1.6 Explain the Process of Maintaining and Troubleshooting the System XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An XSOAR administrator needs to recover a single deleted playbook that was accidentally removed. The last full backup was taken a week ago, and the playbook was created two days ago. The administrator has a configuration export from yesterday. What is the best recovery approach?

   • ARestore the full backup to a separate server and copy the playbook from there.
   • BRecreate the playbook manually from memory and test it.
   • CRestore the full backup from a week ago and then reapply all changes made since then.
   • DImport the configuration export from yesterday to restore the playbook without affecting other recent changes.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Users report that XSOAR is responding slowly. The administrator checks the server's CPU and memory usage and finds them within normal limits. Which log source should the administrator examine next to identify the cause of the performance degradation?

   • AThe backup logs to confirm that the last scheduled backup completed successfully.
   • BThe audit log to see if a user has recently changed the system time zone settings.
   • CThe database query logs to look for slow or long-running queries that may be blocking the application.
   • DThe firewall logs to verify that no new outbound rules are blocking API calls to external services.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which step in troubleshooting involves testing a potential cause to confirm or rule it out?

   • AForming a hypothesis
   • BImplementing a solution
   • CTesting the hypothesis
   • DDocumenting the resolution
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations team runs XSOAR on-premises. During a weekly health check, the administrator notices that the disk usage on the server hosting the primary database has grown by 15% in one week. The team has not added any new integrations or playbooks. Which maintenance action should the administrator take first to address this trend?

   • ARestart the XSOAR server to clear temporary files and release memory that may be inflating the reported disk usage.
   • BDisable the weekly health check job because it is generating excessive logs that consume disk space.
   • CImmediately increase the disk size of the virtual machine to prevent the server from running out of space.
   • DReview the database maintenance logs and check for large or orphaned investigation records that can be archived or purged.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of performing health checks on an XSOAR system?

   • ATo identify potential issues before they impact operations
   • BTo increase the system's processing speed
   • CTo automatically fix all system errors
   • DTo replace the need for backups
   Reveal Solution Discussion Select an answer first