XSOAR-ENGINEER sample questions

Question 1

An organization requires a Cortex XSOAR engine to be deployed in a restricted network zone (DMZ) to facilitate integration with internal security tools that cannot be exposed directly to the internet. The XSOAR main server is hosted in the cloud. Which connection method must be configured on the engine to ensure secure communication with the main server?

Accepted Answer

The engine initiates a persistent HTTPS tunnel (websocket) outbound to the main server on port 443.

Answer

The engine must be configured to listen on port 443 for incoming connections from the main server.

Answer

A VPN tunnel must be established between the DMZ router and the Cortex XSOAR cloud gateway.

Answer

The engine requires an SSH tunnel on port 22 to be established from the main server.

Question 2

A SOC Engineer needs to migrate custom content (playbooks, scripts, and layouts) from a Development XSOAR environment to a Production environment. The organization enforces strict version control and peer review processes. What is the recommended method to achieve this migration?

Accepted Answer

Use the Remote Repository feature to connect both environments to a Git repository, pushing from Dev and pulling to Prod.

Answer

Manually export each item as a JSON file from Dev and import them one by one into Prod.

Answer

Use the 'Backup and Restore' feature to overwrite the Production database with the Development database.

Answer

Copy the /var/lib/demisto/content directory from the Dev server to the Prod server using SCP.

Question 3

You are troubleshooting a failed integration fetch in Cortex XSOAR. The integration connects to an external SIEM to pull alerts. The error log shows 'CertificateVerifyFailed'. The SIEM uses a self-signed certificate. How should you resolve this issue securely while maintaining the integration?

Accepted Answer

Add the SIEM's CA certificate to the Docker image or the engine's trusted certificate store.

Answer

Check the 'Trust any certificate' (insecure) checkbox in the integration instance settings.

Answer

Change the integration URL from HTTPS to HTTP.

Answer

Disable the server certificate verification in the demisto.conf file.

Question 4

True or False: When a Content Pack update is available in the Marketplace, updating it will automatically overwrite any local changes made to the out-of-the-box playbooks included in that pack, without creating a backup.

Accepted Answer

False

Answer

True

Question 5

An engineer needs to optimize the database storage of a Cortex XSOAR environment. Which TWO actions can effectively reduce the disk space consumed by incidents and indicators? (Select TWO)

Accepted Answer

Configure a shorter retention period for closed incidents in the system settings.

Accepted Answer

Implement a Preprocessing Rule to drop irrelevant alerts before they become incidents.

Answer

Increase the number of daily backups.

Answer

Switch the database engine from BoltDB to Elasticsearch.

Question 6

A security engineer is configuring a new classifier for email-based incidents. The requirement is to classify emails with the subject 'Phishing Alert' as 'Phishing' incidents, and emails with 'Malware Detected' as 'Malware' incidents. All other emails should be classified as 'General'. Which configuration step is essential to achieve this?

Accepted Answer

Set the 'Default Incident Type' to 'General' and add key-based classification rules for the 'subject' field.

Answer

Create a pre-processing script to change the email subject line before classification.

Answer

Configure the Mapper to map the 'subject' field to the 'type' field directly.

Answer

Use a Transformer to convert the email body into an incident type.

Question 7

You are mapping a JSON alert from a SIEM to XSOAR fields. The JSON structure contains a nested field: `{"alert": {"details": {"source_ip": "192.168.1.1"}}}`. Which syntax correctly extracts the IP address in the Mapper configuration?

Accepted Answer

alert.details.source_ip

Answer

alert->details->source_ip

Answer

${alert:details:source_ip}

Answer

Get(alert, 'details.source_ip')

Question 8

A layout for the 'Phishing' incident type must show a specific tab called 'Forensics' ONLY if the incident severity is 'High' or 'Critical'. How should this be configured?

Accepted Answer

Add a display condition (filter) to the 'Forensics' tab in the Layout Editor referencing the severity field.

Answer

Configure a 'Hidden' permission on the tab and assign it to the Admin role.

Answer

Create two separate layouts, one with the tab and one without, and use a script to switch layouts.

Answer

This is not possible; tabs are static and cannot be conditionally hidden.

Question 9

You are creating a custom Incident Type 'Malware Investigation'. You want to ensure that whenever an incident of this type is created, a specific playbook 'Malware Response v2' is automatically assigned and executed. Where do you configure this association?

Accepted Answer

In the Incident Type settings, under the 'Default Playbook' dropdown menu.

Answer

In the Integration Instance settings under 'Default Playbook'.

Answer

In the Playbook settings, by selecting the 'Trigger on Incident Type' option.

Answer

In the Preprocessing Rules.

Question 10

A developer needs to store a list of malicious IP addresses that are updated daily by an external threat feed. This list will be used by multiple playbooks to block traffic. Which Cortex XSOAR feature is best suited for storing and managing this data?

Accepted Answer

XSOAR Lists

Answer

Incidents

Answer

Context Data

Answer

Jobs

Top vendors

Top exams

Free XSOAR-ENGINEER sample questions