortex XSOAR in an enterprise environment requiring high availability and disaster recovery. Which THREE architecture and maintenance best practices should be implemented? (Choose three)

Select 3 answers
A.Run all integration Docker containers in privileged root mode across all nodes.
B.Schedule automated regular backups of both configuration and database files to secondary storage.
C.Deploy an external, highly available PostgreSQL database cluster rather than relying on embedded instances.
D.Disable database persistence to maximize disk I/O performance.
E.Place a load balancer in front of multiple Cortex XSOAR application server nodes.
AnswersB, C, E

Scheduling automated backups of configuration and database files to secondary storage satisfies the disaster recovery requirement by enabling restoration after instance loss or corruption. Off-instance copies protect playbooks, integrations and incident data independently of the primary deployment's availability.

Why this answer

Option B is correct because Cortex XSOAR's supported disaster-recovery practice is to schedule automated backups of both the configuration and the database (e.g., via the built-in backup mechanism or scripts) and store them on secondary/off-box storage so the environment can be restored after node or site failure. Option C is correct because for high availability and DR, production deployments should use an external highly available PostgreSQL cluster (e.g., streaming replication with automatic failover) instead of the embedded database, which is single-node and unsuitable for HA. Option E is correct because placing a load balancer in front of multiple Cortex XSOAR application server nodes distributes traffic, enables health-check-based failover, and removes the application server as a single point of failure.

Option A does not belong because running integration Docker containers in privileged root mode is a security anti-pattern and is not required for HA/DR. Option D does not belong because disabling database persistence sacrifices durability and would prevent recovery, directly contradicting disaster-recovery requirements.

Exam trap

XSOAR-Engineer often tests the misconception that embedded databases are sufficient for HA — candidates may overlook the need for an external HA database cluster and load balancer for true redundancy.

Practice this question →
32
MCQmedium

An administrator is planning to scale a Cortex XSOAR deployment by adding multiple engines to distribute playbook task load. The organization uses a load balancer in front of the main server. Which configuration on the engines is required to ensure they connect through the load balancer rather than directly to a server node?

A.Configure the engine's server URL to point to the load balancer's fully qualified domain name and import the load balancer's certificate into the engine trust store.
B.Set the engine to use a SOCKS5 proxy and specify the load balancer's IP address as the proxy server.
C.Modify the server's conf.json to list the load balancer's IP in the allowed engines section.
D.Enable the high-availability flag on each engine and set the server port to 8443 for load balancer communication.
AnswerA

Engines connect to the server address configured in their settings. When a load balancer fronts the server, the engine must use the load balancer's FQDN so connections are distributed correctly. The engine must also trust the certificate presented by the load balancer, which may differ from the server node certificate. These two settings ensure the tunnel establishes through the load balancer.

Why this answer

When a load balancer sits in front of the Cortex XSOAR server, engines must be configured with the load balancer's FQDN as their server address so traffic is properly distributed. They must also trust the certificate presented by the load balancer. Proxy settings, server allow-lists, or nonstandard ports are not part of the required configuration for engines to connect through a load balancer.

Exam trap

The trap here is assuming the server must be reconfigured or that a proxy is needed, when the decisive change is pointing the engine at the load balancer's FQDN and trusting its certificate.

Practice this question →
33
MCQeasy

An administrator is preparing a maintenance window for a Cortex XSOAR server. Before applying a content pack update that modifies several playbooks and integrations, the administrator wants to capture a point-in-time backup of the application configuration. Which built-in mechanism should be used to export the current configuration?

A.Copy the /usr/local/demisto directory to an external drive.
B.Use the Backup and Restore page in the Settings section of the Cortex XSOAR UI.
C.Run the demisto-sdk backup command on the server.
D.Execute the pg_dump utility against the PostgreSQL database.
AnswerB

Cortex XSOAR includes a built-in Backup and Restore feature under Settings that allows administrators to export a full configuration snapshot, including playbooks, integrations, and system settings. This export can be downloaded and later restored if the content pack update causes issues. It is the intended tool for capturing configuration state before maintenance.

Why this answer

The Backup and Restore page in the Cortex XSOAR Settings provides a supported way to export a complete configuration snapshot, including playbooks, integrations, and system settings. This snapshot can be downloaded and used to restore the system if a content update introduces problems. Other methods either target development workflows or produce incomplete or inconsistent backups.

Exam trap

The trap here is assuming that a database dump or file copy is sufficient for a configuration backup, when Cortex XSOAR's built-in export captures additional metadata and settings that those methods miss.

