Free Palo Alto Networks XSOAR Engineer XSOAR-Engineer Exam Questions

According to the Cortex XSOAR Admin Guide, visibility of layout tabs is controlled by role-based access permissions (RBAC). When customizing layouts, administrators can assign tabs, fields, and components to specific user roles. If the ''Forensics'' tab appears for senior analysts but not junior analysts, this indicates that the tab has been assigned only to certain roles through the ''Roles'' field in the layout editor.

XSOAR does not hide layout tabs due to incorrect field mappings (option A). If a field is unmapped, it simply appears empty, not invisible. Likewise, marking a tab as ''read-only'' (option C) still makes it visible; it only restricts editing. Display filters (option D) apply to list widgets, dashboards, and incidents---not layout tab visibility.

The documentation clearly states that a tab will not appear to a user unless their assigned role is included in the tab's role permissions. Therefore, junior analysts cannot view the tab because the tab was not assigned to their role, making option B the correct explanation based on XSOAR's RBAC-controlled layout behavior.

XSOAR's ingestion pipeline defines a strict order in which raw fetched data is processed, and the Admin Guide explains that Classification determines the incident type based on incoming fields, while Mapping performs the actual transformation of event data into structured incident fields. Mapping profiles define how each field from the integration's raw JSON (for example, source_ip, username, alert_id) is converted into standard or custom incident fields.

The Mapping Editor allows administrators to select specific fields from the incoming event data and bind them to incident fields used throughout playbooks, layouts, and reports. This ensures normalization of data and consistent schema usage across the SOC.

The documentation makes clear that Mapping is responsible for populating incident field values, whereas Classification only chooses the incident type. Field configuration defines field metadata but does not map values. Layout configuration controls visual presentation only and does not populate fields.

Thus, option B (Mapping) is the function that converts event data into incident field values and is the correct answer according to the ingestion architecture documented in the XSOAR Admin Guide.

Integration debug messages (generated using demisto.debug) are stored in the Integration Logs table, not in the War Room or incident labels.

The Admin Guide states that all logs generated by integration code are visible through the Integration Logs section for troubleshooting.

The XSOAR Playbook Editor allows engineers to manipulate and transform context data dynamically. According to the XSOAR Admin and Playbook Development Guides, ''Extend Context'' is the dedicated mechanism that enables a task to save output values into new or existing context keys, including keys that correspond to incident fields. By defining a key under the ''Extend Context'' section, the playbook task can map specific outputs---such as JSON fields, strings, arrays, or nested objects---to a structured location within the incident context. These keys can then be used to populate incident fields through further playbook tasks, field mappings, or automated incident field updates.

Classification (option A) applies only during ingestion and cannot assign task outputs to incident fields. Inputs (option B) define what data a task receives, not how it is stored afterward. Mapping (option D) belongs to the ingestion pipeline and determines how event fields become incident fields during creation, not during playbook execution.

Therefore, Extend Context is the correct feature that allows a task to associate its output with incident fields, making option C the correct answer based on documentation.