Free XSOAR-Engineer Braindumps Download Updated on Jun 06, 2026 with 206 Questions
Palo Alto Networks XSOAR-Engineer Exam Practice Test Questions
NEW QUESTION # 103
Newly created subplaybooks do not have any inputs, or outputs. What is necessary to make them functional?
(Choose two.)
- A. Define input key in the subplaybook task. Map context values to pull from parent playbook.
- B. Map inputs and outputs to the parent playbook and the subplaybook will use the same values.
- C. The output of the previous task automatically becomes the input of the subplaybook.
- D. Open the subplaybook and add inputs or outputs in the Playbook triggered task.
Answer: A,D
NEW QUESTION # 104
Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)
- A. Add an engine
- B. Add a live backup server (disaster recovery)
- C. Add an indexing server
- D. Add a distributed database server
Answer: B,D
NEW QUESTION # 105
An analyst wants to run a script to remove usernames from an incident before the incident becomes active in XSOAR. How can this be achieved?
- A. Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.
- B. Run an automation script in the Playground to remove usernames from the incident.
- C. Create a playbook task to remove the usernames from the incident.
- D. Run an automation script on the XSOAR server to remove usernames from the incident.
Answer: A
Explanation:
Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR-Administrator- Guide/Incident-Management
NEW QUESTION # 106
What can be used as integration parameters?
- A. Token, query, playbook
- B. URL, certificate, image
- C. URL, API key, port
- D. User-password, csv file, query
Answer: C
NEW QUESTION # 107
What is the primary effect on a new file hash when it is added to the indicator exclusion list?.
- A. It is not extracted, enriched, or given a new verdict.
- B. It is excluded from intelligence feeds that have a reliability score lower than "B - Usually reliable.".
- C. It is processed normally by enrichment automations, but the verdict is set to "benign.".
- D. It is extracted and stored, but an "exclusion" tag is added, requiring manual review before it can affect any incidents.
Answer: A
Explanation:
The Indicator Exclusion List feature in XSOAR is designed to prevent certain IOCs (file hashes, IPs, domains, etc.) from being processed by the platform. The Admin Guide explains that once an indicator is added to the exclusion list, XSOARdoes not extract, enrich, score, or apply verdictsto that indicator during ingestion or field-change extraction. This ensures that benign internal hashes, test indicators, or noisy artifacts do not trigger incidents, enrichments, or correlation rules.
Option B does not reflect platform behavior-XSOAR does not create exclusion tags requiring manual review; instead, itcompletely bypasses extraction and enrichment. Option C is incorrect because excluded indicators do not undergo enrichment or verdict assignment at all. Option D incorrectly suggests that exclusion depends on feed reliability; the exclusion list applies globally and unconditionally.
Therefore, the correct interpretation per the documentation is thatexcluded indicators are never extracted or processed, aligning precisely with optionA.
NEW QUESTION # 108
A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named
"BlockedSenders_Email."
Which built-in command should be used within the playbook to add this email address to the specified list?.
- A. !createListItem listName="BlockedSenders_Email" itemValue="<email_address>".
- B. !appendToListContext listPath="BlockedSenders Email" data="<email_address>".
- C. !addToList listName="BlockedSenders_Email" listData="<email_address>".
- D. !setIncident list.BlockedSenders_Emai1="<email_address>".
Answer: C
Explanation:
XSOAR's built-inLists Servicesupports operations such as creating, updating, and appending items to lists using automation commands. The correct command for appending a value to an existing list is!addToList, which inserts the new string (in this case an email address) into the list array stored within the XSOAR Lists infrastructure.
The Admin Guide describes!addToListas the intended mechanism to add new elements to a named list while automatically handling JSON structure and avoiding duplication errors.
Option B, !appendToListContext, modifiescontext data, not persistent platform lists-therefore it will not update the BlockedSenders list. Option C misuses !setIncident, which updates incident fields only, not system lists. Option D, !createListItem, is used when an integration or automation script exposes a "create item" action, not for native XSOAR lists.
Thus, the correct and documented method of adding an email value to a persistent XSOAR list is!addToList, making optionAthe accurate choice.
NEW QUESTION # 109
Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882.
This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.
After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)
- A. Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:-Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information-Mark the ticket severity as Urgent
- B. Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual - Exit on yes - left:1, right 1) and perform the following tasks:-Active Directory User Enrichment based on the computerName-Create the ServiceNow Record by adding the enrichment information-Mark the ticket severity as Urgent
- C. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:-Active Directory User Enrichment based on the computerName-Create the ServiceNow Record by adding the enrichment information-Mark the ticket severity as Urgent
- D. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:-Increase the iterator value by one each time-Active Directory User Enrichment based on the computerName-Create the ServiceNow Record by adding the enrichment information-Mark the ticket severity as Urgent
Answer: A,D
NEW QUESTION # 110
In a Dev/Prod deployment model, what is available only in the development tenant?.
- A. "Export all custom content" feature.
- B. Custom integration instances.
- C. Content Repository page.
- D. Marketplace.
Answer: A
Explanation:
In Cortex XSOAR's documented Dev/Prod deployment model, thedevelopment tenantis designed to be the workspace where engineers create, modify, test, and validate content before promoting it into production. As part of this workflow, the development tenant includes the"Export all custom content"feature, which generates a structured content bundle containing custom playbooks, integrations, fields, layouts, lists, and other artifacts. This bundle is then imported into the production tenant to ensure controlled, versioned, and tested promotion of content.
The Admin Guide highlights that this export capability isrestricted to the development environmentto preserve the integrity and stability of the production tenant. Production systems are intentionally limited, allowing only the import (not export) of custom content to prevent accidental overwriting, drift, or unintended modifications.
