Palo Alto Networks Certified XSOAR Engineer Practice Exam

What the Palo Alto Networks Certified XSOAR Engineer exam covers

• Planning, Installation, and Maintenance79 questions
• Use Case Planning and Development113 questions
• Playbook Development165 questions
• Incident Interactions and Reporting91 questions
• Threat Intelligence Management101 questions

Free Palo Alto Networks Certified XSOAR Engineer practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 549-question bank.

1. Question 1Planning, Installation, and MaintenanceSelect all that apply

   Northwind Rail runs three Cortex XSOAR 8 SaaS tenants (dev, staging and prod) under one Cortex Gateway account. The Account Admin wants one Manager role whose permissions are maintained in a single place for all three tenants. The prod SOC lead also wants users who hold that role in prod to get the SOC Overview dashboard by default and to work weekly on-call shifts. Which TWO statements describe how the engineer should set this up? (Choose TWO)

   • ACreate the Manager role inside the prod tenant, and it is copied to the dev and staging tenants on save
   • BCreate the Manager role in Cortex Gateway, so the same role and access level is available in every tenantCorrect
   • CAdd the shifts and default dashboards while creating the role in Cortex Gateway, so each tenant inherits them
   • DAdd the default dashboards and the shifts for the Manager role on its Advanced tab inside the prod tenantCorrect
   • EPut the Manager role in a user group created in Cortex Gateway, since tenant groups list only tenant roles
   ✓ Correct answer: B, D

   Cortex Gateway is the central portal for roles, user groups and users across tenants, and any role created there is available for all tenants, which suits a Manager role that must stay identical everywhere. The Advanced tab, which holds default dashboards, preset role queries and shifts, can be reached only when creating or editing a role in the XSOAR tenant, and the documentation states that shift management is not available in Cortex Gateway. A role created in Gateway can still receive these tenant-level settings, so the prod lead's dashboard and shift requirements are added in the prod tenant.

   Why the other options are wrong

   • ARoles created in a tenant are specific to that tenant and exist only at the tenant level, so they are not copied to other tenants.
   • CAdvanced settings such as default dashboards and shifts can be defined only at the tenant level; shift management is not available in Cortex Gateway.
   • EA tenant user group can include a role created in Cortex Gateway; the documented pattern is a Gateway Manager role placed in a user group created in the tenant.
2. Question 2Planning, Installation, and Maintenance

   Laxford Airlines configures a Splunk instance in Cortex XSOAR 8. In the Collect settings the engineer sets Classifier to Splunk-Notables, which routes phishing notables to the Phishing incident type, and also sets the instance's Incident type field to Generic Alert. A phishing notable is fetched. Which incident type does the new incident get?

   • AGeneric Alert, because the instance's Incident type field overrides the classifier's result
   • BGeneric Alert first, then Phishing once the Generic Alert playbook reclassifies the incident
   • CBoth, as one Phishing incident and one linked Generic Alert incident for the same notable
   • DPhishing, because a configured classifier takes precedence over the instance's Incident typeCorrect
   ✓ Correct answer: D

   The Collect settings define how an instance collects, classifies and maps fetched data. The Classifier determines which incident type is created. The Incident type field is used when a classifier does not exist, and if a classifier is specified, it takes precedence when assigning an incident type to the fetched incident. The incident type then determines which playbook runs on it.

   Why the other options are wrong

   • AIf a classifier is specified, it takes precedence over the instance's Incident type field.
   • BThe classifier assigns the type at fetch time, and it takes precedence over the instance's Incident type field.
   • COne fetched event becomes one incident whose type the classifier determines; the Incident type field applies only when no classifier exists.
3. Question 3Use Case Planning and Development

   Pelham Bank adds a Clicked Link tab to its phishing incident layout in Cortex XSOAR 8: ``` | Tab setting | Value | |---------------------|------------------------------------------------| | Display Filter | Clicked Link equals Yes | | Viewing Permissions | Tier2, Incident Response | | Contents | Link Containment Status (mandatory), buttons | ``` Incident 501 has Clicked Link = Yes and is opened by a Tier1 analyst. Incident 502 has Clicked Link = No and is closed by a Tier2 analyst. What applies?

   • AOn 501 the tab is shown to Tier1; on 502 the mandatory field is optional
   • BOn 501 the tab is hidden from Tier1; on 502 the mandatory field is required
   • COn 501 the tab is shown to Tier1; on 502 the mandatory field is required
   • DOn 501 the tab is hidden from Tier1; on 502 the mandatory field is optionalCorrect
   ✓ Correct answer: D

   Viewing Permissions select which roles can view a tab, so Tier1 is not among the roles that see the Clicked Link tab on incident 501. The Display Filter shows the tab only when its filter applies, so on incident 502, where Clicked Link is No, the tab is not shown. The layout page states that if a mandatory field is not shown in the layout, the user is not obliged to complete it. The Tier2 analyst can therefore close 502 without Link Containment Status.

