A team is creating a new list for storing allowed email domains. They want to ensure that the list is easy to identify and that only the security team can modify it. What is a best practice for naming and securing this list?

Name it 'AllowedEmailDomains' and set permissions to allow only the security team to edit.

Name it 'list1' and set permissions to allow all users to edit.

Name it 'SecurityList' and allow all users to view but only admins to edit.

Name it 'temp' and rely on playbook documentation to explain its purpose.

Which action can be performed when editing a key-value list in XSOAR?

Changing the list type from key-value to context

A security engineer wants to ensure that only the incident response team can delete a critical list of compromised credentials. Other teams should be able to view the list but not delete it. What is the best way to configure this?

Store the list in a protected folder that only the incident response team can access.

Set the list permissions to allow read for all roles and delete only for the incident response role.

Make the list read-only for everyone and have the incident response team recreate it if changes are needed.

Use a custom script to check the user's role before allowing deletion.

Palo Alto NetworksCertified XSOAR Engineer

Domain 2Objective 7

2.7 Explain List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 3)

Part of the Use Case Planning and Development domain, which accounts for 22% of the XSOAR-ENGINEER exam.

24questions here

5free pages

8concepts

22%of the exam

Questions 11–15

11application · medium
A team is creating a new list for storing allowed email domains. They want to ensure that the list is easy to identify and that only the security team can modify it. What is a best practice for naming and securing this list?
Select an answer first
12foundation · easy
Which action can be performed when editing a key-value list in XSOAR?
Select an answer first
13foundation · easy
Which XSOAR list type is primarily used to store data in the incident context that can be accessed by multiple playbooks?
Select an answer first
14application · medium
A security engineer wants to ensure that only the incident response team can delete a critical list of compromised credentials. Other teams should be able to view the list but not delete it. What is the best way to configure this?
Select an answer first
15foundation · easy
Which feature in XSOAR allows you to track modifications made to a list?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.

2.7 Explain List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

A team is creating a new list for storing allowed email domains. They want to ensure that the list is easy to identify and that only the security team can modify it. What is a best practice for naming and securing this list?

Which action can be performed when editing a key-value list in XSOAR?

Which XSOAR list type is primarily used to store data in the incident context that can be accessed by multiple playbooks?

A security engineer wants to ensure that only the incident response team can delete a critical list of compromised credentials. Other teams should be able to view the list but not delete it. What is the best way to configure this?

Which feature in XSOAR allows you to track modifications made to a list?

Keep studying — Use Case Planning and Development