1.6 Explain the Process of Maintaining and Troubleshooting the System XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A playbook that enriches indicators using a third-party threat intelligence service has started failing. The error log shows 'HTTP 403 Forbidden'. The integration was working yesterday. Which of the following is the most likely cause of this issue?

   • AThe threat intelligence service has been decommissioned and the endpoint no longer exists.
   • BThe XSOAR server's clock is out of sync, causing timestamp mismatches in the request headers.
   • CThe API key for the threat intelligence service has expired or been revoked.
   • DThe XSOAR server's outbound firewall is blocking traffic to the threat intelligence service.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization's change management policy requires that all XSOAR configuration changes be reversible. The administrator needs to implement a routine maintenance process that supports this policy. Which practice should the administrator adopt?

   • AEnable the built-in high-availability feature to fail over to a secondary server during changes.
   • BPerform configuration changes only during off-peak hours to minimize user impact.
   • CTake a full backup before every configuration change and document the change in a change log.
   • DKeep a spreadsheet of all integration credentials in case a change needs to be undone manually.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a routine maintenance task for an XSOAR system?

   • ADeleting old logs without review
   • BChanging the admin password weekly
   • CDisabling all integrations to reduce load
   • DPerforming regular backups of the database and configuration files
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After resolving an XSOAR issue, what is the recommended final step?

   • AReboot the server again
   • BDelete all related logs
   • CDisable the affected integration
   • DDocument the issue and resolution
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An XSOAR administrator receives alerts that a critical playbook is failing intermittently at the same step. The error message in the execution log is generic: 'Connection refused'. The playbook calls an external ticketing system. Which step should the administrator take first following a systematic troubleshooting methodology?

   • ARebuild the playbook from scratch to eliminate any logic errors introduced during a recent edit.
   • BVerify that the ticketing system's API endpoint is reachable from the XSOAR server and that authentication credentials are still valid.
   • CDisable the integration and re-enable it to force a fresh connection pool.
   • DIncrease the playbook's retry count so the intermittent failure is masked by automatic retries.
   Reveal Solution Discussion Select an answer first