   Why the other options are wrong

   • AViewing Permissions restrict the tab to the selected roles, Tier2 and Incident Response, so a Tier1 analyst does not see it.
   • BOn 502 the Display Filter does not match, so the tab and its mandatory field are not shown, and a mandatory field that is not shown need not be completed.
   • CViewing Permissions hide the tab from Tier1, and a mandatory field that is not shown because of a Display Filter need not be completed.
4. Question 4Use Case Planning and Development

   Torvik Retail installed the Malware incident type from a content pack. The SOC wants the type to use its own Malware - Torvik playbook as the default playbook from now on. The change board adds two conditions: the change must survive future content pack upgrades, and the pack's own Malware type must keep receiving content pack updates. How should the engineer make the change?

   • ADuplicate the Malware type and set the playbook on the duplicateCorrect
   • BDetach the Malware type, edit it, and reattach it after the next update
   • CDetach the Malware type, edit it, and leave it detached from then on
   • DEdit the attached Malware type, since only the playbook field changes
   ✓ Correct answer: A

   Incident types installed from a content pack are attached and not editable. Duplicating the type gives an editable copy, and the original keeps receiving content pack updates, although the duplicate does not. A detached type receives no updates while detached, and any changes made while detached are overwritten by the pack's default values when it is reattached. Duplicating is therefore the documented way to protect the change from upgrades.

   Why the other options are wrong

   • BChanges made while a type is detached are overwritten by the content pack's default values when it is reattached, so the playbook change would be lost.
   • CA detached incident type does not receive content pack updates, which breaks the condition that the pack's Malware type keeps receiving them.
   • DIncident types installed from a content pack are attached by default, which means they are not editable until duplicated or detached.
5. Question 5Playbook Development

   At Larkspur Health, a custom script adds each host it checks to a context list. The hosts never appear in context, although the War Room shows no error. This is the relevant excerpt: ```python for host in hosts: res = execute_command('Set', {'append': 'true', 'key': 'Hunt.Hosts', 'value': host}) demisto.debug('hosts appended') ``` The hosts must be appended to the existing Hunt.Hosts key, not replace it. What change makes the context update take place?

   • ACollect the hosts and send them in one Set call as a single array
   • BUse the key Hunt(val.Hosts == obj.Hosts) as a DT selector key
   • CPass the result of each execute_command call to return_resultsCorrect
   • DSet stringify to true so that each host is saved as a string
   ✓ Correct answer: C

   The Set reference lists this case under known limitations. When Set is called from within another script and append is set to true, the results given by demisto.executeCommand must be returned manually for the context update to take place. Its example calls execute_command('Set', {'append': 'true', ...}) and then return_results(res). The script here keeps the result in res but never returns it, so the appended hosts are never written.

   Why the other options are wrong

   • ASet accepts an array value, but whenever Set is called from another script with append=true the executeCommand result must still be returned for the context update to take place.
   • BA DT selector key is supported with append=true, but it does not remove the need to return the executeCommand result from the calling script.
   • Dstringify only decides whether the argument is saved as a string; the update is still lost when the executeCommand result is not returned.
6. Question 6Playbook Development

   At Sablewood Media, a phishing playbook must branch on whether the domain in a reported URL belongs under the company's own domain, so that mail.sablewood.example is treated as internal while other domains are not. Which built-in filter performs this test?

   • AStringContainsArray, with sablewood.example on the right
   • BIsInCidrRanges, with sablewood.example on the right
   • CIn list (String), with sablewood.example on the right
   • DCheckIfSubdomain, with sablewood.example on the rightCorrect
   ✓ Correct answer: D

   The Other filter category lists CheckIfSubdomain, described as testing whether the value on the left is a subdomain of the value on the right. With the URL's domain on the left and sablewood.example on the right, mail.sablewood.example passes and unrelated domains do not. The other filters in the category, such as IsInCidrRanges, work on IP addresses and CIDR ranges rather than domain names.

   Why the other options are wrong

   • AStringContainsArray tests whether a substring or an array of substrings on the left is within a string array on the right; mail.sablewood.example is not within the array that holds sablewood.example.
   • BIsInCidrRanges tests whether IPv4 addresses on the left fall in comma-delimited CIDR ranges on the right, so it does not compare domain names.
   • CIn list tests whether the string on the left is in the list on the right, so mail.sablewood.example is not matched by the parent domain alone.
7. Question 7Playbook Development

   At Brightwave Media, an engineer's new script calls the ad-get-user and ad-disable-account commands, and the team wants these command dependencies recorded on the script. Where can the engineer declare them?

