Palo Alto Networks XSOAR-Engineer Exam Questions Instant Access

Question 1

An incident field is created having the display name as Source_IP. How can the field be accessed?

A${incident.sourceip}

B${incident.Source_IP}

C${incident.srcip}

D${incident.Source IP}

Answer : C

Question 2

Which three options can be defined in the layout settings? (Choose three.)

ASet of fields to present

BPermission to view the tab based on 'Users'

CPermission to view the tab based on 'Roles'

DDelete built-in tabs including the war room

EDynamic sections

Answer : A, C, E

Question 3

An engineer wants to save a command output to a custom context key using "Extend Context" in a playbook task. To do this, the engineer needs the full context path of the command's output.

Which common CLI argument or flag can help identify this full output and its correct path?.

Adebug-mode.

Bauto extract.

Craw-response.

Dextend-parent-context.

Answer : C

When running integration commands in Cortex XSOAR, the system automatically structures outputs into context keys defined in the integration YAML. However, many commands return additional data not mapped by default. To find the complete JSON output---including unmapped data---XSOAR provides the raw-response=true flag.

According to the Admin and Integration Development Guides, setting raw-response=true displays the full unprocessed output exactly as returned by the integration. This is essential when configuring ''Extend Context,'' because the engineer must reference the exact JSON path to extract specific values into a new context key.

debug-mode enables verbose logging but does not display full JSON output. auto extract triggers automatic IOC extraction, unrelated to examining context paths. extend-parent-context modifies output behavior inside playbooks but does not reveal underlying JSON structure.

Therefore, only raw-response reliably exposes the complete output structure, enabling accurate mapping when using ''Extend Context.''

Question 4

Which of the following is a feature of XSOAR automations?

Acan run on multiple docker containers

Bcan be set to run on a scheduled basis in the automation settings

Ccan be password protected

Dcan be written in C++

Answer : B

Question 5

An engineer adds a new "Forensics" tab that includes several sections for detailed artifact analysis to the "Malware Incident" layout. However, junior analysts report they cannot see this tab, while senior analysts can.

Which configuration setting is the most likely reason for this discrepancy?.

AThe underlying fields within the tab sections was incorrectly mapped.

BThe tab was not added to the junior analyst role group.

CThe tab was marked as read-only in the layout configuration for the junior analyst roles.

DA display filter was applied to the tab in the layout editor.

Answer : B

According to the Cortex XSOAR Admin Guide, visibility of layout tabs is controlled by role-based access permissions (RBAC). When customizing layouts, administrators can assign tabs, fields, and components to specific user roles. If the ''Forensics'' tab appears for senior analysts but not junior analysts, this indicates that the tab has been assigned only to certain roles through the ''Roles'' field in the layout editor.

XSOAR does not hide layout tabs due to incorrect field mappings (option A). If a field is unmapped, it simply appears empty, not invisible. Likewise, marking a tab as ''read-only'' (option C) still makes it visible; it only restricts editing. Display filters (option D) apply to list widgets, dashboards, and incidents---not layout tab visibility.

The documentation clearly states that a tab will not appear to a user unless their assigned role is included in the tab's role permissions. Therefore, junior analysts cannot view the tab because the tab was not assigned to their role, making option B the correct explanation based on XSOAR's RBAC-controlled layout behavior.

Question 6

A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named "BlockedSenders_Email."

Which built-in command should be used within the playbook to add this email address to the specified list?.

A!addToList listName='BlockedSenders_Email' listData='<email_address>'.

B!appendToListContext listPath='BlockedSenders Email' data='<email_address>'.

C!setIncident list.BlockedSenders_Emai1='<email_address>'.

D!createListItem listName='BlockedSenders_Email' itemValue='<email_address>'.

Answer : A

XSOAR's built-in Lists Service supports operations such as creating, updating, and appending items to lists using automation commands. The correct command for appending a value to an existing list is !addToList, which inserts the new string (in this case an email address) into the list array stored within the XSOAR Lists infrastructure.

The Admin Guide describes !addToList as the intended mechanism to add new elements to a named list while automatically handling JSON structure and avoiding duplication errors.

Option B, !appendToListContext, modifies context data, not persistent platform lists---therefore it will not update the BlockedSenders list. Option C misuses !setIncident, which updates incident fields only, not system lists. Option D, !createListItem, is used when an integration or automation script exposes a ''create item'' action, not for native XSOAR lists.

Thus, the correct and documented method of adding an email value to a persistent XSOAR list is !addToList, making option A the accurate choice.

Question 7

What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

ADownload content for offline installation

BUninstall content pack

CUpdate to x version

DRevert to x version

Answer : C, D

Palo Alto Networks XSOAR Engineer XSOAR-Engineer Exam Questions