XSOAR-ENGINEER Palo Alto Networks Certified XSOAR Engineer Practice Questions
Prepare for XSOAR-ENGINEER with more than an answer.
- Exam fee
- $250 USD
- Level
- Specialist
- Valid for
- 2 years
Domains covered on the exam 5
- Planning, Installation, and Maintenance14%
- Use Case Planning and Development22%
- Playbook Development30%
- Incident Interactions and Reporting16%
- Threat Intelligence Management18%
- 1
Which of the following is a valid method to pass data from a parent playbook to a sub-playbook?
Show answer details
Correct answer: C
Sub-playbooks define inputs in their settings. When added as a task to a parent playbook, these inputs appear in the Task configuration, allowing the parent to map context data to them.
- 2
A developer is writing a Python automation script to parse a CSV file attached to an incident. Which function should be used to retrieve the file path of the attachment from the entry ID?
Show answer details
Correct answer: D
demisto.getFilePath(entry_id)returns a dictionary containing the local path and name of the file associated with the given Entry ID, allowing the script to open and read it. - 3
You are debugging a playbook that failed. You open the Playbook Debugger. What is the primary advantage of using the Debugger compared to simply viewing the Work Plan execution log?
Show answer details
Correct answer: D
This interactive capability (breakpoints, context inspection/modification) is the key differentiator of the Debugger.
- 4
A playbook task runs the command
!ad-get-user. You want to ensure that the outputsAMAccountNameis stored in the context keyActiveDirectory.Userinstead of the defaultAccount.User. How do you configure this?Show answer details
Correct answer: A
Playbook tasks allow output mapping (Output Settings) where you can override the default context location for specific command outputs.
- 5
You need to create a playbook task that waits for a user to manually approve an action via email or the War Room. Which task type should you use?
Show answer details
Correct answer: D
Data Collection tasks (or 'Ask' tasks) are specifically designed to pause playbook execution and wait for user input (like a survey or approval button response).
- 6
An organization requires a Cortex XSOAR engine to be deployed in a restricted network zone (DMZ) to facilitate integration with internal security tools that cannot be exposed directly to the internet. The XSOAR main server is hosted in the cloud. Which connection method must be configured on the engine to ensure secure communication with the main server?
Show answer details
Correct answer: A
Cortex XSOAR engines are designed to initiate the connection to the main server. They establish a persistent HTTPS (WebSocket) tunnel outbound on port 443. This design allows engines to sit behind firewalls without requiring inbound ports to be opened.
- 7
A SOC Engineer needs to migrate custom content (playbooks, scripts, and layouts) from a Development XSOAR environment to a Production environment. The organization enforces strict version control and peer review processes. What is the recommended method to achieve this migration?
Show answer details
Correct answer: B
The Remote Repository feature allows XSOAR to integrate directly with Git. The recommended workflow for strict version control is to push content from the Development environment to a Git repository branch, perform peer reviews/merges, and then pull the approved content into the Production environment.
- 8
You are troubleshooting a failed integration fetch in Cortex XSOAR. The integration connects to an external SIEM to pull alerts. The error log shows 'CertificateVerifyFailed'. The SIEM uses a self-signed certificate. How should you resolve this issue securely while maintaining the integration?
Show answer details
Correct answer: C
The most secure method is to import the self-signed certificate (or the signing CA) into the trust store used by the integration (often within the Docker container or the host engine). Simply trusting 'any' certificate is a security risk and not recommended for production.
- 9
True or False: When a Content Pack update is available in the Marketplace, updating it will automatically overwrite any local changes made to the out-of-the-box playbooks included in that pack, without creating a backup.
Show answer details
Correct answer: B
False. Cortex XSOAR prevents overwriting detached content. If you have modified an out-of-the-box playbook, it becomes 'detached'. You must either reattach it (losing changes) or duplicate it before updating. Generally, it is best practice to detach or duplicate content before editing to avoid update conflicts.
- 10
An engineer needs to optimize the database storage of a Cortex XSOAR environment. Which TWO actions can effectively reduce the disk space consumed by incidents and indicators? (Select TWO)
Show answer details
Correct answer: C, D
Reducing the retention period allows the system to prune older data, freeing up significant disk space.
Preprocessing rules prevent unnecessary data from ever entering the database, which is a proactive way to manage storage growth.
