Palo Alto Networks XSOAR Engineer - XSOAR-Engineer Exam Questions [2026]

QUESTION NO: 1
Match the action with the most appropriate playbook task type.

Correct Answer:

Explanation:

https://www.jaacostan.com/2021/02/palo-alto-cortex-xsoar-playbook-icons.html

QUESTION NO: 2
Which set of trigger options is available to start a job when a new instance is created?.

A. "Cron View" and "Human View" B. "Mapping" and "Classification" C. "Script Start" and "CLI" D. "Time" and "By delta in feed"

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
A playbook task generates a report as HTML in the context data.
An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

A. Create a custom Indicator Mapper and populate the custom indicator field. B. Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field. C. Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field. D. Populate the custom indicator field with the built-in !SetIndicator command.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

A. Remote git repository specified in the dev-prod configuration parameters B. The development server's default repository C. A content repository specified in the Marketplace D. Cortex XSOAR public content repository

Correct Answer: A

QUESTION NO: 5
What are two primary uses of standard tasks? (Choose two.)

A. To highlight different paths in a playbook B. To create an incident or escalate an existing incident C. To generate new widgets for a dashboard D. To automate tasks such as parsing a file or enriching indicators

Correct Answer: B,D

QUESTION NO: 6
In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

A. In repetitive processes that requires sub-playbook re-execution B. In repetitive process flows to iterate for each playbook input C. In repetitive process flows with no more than 10 loops D. When continuously ingesting incidents from third-party systems

Correct Answer: B,D

QUESTION NO: 7
Match the corresponding action with the appropriate playbook tasks.

Correct Answer:

Reference:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks- overview.html

QUESTION NO: 8
Which component can be part of a load balancing group?

A. Distributed database B. Engine C. D2 agent D. Load balancing server

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
Who is permitted to create and submit content to the Marketplace?

A. Any user who has a live.paloaltonetworks.com account B. Any user who has signed up through the dev portal C. Only users with a valid Github account D. All users with the correct XSOAR Role and Permissions

Correct Answer: D