1.1 Demonstrate Knowledge of Planning and Configuring System Authentication and Authorization XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A team needs a role that allows users to manage incidents and run playbooks, but explicitly prevents them from accessing the Settings page or managing integrations. The predefined roles do not match this requirement. What should the administrator do?

   • AAssign the Read-Only role and enable playbook execution
   • BCreate a custom role with incident management and playbook execution permissions, excluding settings and integration management
   • CModify the Administrator role to remove Settings access
   • DAssign the Analyst role and rely on its default restrictions
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which XSOAR predefined role is typically intended for users who need full administrative access to the system?

   • AAdministrator
   • BViewer
   • CIncident Responder
   • DAnalyst
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An administrator is configuring XSOAR authentication and wants to enforce MFA for all users. The organization uses SAML SSO with an identity provider that supports MFA. However, some users authenticate via local accounts for break-glass access. What is the best way to enforce MFA for local accounts?

   • AUse LDAP authentication with MFA enforced at the directory level
   • BEnable MFA in the identity provider and require all users to use SAML
   • CDisable local authentication entirely and rely solely on SAML
   • DConfigure MFA for local accounts in XSOAR's authentication settings
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team wants to ensure that no single user can both create playbooks and deploy them to production. They also want to minimize administrative overhead. Which approach best satisfies both requirements?

   • AUse the Analyst role for all users and manually review playbook changes
   • BCreate two custom roles: one with playbook creation and one with deployment, and assign users to only one role
   • CCreate a single custom role with both playbook creation and deployment permissions
   • DAssign all users the Administrator role and rely on audit logs
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   After creating a custom role in XSOAR, how do you grant that role's permissions to a user?

   • ASend an invitation to the user to accept the role
   • BModify the user's LDAP group membership
   • CAdd the user to the role's member list in the role configuration
   • DAssign the role to the user in the user's profile settings
   Reveal Solution Discussion Select an answer first