Free Palo Alto Networks XSOAR Engineer Exam XSOAR-Engineer Exam Practice Test

Who is permitted to create and submit content to the Marketplace?

• Only users with a valid Github account
• Any user who has signed up through the dev portal
• Any user who has a live.paloaltonetworks.com account
• All users with the correct XSOAR Role and Permissions

Where are incident layouts customized?

• Settings > Object Setup > Incidents > Layouts
• Settings > Integrations > Instance configuration
• Settings > Object Setup > Indicators > Layouts
• Settings > Advanced > Incident Layouts

Which built-in automation/command cab be used to change an incident’s type?

• setIncident
• Set
• GetFieldsByIncidentType
• modifyIncidentFields

Which three types of information are displayed on the incident Quick View? (Choose three.)

• Indicators and relationships
• Timeline information
• Evidence Board
• Context data
• Incident severity

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

• Manually directly from the War Room with the Actions drop-down
• From the Notes section (mark as entry icon)
• Manually from the playbook task (mark as entry icon)
• Automatically from playbook tasks when the option is selected on the Advanced tab
• By running the command !MarkAsEvidence

Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

• Live backup (disaster recovery)
• Distributed database
• Backup data to XSOAR engines
• Local backup

Which two reasons would lead an engineer to create a custom widget? (Choose two.)

• To visualize server configuration keys
• To visualize XSOAR list data
• To visualize complex incident data calculations
• To visualize context data
• To visualize a custom query

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

• -status:closed -category:job type:Phishing created:>="30 days ago"
• status:closed -category:job & type:Phishing created:>="30 days ago"
• -status:closed -category:job & type:Phishing created:<="30 days ago"
• -status:closed -category:job type:Phishing created:="30 days ago"

Which three options can be defined in the layout settings? (Choose three.)

• Set of fields to present
• Permission to view the tab based on ‘Users’
• Permission to view the tab based on ‘Roles’
• Delete built-in tabs including the war room
• Dynamic sections

At what stage during the incident lifecycle is an incident type assigned?

• Pre-processing
• Incident creation
• Classification
• Playbook execution