Practice this question →
34
MCQmedium

An administrator is configuring Syslog integration in Cortex XSOAR to forward security alerts. Which transport layer security options are supported when sending logs to a remote SIEM via Syslog?

A.UDP only
B.UDP and TCP (Plaintext only)
C.HTTPS REST API only
D.UDP, TCP, and TLS (Encrypted TCP)
AnswerD

Syslog forwarding in Cortex XSOAR supports UDP, TCP, and TLS-encrypted TCP, so the administrator can select the transport matching each remote SIEM's security posture. TLS satisfies the requirement for encrypted delivery, while UDP and TCP cover unencrypted legacy collectors.

Why this answer

Cortex XSOAR Syslog integration supports UDP, TCP, and TLS-secured TCP connections for log forwarding.

Practice this question →
35
MCQeasy

A Cortex XSOAR administrator is planning a new distributed deployment with multiple engines to handle increased load. Which component is responsible for distributing incidents and tasks to the engines?

A.The load balancer
B.The message queue service
C.The engine that was installed first
D.The Cortex XSOAR server
AnswerD

The Cortex XSOAR server acts as the central management and distribution point. It assigns incidents and playbook tasks to available engines based on their configured roles and load. The server maintains the state of all incidents and orchestrates the workflow, ensuring that tasks are executed on the appropriate engine.

Why this answer

The Cortex XSOAR server is the central component that distributes incidents and tasks to engines. It manages incident state, playbook execution, and engine communication. Load balancers, message queues, and engine hierarchy do not play a role in task distribution.

Exam trap

The trap here is confusing the role of a load balancer or message queue with the server's orchestration duties, which are handled internally by the Cortex XSOAR server.

Practice this question →
36
MCQeasy

Which role in Cortex XSOAR has full administrative privileges across the entire platform, including user management and system settings?

A.Incident Analyst
B.Playbook Designer
C.Administrator
D.Auditor
AnswerC

The Administrator role holds unrestricted rights across the whole Cortex XSOAR platform, covering user management, system settings and all tenant configuration. Lower roles such as Analyst or Investigator are scoped to incident work and cannot alter platform-wide settings, so only Administrator satisfies the full-privilege requirement.

Why this answer

The Administrator role in Cortex XSOAR holds full administrative privileges across the entire platform, including user management, system settings, integrations, and content. It is the highest-privilege built-in role and is the only one that can modify global configuration and manage other users. This makes it the correct answer for a question about full platform-wide administrative control.

Exam trap

XSOAR-Engineer often tests role boundaries — candidates may assume any senior-sounding role (like Playbook Designer) has broad privileges, but only Administrator grants full platform-wide control including user management.

How to eliminate wrong answers

Option A is wrong because the Incident Analyst role is limited to working with incidents and does not include user management or system settings. Option B is wrong because the Playbook Designer role focuses on creating and editing playbooks and automation content, not on platform administration. Option D is wrong because the Auditor role is read-only and intended for compliance review, with no ability to change settings or manage users.

Practice this question →
37
MCQhard

An XSOAR engineer is troubleshooting an engine that shows as disconnected in the server UI. The engine host can ping the server, and the server can ping the engine host. The engineer verifies that the engine service is running. Which action should be taken next to diagnose the issue?

A.Verify that the engine's hostname resolves correctly from the server.
B.Check the engine's logs for connection errors or authentication failures.
C.Restart the XSOAR server to clear any temporary glitches.
D.Increase the engine's memory allocation to improve performance.
AnswerB

The engine logs contain detailed information about connection attempts, including authentication errors, TLS handshake failures, or network timeouts. Since basic connectivity is confirmed, the next logical step is to inspect the engine's logs to identify why the connection is not being established. This action directly targets the most likely causes of a disconnected state.

Why this answer

When an engine is disconnected despite basic network connectivity, the engine's logs are the best source of information. They can reveal authentication failures, TLS errors, or misconfigured server addresses. Other actions, such as restarting the server or checking hostname resolution, are either disruptive or redundant given the scenario.

Exam trap

The trap here is to jump to restarting the server or checking network basics again, when the engine logs hold the specific error needed to diagnose the disconnection.

Practice this question →
38
MCQeasy

What is the primary function of the Cortex XSOAR Content Pack mechanism?

