PALO ALTO CORTEX XSOAR EXAM 2025 WITH
COMPLETE QUESTIONS AND ANSWERS
Which role is associated with responsibility for backups and disaster-recovery configuration?
A. SOAR engineer
B. IT administrator
C. SOC/CERT analyst
D. SOC/CERT manager -CORRECT ANSWER->>B
What are the three key feature sets of the Cortex XSOAR platform? (Choose three.)
A. collaboration environment
B. workflow automation
C. security ticketing
D. integrated development environment -CORRECT ANSWER->>ABC
Which element of the Cortex XSOAR solution architecture supports the isolation of the development of
new integrations, automations, and playbooks?
A. Dev-prod
B. Hybrid cloud
C. Cortex XSOAR Engine
D. multi-tenant mode -CORRECT ANSWER->>A
What is a primary focus of the role of an IT administrator?
A. configure and enable all anticipated Cortex XSOAR integrations
B. configure playbooks and associate them with incident types
C. deploy Cortex XSOAR Servers and Engines with baseline operational functionality
D. map ingested data to data fields, configure incident page layouts, and troubleshoot pre-processing -
CORRECT ANSWER->>C
How many simultaneous Engine Pools does Cortex XSOAR 5.0 support? A. 1
B. 2
C. 4
D. 32 -CORRECT ANSWER->>A
You can see a graphical depiction of an incident's playbook in the War Room. (True or False) -CORRECT
ANSWER->>F
Tasks are building blocks for playbooks. (True or False) -CORRECT ANSWER->>T
A Cortex XSOAR Engine must be configured to accept connections from the parent server, if the Engine
is deployed in a protected enclave. (True or False) -CORRECT ANSWER->>F
, Which type of deployment involves the use of one or more Cortex XSOAR engines?
A. hosted cloud
B. hybrid cloud
C. private cloud
D. protective enclave -CORRECT ANSWER->>B
In which type of deployment does Palo Alto Networks take responsibility for upgrades to the Cortex
XSOAR server?
A. hosted cloud
B. private cloud
C. protected enclave
D. hybrid private cloud and on-premises -CORRECT ANSWER->>A
For all production-level deployments, which statement about SSD drives is true?
A. They are optional for cloud deployments.
B. They should be used with Cortex XSOAR only for testing.
C. If the minimum transfer rate is met, HDD-based arrays and SANs will deliver the same performance.
D. Use of them is a minimum requirement. -CORRECT ANSWER->>D
After the server installer script completes, which is a primary indicator that the login page for the web
console should be accessible soon?
A. Docker shows that the container for Python support is running.
B. A message is displayed in the terminal window that lists the URLs available to reach the console and
that requests you to log in.
C. The "docker" daemon appears in the list of running processes after running the "ps" or the "top"
command.
D. The second reboot after installation has completed with no errors. -CORRECT ANSWER->>A
How can you apply the Cortex XSOAR server license?
A. Copy it to the /etc./demisto/license directory before you run the installer.
B. Load it on the target server and include the pathname in the --license argument.
C. Drag and drop it onto the dialog box that appears after your first logon to the web console.
D. Apply the license-key string value with the --license argument with use of the binary installer file, after
use of the installer shell script is complete. -CORRECT ANSWER->>C
Which option do you use with the installer script to pass subsequent arguments to the binary installer?
A. -p
B. -pipe
C. -- <-argument>
D. --run <-argument> -CORRECT ANSWER->>C
You can run Python script directly from the CLI of the web console. (True or False) -CORRECT
ANSWER->>T
You can check Docker status without access to the shell of the operating system. (True or False) -
COMPLETE QUESTIONS AND ANSWERS
Which role is associated with responsibility for backups and disaster-recovery configuration?
A. SOAR engineer
B. IT administrator
C. SOC/CERT analyst
D. SOC/CERT manager -CORRECT ANSWER->>B
What are the three key feature sets of the Cortex XSOAR platform? (Choose three.)
A. collaboration environment
B. workflow automation
C. security ticketing
D. integrated development environment -CORRECT ANSWER->>ABC
Which element of the Cortex XSOAR solution architecture supports the isolation of the development of
new integrations, automations, and playbooks?
A. Dev-prod
B. Hybrid cloud
C. Cortex XSOAR Engine
D. multi-tenant mode -CORRECT ANSWER->>A
What is a primary focus of the role of an IT administrator?
A. configure and enable all anticipated Cortex XSOAR integrations
B. configure playbooks and associate them with incident types
C. deploy Cortex XSOAR Servers and Engines with baseline operational functionality
D. map ingested data to data fields, configure incident page layouts, and troubleshoot pre-processing -
CORRECT ANSWER->>C
How many simultaneous Engine Pools does Cortex XSOAR 5.0 support? A. 1
B. 2
C. 4
D. 32 -CORRECT ANSWER->>A
You can see a graphical depiction of an incident's playbook in the War Room. (True or False) -CORRECT
ANSWER->>F
Tasks are building blocks for playbooks. (True or False) -CORRECT ANSWER->>T
A Cortex XSOAR Engine must be configured to accept connections from the parent server, if the Engine
is deployed in a protected enclave. (True or False) -CORRECT ANSWER->>F
, Which type of deployment involves the use of one or more Cortex XSOAR engines?
A. hosted cloud
B. hybrid cloud
C. private cloud
D. protective enclave -CORRECT ANSWER->>B
In which type of deployment does Palo Alto Networks take responsibility for upgrades to the Cortex
XSOAR server?
A. hosted cloud
B. private cloud
C. protected enclave
D. hybrid private cloud and on-premises -CORRECT ANSWER->>A
For all production-level deployments, which statement about SSD drives is true?
A. They are optional for cloud deployments.
B. They should be used with Cortex XSOAR only for testing.
C. If the minimum transfer rate is met, HDD-based arrays and SANs will deliver the same performance.
D. Use of them is a minimum requirement. -CORRECT ANSWER->>D
After the server installer script completes, which is a primary indicator that the login page for the web
console should be accessible soon?
A. Docker shows that the container for Python support is running.
B. A message is displayed in the terminal window that lists the URLs available to reach the console and
that requests you to log in.
C. The "docker" daemon appears in the list of running processes after running the "ps" or the "top"
command.
D. The second reboot after installation has completed with no errors. -CORRECT ANSWER->>A
How can you apply the Cortex XSOAR server license?
A. Copy it to the /etc./demisto/license directory before you run the installer.
B. Load it on the target server and include the pathname in the --license argument.
C. Drag and drop it onto the dialog box that appears after your first logon to the web console.
D. Apply the license-key string value with the --license argument with use of the binary installer file, after
use of the installer shell script is complete. -CORRECT ANSWER->>C
Which option do you use with the installer script to pass subsequent arguments to the binary installer?
A. -p
B. -pipe
C. -- <-argument>
D. --run <-argument> -CORRECT ANSWER->>C
You can run Python script directly from the CLI of the web console. (True or False) -CORRECT
ANSWER->>T
You can check Docker status without access to the shell of the operating system. (True or False) -