Marketplace access (A) exists in both tenants. Custom integration instances (C) can be created in either tenant. The Content Repository page (B) is also available across both environments.
Therefore, the only feature exclusive to the development tenant isD: "Export all custom content."This ensures a safe, repeatable Dev#Prod promotion model aligned with enterprise change-control requirements.
NEW QUESTION # 111
Which two reasons would lead an engineer to create a custom widget? (Choose two.)
- A. To visualize context data
- B. To visualize server configuration keys
- C. To visualize complex incident data calculations
- D. To visualize a custom query
- E. To visualize XSOAR list data
Answer: A,D
Explanation:
Reference: https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xsoar/6-0/ cortex-xsoar-admin/cortex-xsoar-admin.pdf/cortex-xsoar-admin.pdf
NEW QUESTION # 112
Which of the following are valid methods to contribute custom content? (Choose three.)
- A. Using the marketplace interface to upload the content
- B. A Github pull request on the public XSOAR Content Repository
- C. Using the content submission tool on live.paloaltonetworks.com
- D. Submit content directly through feature requests
- E. Private GitHub repository submission for premium content
Answer: A,B,C
NEW QUESTION # 113
Within the playbook editor, which function allows a user to associate a task output to an incident field?.
- A. Extend context.
- B. Mapping.
- C. Inputs.
- D. Classification.
Answer: A
Explanation:
The XSOAR Playbook Editor allows engineers to manipulate and transform context data dynamically.
According to the XSOAR Admin and Playbook Development Guides,"Extend Context"is the dedicated mechanism that enables a task to save output values into new or existing context keys, including keys that correspond to incident fields. By defining a key under the "Extend Context" section, the playbook task can map specific outputs-such as JSON fields, strings, arrays, or nested objects-to a structured location within the incident context. These keys can then be used to populate incident fields through further playbook tasks, field mappings, or automated incident field updates.
Classification (option A) applies only during ingestion and cannot assign task outputs to incident fields. Inputs (option B) define what data a task receives, not how it is stored afterward. Mapping (option D) belongs to the ingestion pipeline and determines how event fields become incident fields during creation, not during playbook execution.
Therefore,Extend Contextis the correct feature that allows a task to associate its output with incident fields, making optionCthe correct answer based on documentation.
NEW QUESTION # 114
When the verdict of an indicator is set manually, which source reliability does it receive?.
- A. A+++.
- B. Undefined.
- C. A.
- D. F - reliability cannot be found.
Answer: B
Explanation:
When an analyst manually sets an indicator's verdict, XSOAR records the verdict with a source named
"Manual", and assigns it a reliability of Undefined.
This is explicitly documented under Indicator Verdict + Reliability behavior when a manual override is applied.
NEW QUESTION # 115
When is the post-processing script executed in XSOAR?
- A. Just after the pre-processing is executed
- B. Just after the playbook is executed
- C. Just after the Close Incident button is clicked
- D. Just after the incident is created
Answer: B
NEW QUESTION # 116
Which configuration is a valid distributed database (DB) implementation?
- A. 2 main DBs, 1 application server, 2 node servers
- B. 1 main DB, 1 application server, 3 node servers
- C. 2 application servers, 1 main DB, 1 node server
- D. 1 application server, 2 main DBs, 1 node server
Answer: B
NEW QUESTION # 117
Which two actions will group similar incidents that share a common root cause or represent different aspects of a larger problem? (Choose two.).
- A. Merge Incidents.
- B. Join Incidents.
- C. Add Child Incidents.
- D. Relate Incidents.
Answer: B,D
Explanation:
The XSOAR Incident Relationships model provides multiple ways to connect related incidents for correlation and hierarchical investigation. The Admin Guide details howRelate Incidentscreates a logical link between two or more incidents, identifying them as connected without altering their internal data. This is commonly used when incidents share a common threat, indicator, or root cause.
Join Incidentsallows analysts to group multiple incidents under a single parent investigation while keeping them technically separate. Joined incidents appear together in correlation views and analytics dashboards, enabling SOC teams to assess broader attack patterns. Joining does not merge content or overwrite fields; it simply binds multiple incidents under a shared investigative umbrella.
"Add Child Incidents" (option B) is used for parent-child hierarchical workflows, not grouping related violations. "Merge Incidents" (option D) consolidates multiple incidents into one and deletes the originals, which is not the intended function for grouping related but distinct events.
NEW QUESTION # 118
An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.
Which command will accomplish this?
- A. run 'ad-delete-user' command with 'user-dn' arg and using-brand="Active Directory Query v2"
- B. run 'ad-delete-user' command with 'user-dn' arg and raw-response=true
- C. run 'ad-delete-user' command with 'user-dn' arg and ignore-outputs=true
- D. run 'ad-delete-user' command with 'user-dn' arg and using="Active DirectoryQuery v2_instance_1"
Answer: D
NEW QUESTION # 119
An engineer's organization system is registered in the following manner: <SiteName-SystemID- Username>.
The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?
- A. Create a custom indicator field named 'username' and link it to the internal system indicator
- B. Change the reputation command for the internal system indicator type
- C. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning
- D. Create a new indicator type of the internal username and set a formatting script to extract only theusername
Answer: D
Explanation:
Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat-intel-management- guide/manage-indicators/understand-indicators/indicator-types/indicator-type-profile
NEW QUESTION # 120
......
Updated Verified XSOAR-Engineer dumps Q&As - Pass Guarantee or Full Refund: https://actualtest.updatedumps.com/Palo-Alto-Networks/XSOAR-Engineer-updated-exam-dumps.html