A.To compile raw source code into executable binary binaries
B.To manage Docker container images for offline deployment
C.To store encrypted user passwords and API keys securely
D.To package related integrations, playbooks, scripts, and dashboards into a single installable unit
AnswerD

Content packs bundle integrations, playbooks, scripts, and dashboards as one installable unit, satisfying the requirement for a single deployable artefact. This mechanism lets engineers distribute complete, versioned automation content across tenants without manually importing each component, which is precisely the packaging function the stem asks about.

Why this answer

A Cortex XSOAR Content Pack is a versioned, installable bundle that packages related integrations, playbooks, scripts, dashboards, incident types, fields, and layouts into a single unit. It enables one-click installation and dependency management from the Marketplace. This is the primary mechanism for distributing and deploying XSOAR content.

Exam trap

XSOAR-Engineer often tests the confusion between Content Packs (bundling content) and other mechanisms like Docker image management or credential storage, tricking candidates who conflate packaging with deployment or secrets.

How to eliminate wrong answers

Option A is wrong because Content Packs do not compile source code into binaries — XSOAR runs Python scripts and integrations interpreted at runtime, and packaging is about bundling YAML/JSON/Python artifacts, not compilation. Option B is wrong because while Content Packs may reference Docker images for integrations, managing Docker images for offline deployment is not their primary function; that is handled by Docker registries and the XSOAR server's image management. Option C is wrong because storing encrypted passwords and API keys is the role of the Credentials store and secret management, not Content Packs — packs may include integration configurations but do not store secrets.

Practice this question →
39
Multi-Selecteasy

Which TWO tasks are typically performed during routine Cortex XSOAR platform maintenance? (Choose two)

Select 2 answers
A.Reviewing system audit logs and health check dashboards for anomalies
B.Manually recompiling the Python interpreter binary
C.Formatting the server storage disks weekly
D.Replacing the SSL certificate daily
E.Updating content packs and integrations from the Cortex XSOAR Marketplace
AnswersA, E

Reviewing audit logs and health dashboards directly satisfies the routine maintenance requirement by detecting anomalies before they escalate. This proactive monitoring verifies platform integrity, authentication events and component status, catching degradation early. Unlike reactive troubleshooting after failure, scheduled log and health reviews constitute the preventive upkeep Cortex XSOAR administrators perform to maintain operational stability.

Why this answer

Option A is correct because routine Cortex XSOAR maintenance includes monitoring system audit logs and health check dashboards (e.g., the System Health and Audit Logs views) to detect anomalies such as failed playbook runs, integration errors, or resource exhaustion before they impact incident response. Option E is correct because keeping content packs and integrations current via the Cortex XSOAR Marketplace is a standard maintenance task that delivers bug fixes, new commands, and updated detection logic, and is typically managed through the Marketplace or the Content Management interface. Option B is not a maintenance task because the Python interpreter ships with the platform and is upgraded through official Cortex XSOAR releases, not by manually recompiling binaries.

Option C is not performed because disk formatting is destructive and only done during initial deployment or disaster recovery, not weekly. Option D is not routine because SSL certificates are replaced on a scheduled expiration cycle (typically annually or per organizational policy), not daily.

Practice this question →
40
MCQhard

An administrator configures multi-tenant architecture in Cortex XSOAR. Which component is responsible for isolating incidents, playbooks, and integrations between different child tenants?

A.Individual PostgreSQL database instances per tenant schema
B.Account-based segregation with role-based access control (RBAC) on the central server
C.Dedicated Docker containers per tenant
D.Physical server separation linked via API gateways
AnswerB

Account-based segregation with RBAC on the central server isolates incidents, playbooks and integrations per child tenant, satisfying the multi-tenant isolation requirement. Each account scopes its own content, while RBAC restricts users to their assigned tenant, preventing cross-tenant visibility or modification. This is the mechanism Cortex XSOAR uses for tenant separation.

Why this answer

In Cortex XSOAR multi-tenancy, accounts and roles manage data segregation between tenants on a single central server.

Practice this question →
41
MCQmedium

An administrator needs to import a bundle of custom content (playbooks, scripts, layouts) exported from a development environment into a production Cortex XSOAR instance. Which feature should be used?

A.demisto-ctl import-content
B.Settings > Integrations > Content Transfer
C.Settings > Import / Export > Import
D.Marketplace > Upload Custom Pack
AnswerC

Settings > Import / Export > Import uploads a content bundle archive and merges its playbooks, scripts and layouts into the target tenant. This is the supported mechanism for promoting customised content between development and production instances without manual recreation.

