Palo Alto Networks XSOAR Engineer (XSOAR-Engineer) Free Practice Test

Question 1

Select the correct incident life cycle on XSOAR.

A. Planning > Incident Ingestion > Pre-processing > Mapping and Classification > Incident Creation > Playbook runs > Post-processing

B. Planning > Incident Ingestion > Incident Creation > Mapping and Classification > Pre-processing > Playbook runs > Post-processing

C. Planning > Incident Ingestion > Pre-processing > Incident Creation > Mapping and Classification > Playbook runs > Post-processing

D. Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

Correct Answer: D

Question 2

Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

A. execute !<integration_instance_name>-fetch

B. Create a one task playbook with a fetch-incident command

C. execute !<integration_name>-fetch

D. In the instance settings, enable the fetch incidents parameter and wait for one minute

Correct Answer: A,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which Marketplace content pack will allow sharing of threat intelligence in STIX format?.

A. Generic Export Indicators Service.

B. MISP Server.

C. TAXII Server.

D. External dynamic list.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

When the "Only allow these dashboards" checkbox is selected for a user role, what is the primary effect on users assigned this role?.

A. They will be restricted to viewing only the specified default dashboards and cannot make any modifications.

B. They can only view specified dashboards and make minor modifications.

C. They are prompted to select their preferred dashboards upon login and can only modify these chosen dashboards.

D. They will automatically have all dashboards that are shared with them added to their view.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

What will happen if a playbook debugger is left running for more than 24 hours?

A. The session will be running till stopped manually by administrator.

B. By default, every 24 hours, the system closes any debugger sessions that have been open for more than
180 minutes.

C. The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

D. By default, the system closes automatically any debugger session that have been open 180 minutes.

Correct Answer: D

Question 6

What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

A. Inputs are data pieces that are present in the playbook

B. Inputs are the data fields parsed by the Classifier

C. Outputs can be derived from the result of a task or command

D. Outputs are used as incident trigger for playbook

E. Inputs are data pieces that are present in the task

Correct Answer: A,B,C

Question 7

A breakpoint is added to a saved playbook to ensure that it pauses before running the task "ad-delete-user." However, it is later discovered that an Active Directory account was deleted by this playbook, and the playbook did not pause at the breakpoint.
What is the cause of this issue?.

A. The playbook was not set to "quiet mode.".

B. The playbook does not stop at the breakpoint when run from an incident.

C. The task was not configured to override input.

D. The task was not set to "skip.".

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Based on the image below, which key from the context points to the string GOGL?.

A. Whois.IP.[0].network.name.

B. Whois.IP.entities.

C. Whois.IP.asn_registry.entities.

D. Whois.IP.network.name.

Correct Answer: A

Question 9

Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

A. reputationScript

B. reputation

C. enrich

D. reputation-script

Correct Answer: A

Question 10

Which two features can be used together to automatically execute a search on a remote SIEM for extracted IP Indicators? (Choose two.).

A. Reputation script.

B. Enhancement script.

C. Feed-triggered job.

D. Integration command.

Correct Answer: C,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 11

What is the function of timer SLA fields in Cortex XSOAR?

A. To run a script that executes on SLA assignment

B. To automatically alert the analyst on SLA breach

C. To track SLA breaches per playbook

D. To count the time between one or more tasks

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

Match the operations with the appropriate context.

Correct Answer:

Question 13

Based on the integration and classifier configuration images below,

which incident type will be created for incidents ingested using this integration when the incoming "type" field is set to "url allowed"?.

A. URL Allowed.

B. XSOAR ENGINEER- URL Alerts.

C. Case.

D. Access.

Correct Answer: B

Question 14

Which task type would be used to verify/check that an integration was enabled?

A. Data Collection task

B. Standard task

C. Conditional task

D. Section Header task

Correct Answer: A

Welcome to TestSimulate

Palo Alto Networks XSOAR Engineer (XSOAR-Engineer) Free Practice Test