Planning Installation And Maintenance practice questions

Manually copy pip packages into the /var/lib/demisto/python/site-packages directory.

Why wrong: Manually injecting files into internal paths is unsupported and will be overwritten during container initialization.

Configure the server to tunnel through an unauthenticated proxy.

Why wrong: Air-gapped environments by definition have no route to external networks, rendering proxies ineffective.

Run 'demisto-sdk download-dependencies' from the CLI.

Why wrong: demisto-sdk is used for content development, not server-side offline dependency management.

tar -czvf /backup/xsoar.tar.gz /var/lib/demisto

Why wrong: Raw file archiving while the database is running can lead to file corruption and inconsistent backups.

pg_dump demisto > backup.sql

Why wrong: While PostgreSQL holds data, demisto-ctl backup captures necessary file assets and configurations alongside the database.

XSOAR Web UI > Settings > Maintenance > Export Snapshot

Why wrong: Snapshots in the UI are for content packs, not a full system database and configuration backup.

TCP 8443

Why wrong: Port 8443 is often used for alternate HTTPS traffic, but standard server-to-engine communication defaults to 443 unless explicitly changed.

TCP 22

Why wrong: Port 22 is used for SSH and is not the standard port for engine-to-server communication.

TCP 6222

Why wrong: Port 6222 is used for Demisto enterprise clustering sync, not standard engine-to-server outbound traffic.

Upgrade all components simultaneously using the orchestrated installer.

Why wrong: Simultaneous upgrades can cause split-brain scenarios and service interruptions in a multi-node environment.

Upgrade secondary servers first, then the primary server, and lastly the engines.

Why wrong: Updating secondary servers before the primary server can cause database schema mismatches and synchronization failures.

Upgrade the engines first, then secondary servers, and finally the primary server.

Why wrong: Engines depend on the server version and must not be upgraded before the server tier.

demisto.engine.memory.limit

Why wrong: This is not a valid Cortex XSOAR configuration key.

incident.ingestion.buffersize

Why wrong: This parameter controls batching for ingestion, not JVM memory allocation.

python.max.worker.memory

Why wrong: Python workers run in separate Docker containers and are governed by Docker resource limits, not the server JVM heap.

Incidents > Audit Trail

Why wrong: The incident audit trail tracks changes made to specific incident fields, not integration execution streams.

Dashboards > Server Metrics

Why wrong: Server metrics show performance statistics, not individual integration debugging output.

Settings > Advanced > System Health

Why wrong: System health monitors CPU, memory, and database status rather than integration-specific execution logs.

demisto-ctl restart

Why wrong: demisto-ctl is used for cluster management and database operations, not standard systemd service restarts.

systemctl restart cortex-xsoar

Why wrong: The systemd service name for Cortex XSOAR is demisto.

service xsoar-server restart

Why wrong: The service name is demisto, not xsoar-server.

MySQL

Why wrong: MySQL is not the native database architecture used by Cortex XSOAR for clustering.

Microsoft SQL Server

Why wrong: MS SQL is not supported as the native clustering database for Cortex XSOAR.

MongoDB

Why wrong: MongoDB is not used as the primary database for Cortex XSOAR server clustering.

To act as a primary database replica for high availability

Why wrong: Engines do not store the primary database; they act as execution agents.

To handle user authentication and single sign-on (SSO) requests

Why wrong: Authentication is handled by the main server, not engines.

To store long-term incident archives for compliance reporting

Why wrong: Archiving is a server-level function, not an engine function.

Dashboards > Container Health

Why wrong: There is no default dashboard named Container Health.

Incidents > Management > Containers

Why wrong: Incident management does not track integration container images.

Settings > About > System Information

Why wrong: System information displays server version and OS details, not individual integration container images.

Delete the content pack folder from the file system and restart the server.

Why wrong: Manually deleting system files can leave broken dependencies and orphan references in the database.

Run 'demisto-sdk downgrade' from the CLI.

Why wrong: demisto-sdk does not manage live server content pack downgrades.

Restore the entire server from the last nightly database backup.

Why wrong: Restoring the whole database is overly disruptive and time-consuming when only a content pack needs rolling back.

Configured inside the PostgreSQL database connection string

Why wrong: The database certificate is separate from integration API SSL trust stores.

In the host operating system's /etc/pki/ca-trust/source/anchors/ directory only

Why wrong: While the host OS needs trust, Docker containers do not automatically inherit host trust stores without XSOAR server configuration.

Inside each individual integration's Python script code

Why wrong: Hardcoding or modifying script code to bypass SSL verification is insecure and not best practice.

SNMP v3 Traps

Why wrong: SNMP is not the primary native protocol used for forwarding XSOAR audit logs.

NetFlow v9 streaming

Why wrong: NetFlow is used for network traffic analysis, not application log forwarding.

WMI event subscription

Why wrong: WMI is specific to Windows environments and not used natively by XSOAR for log export.

Individual PostgreSQL database instances per tenant schema

Why wrong: XSOAR multi-tenancy uses schema-level or table-level partitioning within a single database instance, not separate instances.

Dedicated Docker containers per tenant

Why wrong: Docker containers are shared across integrations; tenants do not get dedicated container engines solely for isolation.

Physical server separation linked via API gateways

Why wrong: Multi-tenancy in XSOAR runs on a single server instance (or HA cluster) utilizing logical account partitioning.

server.max.threads

Why wrong: server.max.threads controls general HTTP request threads, not Python script execution workers.

integration.concurrency.limit

Why wrong: This is not the correct configuration key name.

docker.container.pool.size

Why wrong: Docker container pooling is managed dynamically, not via a static pool size key.

Incident Analyst

Why wrong: Analysts have permissions restricted to incident handling and response.

Playbook Designer

Why wrong: Playbook Designers can create and edit playbooks and automations, but cannot manage system settings or global users.

Auditor

Why wrong: Auditors have read-only access to logs and incidents for review purposes.

The clock skew between the XSOAR server and IdP exceeds 60 seconds.

Why wrong: Clock skew issues result in 'Token not yet valid' or 'Token expired' errors, not signature validation failures.

The user's email address contains uppercase characters.

Why wrong: Email casing does not cause SAML signature validation errors.

The SAML assertion uses HTTP-Redirect instead of HTTP-POST binding.

Why wrong: Binding mismatches usually result in parsing errors or missing payload errors, not signature failures.

Incidents > Retention Policies

Why wrong: Retention policies are not managed from the Incidents menu.

Dashboards > Maintenance Settings

Why wrong: Maintenance settings are located in Server Configuration, not Dashboards.

Settings > Integrations > Database Maintenance

Why wrong: There is no Database Maintenance menu under Integrations.

Disable the integration for all users except Tier 2 via server configuration keys.

Why wrong: Server configuration keys apply globally, not granularly per integration instance by user role.

Place the integration inside a restricted playbook folder.

Why wrong: Playbook folder permissions do not restrict direct integration command execution from the CLI or war room.

Modify the integration Python code to check the logged-in user's username.

Why wrong: Hardcoding user checks in code is insecure and violates RBAC best practices.

To compile raw source code into executable binary binaries

Why wrong: XSOAR runs interpreted Python and JavaScript; it does not compile binary executables.

To manage Docker container images for offline deployment

Why wrong: Docker images are pulled from registries, not bundled inside content packs.

To store encrypted user passwords and API keys securely

Why wrong: Secrets are managed via the credential store, not content packs.