   • AIn the Depends on commands settings of the script, or in the script's YAML fileCorrect
   • BIn the Script Helper list, which records each command inserted into the code
   • CIn the script's Arguments section, adding one argument for each command used
   • DIn the Outputs section, with one context path for each command the script calls
   ✓ Correct answer: A

   The create a script page has a Depends on commands section. It states that you can set the commands the script depends on directly from these settings. It adds that you still have the option to set the dependencies in the script YAML file. Either place records the dependency on the two Active Directory commands.

   Why the other options are wrong

   • BThe Script Helper provides an alphabetical list of available commands and scripts to use while coding; it is not where dependencies are declared.
   • CArguments define the inputs a user or task passes to the script, not the commands the script depends on.
   • DOutputs define context paths, descriptions and types for the data the script returns, not its command dependencies.
8. Question 8Incident Interactions and ReportingSelect all that apply

   At Lindqvist Retail, an analyst working an incident in the CLI needs to add a War Room entry as evidence with the AddEvidence command and then notify the Tier 2 lead, user jpark, to review it. Which TWO inputs are correct? (Choose TWO)

   • AStart the evidence step with / as in /AddEvidence entryIDs=<id>
   • BStart the evidence step with ! as in !AddEvidence entryIDs=<id>Correct
   • CStart the notification with ! followed by the lead's user name
   • DStart the notification with @ followed by the lead's user nameCorrect
   • EStart the notification with / followed by the lead's user name
   ✓ Correct answer: B, D

   The CLI page lists three prefixes. ! runs integration commands, scripts and built-in commands, and names adding evidence and assigning an analyst as examples. / runs system commands and operations such as adding notes and closing an investigation. @ sends notifications to administrators, teams and analysts by tagging users, and the evidence handling page shows the !AddEvidence entryIDs form.

   Why the other options are wrong

   • AThe / prefix runs system commands and operations such as adding notes and closing an investigation; adding evidence is a built-in command run with !.
   • C! runs integration commands, scripts and built-in commands; tagging a user to send a notification uses @.
   • E/ runs system commands and operations; sending notifications by tagging users uses @.
9. Question 9Incident Interactions and Reporting

   At Norvale Bank, an engineer creates a custom incident field, Business Unit, and wants a Cortex XSOAR 8 bar chart widget of open incidents grouped by that field. What must be true of the field for it to be used in the widget's Group by setting?

   • AMake data available for search is selected on the fieldCorrect
   • BThe field is placed in a section of the incident layout
   • CThe field is created with the Long text field type
   • DShow 'Others' is selected in the Group by edit settings
   ✓ Correct answer: A

   In the widget builder's Axis and grouping section, the Group by dropdown lists the fields to group on. The page states that to add a custom field, you must ensure Make data available for search is checked when editing or creating the field. That indexing option determines whether the field's values are available when searching. Placing the field in a layout or changing grouping display options does not make its values searchable.

   Why the other options are wrong

   • BLayout sections control where the field is shown to analysts; the documented requirement for grouping a widget by a custom field is the Make data available for search option.
   • CLong text fields can't be sorted or used in graphical dashboard widgets, so that type works against the goal.
   • DShow 'Others' gathers the results that fall outside the top values into one group; it doesn't make a custom field available for grouping.
10. Question 10Threat Intelligence Management

    At Corvane Bank, a Cortex XSOAR 8 engineer wants a customized version of the File indicator layout that ships with a content pack, while the original layout keeps receiving content pack updates. The engineer duplicates the content pack layout, edits the copy and saves it. Analysts who open File indicators still see the original layout. What should the engineer do next?

    • ADetach the original layout so File indicators fall back to the copy
    • BEdit the File indicator type and select the copy in its Layout fieldCorrect
    • CContribute the copy to Marketplace so its pack assigns it to File
    • DGrant analyst roles Viewing Permissions on each tab of the copy
    ✓ Correct answer: B

    The indicator layout page notes that if you duplicate a content pack layout, you need to update the indicator type to add the new layout. The layout is assigned by editing the type under Object Setup, Indicators, Types and choosing the customized layout in the Layout field. Duplicating keeps the original attached, so it continues to receive content pack updates, while the copy carries the changes. Until the type references the copy, File indicators keep showing the layout the type already names.

    Why the other options are wrong

    • ADetaching only stops the original layout from receiving content pack updates and makes it editable; the File type still uses whichever layout its Layout field names, and the bank wants the original to keep updating.
    • CContribute to Marketplace validates and submits the layout for review or download; it doesn't assign the layout to an indicator type in this tenant.
    • DViewing Permissions control which roles can see a tab inside a layout; they don't make the indicator type use a different layout.

Who this Palo Alto Networks Certified XSOAR Engineer practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified XSOAR Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified XSOAR Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified XSOAR Engineer exam.

Related Palo Alto resources

• Palo Alto Networks Certified XSOAR Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• SSE-Engineer practice examRelated
• XDR-Analyst practice examRelated
• XDR-Engineer practice examRelated

Palo Alto Networks Certified XSOAR Engineer practice exam FAQ