XSOAR-Engineer Exam Questions and Answers

QUESTION: 9

An engineer notices that playbooks only start once the user clicks the `investigate' button and he/she would like the playbook to start automatically.

How can this be implemented?

Add the playbook to the integration's settings
Select `Run playbook automatically' from the incident type settings
Add the !startinvestigation automation to the beginning of the playbook
Select `Run playbook automatically' from the integration settings

Answer(s): B

Reveal Solution Next Question

QUESTION: 10

Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

The 'Fetches Incidents' option may not have been enabled
There are no new events from the external service
The first fetch should be manually triggered to start the fetching process
It can take up to 1-hour before incidents are initially fetched

Answer(s): A,B

Reveal Solution Next Question

QUESTION: 11

Which two capabilities do Automation script settings include? (Choose two.)

Define `parameters'
Correlate to incident types
Define `outputs'
Set password protection

Answer(s): C,D

Reveal Solution Next Question

QUESTION: 12

DRAG DROP (Drag and Drop is not supported)

Match the appropriate action to the layout type.

See Explanation for the Answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 13

What is a primary use case of data collection tasks?

To allow multi-QUESTIO N NO: surveys without authentication restrictions
To automate tasks such as parsing a file or enriching indicators
To generate new widgets for a dashboard
To determine different paths in a playbook

Answer(s): A

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/playbook- tasks/communication-tasks/create-a-data-collection-task.html

Reveal Solution Next Question

QUESTION: 14

In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

The audit log
The log bundle
The source code for an integration
The error message returned directly below the button
The playground war room

Answer(s): B,C,D

Reveal Solution Next Question

QUESTION: 15

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

Use a field of Number to count the number of seconds elapsed between two tasks
After the playbook has run, calculate the total time taken and set the timer field with this value
To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer
From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Answer(s): C,D

Reveal Solution Next Question

QUESTION: 16

How long is the trial period for paid content packs?

30 days
14 days
7 days
60 days

Answer(s): A

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/marketplace/ marketplace-subscriptions.html

Reveal Solution Next Question

Palo Alto Networks XSOAR-Engineer Exam (page: 2) Palo Alto Networks XSOAR Engineer Updated on: 12-Feb-2026

QUESTION: 9

QUESTION: 10

QUESTION: 11

QUESTION: 12

Explanation:

QUESTION: 13

Reference:

QUESTION: 14

QUESTION: 15

QUESTION: 16

Reference:

Palo Alto Networks XSOAR-Engineer Exam (page: 2)
Palo Alto Networks XSOAR Engineer
Updated on: 12-Feb-2026