Why this answer

The correct answer is C: Settings > Import / Export > Import. This is the built-in Cortex XSOAR UI feature specifically designed to import a previously exported content bundle (a .zip file containing playbooks, scripts, layouts, and other custom content) from one environment into another. It handles dependency resolution and version compatibility, making it the standard method for migrating custom content between development and production instances.

Exam trap

XSOAR-Engineer often tests the confusion between content import/export and other administrative functions like backup/restore or marketplace pack installation, leading candidates to choose plausible-sounding but non-existent menu paths or CLI commands.

How to eliminate wrong answers

Option A is wrong because 'demisto-ctl import-content' is not a valid command; demisto-ctl is a CLI tool for managing server services (e.g., start, stop, backup), not for importing content bundles. Option B is wrong because 'Settings > Integrations > Content Transfer' does not exist; integrations are configured under Settings > Integrations, but there is no 'Content Transfer' submenu. Option D is wrong because 'Marketplace > Upload Custom Pack' is not a feature; the Marketplace is for installing pre-built content packs from the Cortex XSOAR marketplace, not for uploading custom bundles.

Practice this question →
42
MCQmedium

An administrator is planning a new Cortex XSOAR deployment that will use an external PostgreSQL database for the main application data. The security team requires that all communication between the Cortex XSOAR application server and PostgreSQL be encrypted in transit. Which configuration step must the administrator take to meet this requirement?

A.Set the PostgreSQL listen_addresses parameter to localhost and rely on the operating system's loopback interface for security.
B.Install a reverse proxy between the Cortex XSOAR server and PostgreSQL to terminate TLS and forward unencrypted traffic to the database.
C.Enable SSL on the PostgreSQL server and configure the Cortex XSOAR server to connect using the sslmode=require parameter in the database connection string.
D.Configure the Cortex XSOAR server to use the PostgreSQL native pgcrypto extension for column-level encryption.
AnswerC

Cortex XSOAR supports PostgreSQL SSL connections. By enabling SSL on PostgreSQL and adding sslmode=require (or verify-full) to the connection string, all traffic between the application server and database is encrypted. This satisfies the security requirement without additional components and is the documented method for securing the database connection.

Why this answer

The correct approach is to enable SSL on the PostgreSQL server and configure the Cortex XSOAR connection string with sslmode=require. This ensures that all database traffic is encrypted using TLS. The other options either do not provide transport encryption, introduce unsupported components, or would prevent the application from connecting to the database.

Exam trap

The trap here is confusing data-at-rest encryption mechanisms like pgcrypto with transport encryption, or assuming that network segmentation alone satisfies an encryption-in-transit requirement.

Practice this question →
43
Multi-Selectmedium

When planning a multi-tenant Cortex XSOAR deployment, which THREE design considerations must an administrator evaluate? (Choose three)

Select 3 answers
A.Configuring independent Linux kernels for each tenant container.
B.How role-based access control (RBAC) restricts users to their specific tenant accounts.
C.Allocating a separate physical server for each child tenant.
D.Distributing content packs from the root tenant to child tenants.
E.Whether integrations should be configured globally at the root level or individually per tenant account.
AnswersB, D, E

RBAC scopes user permissions and data visibility to assigned tenant accounts, preventing cross-tenant access in a shared deployment. Evaluating how roles map to tenants ensures analysts only view and act on their own tenant's incidents, satisfying multi-tenant isolation requirements.

Why this answer

Option B is correct because in a multi-tenant Cortex XSOAR deployment, RBAC is the mechanism that scopes users to their own tenant account, ensuring that analysts in one child tenant cannot view or act on incidents, playbooks, or data belonging to another tenant. Option D is correct because content packs are managed and distributed from the root (parent) tenant down to child tenants, so the administrator must plan how packs are pushed and which tenants receive them. Option E is correct because a key design decision is whether integrations (and their instances) are configured once at the root level and shared, or configured individually within each tenant account, which affects credential isolation and management overhead.

Option A is not correct because tenants are logical partitions within the XSOAR application, not separate containers each requiring their own Linux kernel. Option C is not correct because multi-tenancy is a logical separation feature and does not require a dedicated physical server per child tenant.

Practice this question →
44
MCQhard

You are configuring SAML 2.0 Single Sign-On (SSO) for Cortex XSOAR authentication. Users report that they receive a 'Signature Validation Failed' error upon logging in. What is the most likely cause of this error?

