Paloalto Networks XSOAR-Engineer Palo Alto Networks XSOAR Engineer Exam Practice Test
Palo Alto Networks XSOAR Engineer Questions and Answers
What happens when an integration is deprecated?
Previous playbook tasks have built out the context in the image below.
When specifying ${User.Name} as an input for a sub playbook task which has the default loop configuration, how many times will the sub-playbook be executed?.
Which component can be part of a load balancing group?
By default, which components does an XSOAR implementation include?
Can an automation script execute an integration command and an integration command execute an automation script?
Which three support types are included in the Marketplace Content Packs? (Choose three.)
Incidents need to be filtered by all of the following criteria:
1.Status – Pending
2.Exclude Category – Job
3.Severity – High
4.Owner – None (No owner assigned)
5.Type – Phishing
6.Email Subject – “You have won a million dollars”
What is the correct query syntax for the above incident search filter?
Which of the following is a basic setting that can be configured in an automation?
Which two options may be added when a content pack is being installed? (Choose two.)
Given the following context data, what would be the expected output of the expression?
A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named "BlockedSenders_Email."
Which built-in command should be used within the playbook to add this email address to the specified list?.
During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.
Which of the following set of steps can help to resolve the issue?
What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)
Which two components have their own context data? (Choose two.)
If a known malicious domain is no longer associated with a specific IP address, which action will make the association inactive?.
An engineer’s organization system is registered in the following manner:
What is the most efficient way for the engineer to achieve this?
After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?
Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?
What will happen if a playbook debugger is left running for more than 24 hours?
Which configuration is a valid distributed database (DB) implementation?
Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?
Which task type would be used to verify/check that an integration was enabled?
When creating an automation in XSOAR, what is the best way to create a log message?
How would context data be filtered to receive only malicious indicator values with DBotScore?
Select the correct incident life cycle on XSOAR.
Which content type cannot be managed using remote repositories?
An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.
How can they achieve this?
Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)
An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically.
How can this be implemented?
An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?
Which three statements are true about the Marketplace? (Choose three.)
What is the correct way to install different engines on the same Ubuntu machine for a Dev/Prod setup?.
An engineer adds a new "Forensics" tab that includes several sections for detailed artifact analysis to the "Malware Incident" layout. However, junior analysts report they cannot see this tab, while senior analysts can.
Which configuration setting is the most likely reason for this discrepancy?.
What is the result of an indicator being marked as expired?.
Which Marketplace content pack will allow sharing of threat intelligence in STIX format?.
Which feature is used to convert event data values into incident fields when an integration fetches an event?.
An automation returned an output called: csvReport.
What filter would be used to check if the automation returned results?
An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:
The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?
What can you use to assign a layout, field, and playbook to an incoming incident?
Where would you look to find a personalized view of your own incidents and tasks?
Which development languages are supported when creating XSOAR automation scripts?
Which two features does XSOAR offer to help recover from a server failure? (Choose two.)
When creating a new tab in the layout, which section cannot be added?
In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?
Which three authentication methods are supported when logging into XSOAR? (Choose three.)
What are two common use cases for conditional tasks? (Choose two.)
What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)
An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?
An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?
What are two primary uses of standard tasks? (Choose two.)
The default expiration method for non-feed indicators is either to never expire or to expire after a specific period of time. How frequently does XSOAR check tor newly expired indicators?
Assuming an incident type configuration runs the associated playbook automatically, which pre-process rule action can preserve matching incidents without triggering the playbook?.
What is the difference between labels and fields?
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critical issues:
• Rate limits being hit on integrated reputation services
• Incidents associated with hundreds of indicators
Given the settings below, what would prevent the issues in this use case?
Incident Type: AD-Analysis –
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user –
Mark results as note: False –
Indicator Extract Mode: Inline –
Quiet Mode: False –
Task 2: ad-disable-account –
Mark results as note: True –
Indicator Extract Mode: None –
Quiet Mode: True –
Task 3: servicenow-update-ticket –
Mark results as note: False –
Indicator Extract Mode: Use System Default
Quiet Mode: False
When developing the playbook, which of the following can be used by a XSOAR Administrator?
Which two options will troubleshoot an integration’s fetch incidents command? (Choose two.)
In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)
Which of the following are valid methods to contribute custom content? (Choose three.)
What is the correct expression to use when filtering only PDF files?
What is an outcome of using sections within a tab when customizing an incident layout?.
An incident field is created having the display name as Source_IP. How can the field be accessed?