Palo Alto Networks XSOAR Engineer XSOAR-Engineer Exam Questions
When the verdict of an indicator is set manually, which source reliability does it receive?
Correct Answer: C
When an analyst manually sets an indicator’s verdict, XSOAR records the verdict with a source named "Manual", and assigns it a reliability of Undefined.
This is explicitly documented under Indicator Verdict + Reliability behavior when a manual override is applied.
Which command adds or updates a description to an incident that can be used within widgets?
Correct Answer: A
The !setIncident command is the documented method for updating incident fields programmatically in Cortex XSOAR. The Admin Guide states that the syntax requires proper quoting for parameters, especially when assigning descriptive text that may include spaces. The correct syntax is:
!setIncident description="some text"
This updates the built-in description field at the incident level and allows widgets, dashboards, and reports to use the updated description because XSOAR widgets can read incident fields directly. Option A uses correct syntax with quotes included.
Option B incorrectly uses !Set, which modifies context keys , not incident fields. Option C is invalid due to incorrect parameter formatting (hyphens instead of equals signs). Option D omits quotation marks, causing parsing errors in cases where the value includes spaces, verbs, or punctuation.
Thus, the only correct and fully documented method to update an incident’s description so that it is available to widgets is A: !setIncident description="…" .
What determines the current verdict for an indicator when multiple sources provide different reliability scores and verdicts?
Correct Answer: C
The Threat Intelligence section specifies that XSOAR determines an indicator’s verdict by selecting the verdict from the source that has the highest reliability score.
Only when two sources have equal reliability does XSOAR choose the most severe (worst) verdict between them.
A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named "BlockedSenders_Email."
Which built-in command should be used within the playbook to add this email address to the specified list?
Correct Answer: A
XSOAR’s built-in Lists Service supports operations such as creating, updating, and appending items to lists using automation commands. The correct command for appending a value to an existing list is !addToList , which inserts the new string (in this case an email address) into the list array stored within the XSOAR Lists infrastructure.
The Admin Guide describes !addToList as the intended mechanism to add new elements to a named list while automatically handling JSON structure and avoiding duplication errors.
Option B, !appendToListContext, modifies context data , not persistent platform lists—therefore it will not update the BlockedSenders list. Option C misuses !setIncident, which updates incident fields only, not system lists. Option D, !createListItem, is used when an integration or automation script exposes a “create item” action, not for native XSOAR lists.
Thus, the correct and documented method of adding an email value to a persistent XSOAR list is !addToList , making option A the accurate choice.
Which two advanced attributes can be applied to incident fields when editing? (Choose two.)
Correct Answer: A, B
Reference: https://docs.servicenow.com/bundle/quebec-it-servicemanagement/page/product/incident-management/reference/incident-managementproperties.html