A.The clock skew between the XSOAR server and IdP exceeds 60 seconds.
B.The user's email address contains uppercase characters.
C.The IdP signing certificate imported into Cortex XSOAR does not match the certificate configured on the Identity Provider.
D.The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.
AnswerC

Signature validation compares the SAML assertion's signature against the IdP certificate stored in Cortex XSOAR. A mismatch between that imported certificate and the one currently configured on the Identity Provider causes validation to fail, producing this error.

Why this answer

Signature validation failures in SAML typically occur when the IdP signing certificate imported into Cortex XSOAR does not match the certificate currently used by the Identity Provider.

Practice this question →
45
MCQeasy

A Cortex XSOAR administrator is setting up a new server and needs to ensure that the server can receive automatic updates for content packs and system components. Which configuration should be verified to allow outbound communication for these updates?

A.The server must have outbound SSH access on port 22 to the update servers.
B.The server must have outbound DNS access on port 53 only; updates are pulled via DNS queries.
C.The server must have outbound FTP access on port 21 to download update packages.
D.The server must have outbound HTTPS access to the Cortex XSOAR update servers on port 443.
AnswerD

Cortex XSOAR uses HTTPS on port 443 to connect to update servers for content packs and system updates. Ensuring outbound access to these servers is essential for automatic updates. Without this connectivity, the server cannot retrieve the latest packs or patches, leaving it outdated and potentially vulnerable.

Why this answer

Automatic updates for Cortex XSOAR content packs and system components are fetched over HTTPS on port 443. The server must have outbound access to the update servers to download these updates. Other protocols like SSH, FTP, or DNS alone do not support the update mechanism and would fail to deliver the necessary files.

Exam trap

The trap here is confusing the protocol used for updates with other common protocols like SSH or FTP, when HTTPS on port 443 is the correct one.

Practice this question →
46
Multi-Selectmedium

An administrator is planning to deploy a Cortex XSOAR engine to handle increasing integration workloads and to allow execution of integrations in a remote network segment. Which TWO statements are true regarding Cortex XSOAR engines? (Choose two.)

Select 2 answers
A.Engines communicate with the Cortex XSOAR server over HTTPS on port 443 by default.
B.Engines store a copy of the Cortex XSOAR incident database for offline access.
C.Engines can be deployed in a remote network segment to run integrations that require access to local resources.
D.Engines can only run Docker-based integrations and cannot execute scripts directly on the host.
E.Engines automatically synchronize playbooks and integrations from the server and can execute them without server connectivity.
AnswersA, C

Cortex XSOAR engines establish a secure connection to the server using HTTPS. By default, they communicate over port 443, which is the standard secure web port. This encrypted channel ensures that commands and data are transmitted securely between the engine and the server.

Why this answer

Cortex XSOAR engines are remote execution components that connect to the server over HTTPS on port 443. They enable integration execution in remote network segments, providing local access to resources. They do not store the incident database and require server connectivity to function, so the true statements are about remote deployment and secure communication.

Exam trap

The trap here is assuming that engines can operate offline or store incident data, when they are actually dependent on the server and do not hold the database.

Practice this question →
47
MCQeasy

Which command is used to restart the Cortex XSOAR server service on a Red Hat Enterprise Linux (RHEL) installation?

A.systemctl restart demisto
B.demisto-ctl restart
C.systemctl restart cortex-xsoar
D.service xsoar-server restart
AnswerA

On RHEL, Cortex XSOAR runs as the demisto systemd unit, so systemctl restart demisto stops and starts the server service cleanly. Alternatives such as service commands or direct binary invocation bypass systemd's dependency and restart handling, and the unit name is demisto, not xsoar.

Why this answer

Cortex XSOAR runs as a systemd service named 'demisto' on RHEL systems.

Practice this question →
48
MCQeasy

An administrator is deploying Cortex XSOAR in a high-availability environment. Which database architecture is natively utilized and required for Cortex XSOAR server clustering?

A.MySQL
B.PostgreSQL
C.Microsoft SQL Server
D.MongoDB
AnswerB

Cortex XSOAR server clustering natively requires PostgreSQL, which stores the shared configuration and tenant data that cluster nodes must access consistently. This satisfies the high-availability constraint, since the database tier must be reachable by every node rather than tied to one server.

Why this answer

Cortex XSOAR utilizes an external PostgreSQL database for server clustering and state management to ensure high availability across multiple engine and server instances.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Planning Installation And Maintenance questions.

Start 20-question session