Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Paloalto Networks
Security Operations
XSOAR-Engineer
Palo Alto Networks XSOAR Engineer Questions and Answers

Pass the Paloalto Networks Security Operations XSOAR-Engineer Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam XSOAR-Engineer Premium Access

View all detail and faqs for the XSOAR-Engineer exam

Go to Exam

510 Students Passed

93% Average Score

92% Same Questions

Viewing page 6 out of 7 pages

Viewing questions 51-60 out of questions

Questions # 51:

In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

Options:

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows with no more than 10 loops

In repetitive processes that requires sub-playbook re-execution

Answer

A, B

Questions # 52:

Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

Options:

Add a distributed database server

Add an indexing server

Add a live backup server (disaster recovery)

Add an engine

Answer

A, C

Questions # 53:

In which two options can an automation script be executed? (Choose two.)

Options:

Engine

Integration

War room

Playbook

Answer

C, D

Explanation

[Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/playbooks/ automations.html, , ]

Questions # 54:

What will happen if a playbook debugger is left running for more than 24 hours?

Options:

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

The session will be running till stopped manually by administrator.

By default, the system closes automatically any debugger session that have been open 180 minutes.

Answer

Questions # 55:

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

Which command will accomplish this?

Options:

run ‘ad-delete-user’ command with ‘user-dn’ arg and using-brand=“Active Directory Query v2”

run ‘ad-delete-user’ command with ‘user-dn’ arg and raw-response=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and ignore-outputs=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and using=“Active DirectoryQuery v2_instance_1”

Answer

Questions # 56:

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:

Question # 56

The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

Options:

XSOAR D2 Agents, to send the required emails.

An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

Another XSOAR server that uses the same license as their primary XSOAR server.

A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

Answer

Questions # 57:

In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?

Options:

Cron job

Time triggered job

Feed triggered job

REST API job

Answer

Explanation

[Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Create-Indicator-Extract-Rules-for-a-Playbook-Task, , ]

Questions # 58:

Which two behaviors occur while an incident is closed? (Choose two.).

Options:

Playbook is marked as complete.

Commands cannot be executed in the War Room.

Timers can no longer run.

Running timers are in a paused state.

Answer

A, C

Explanation

The XSOAR Timers/SLA documentation states that when an incident reaches the Closed state, all timers automatically stop and cannot continue unless manually reset. Timers do not pause — they terminate.

Additionally, when an incident is closed, its associated playbook completes, because closure marks the end of the investigation lifecycle.

Questions # 59:

Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

Options:

Run Command, Export, and Close and Delete for all selected incidents regardless of their status

Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

Run Command for all selected incidents having Active status

Export incidents as JSON and change incident status

Answer

A, B

Questions # 60:

How long is the trial period for paid content packs?

Options:

30 days

14 days

7 days

60 days

Answer

Explanation

[Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/marketplace/ marketplace-subscriptions.html, , ]

Viewing page 6 out of 7 pages

Viewing questions 51-60 out of questions

Modal title

Registered Required

In order to participate in the comments you need to be logged-in.
You can sign-up or login (it's free).

TOP CODES

Top selling exam codes in the certification world, popular, in demand and updated to help you pass on the first try.

2V0-11.25

ADM-201

Agentforce-Specialist

CMMC-CCP

Data-Cloud-Consultant

PDI

PSE-Strata-Pro-24

Secure-Software-Design

Sharing-and-Visibility-Architect

Workday-Pro-Integrations

ZDTA