XSOAR Engineer exam-day guide
XSOAR Engineer · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original, unexpired ID whose name exactly matches your exam registration. If you use a different name form (maiden name, middle name), confirm with the provider in advance which documents are accepted; do not assume a secondary ID will be allowed.
Exam appointment confirmation and provider login
Have the confirmation email, registration number, and portal credentials accessible. For remote proctoring, verify the exact check-in link and any system test the provider requires; confirm with the provider whether a browser extension or secure browser is mandatory.
Remote-proctoring environment check
If testing online, run the provider's system readiness test at least 24 hours ahead: webcam, microphone, browser version, bandwidth, and OS compatibility. Confirm with the provider the rules on extra monitors, virtual machines, and screen-sharing; these vary by provider.
Quiet, private room and clear desk
Use a room with a closed door, no other people, and a desk holding only permitted items. Remove phones, smart watches, notes, and second screens from arm's reach. Proctors commonly require a 360-degree room scan; rehearse it if you are unsure what they expect.
Test-center logistics (if applicable)
Confirm the test-center address, arrival time, and parking or transit plan. Arrive earlier than the provider's stated check-in window; late arrival rules vary, so confirm with the provider whether late entry is allowed.
Permitted materials list confirmed
Confirm with the provider whether blank paper, a pen, a whiteboard, or an on-screen notepad is allowed. Do not bring reference sheets, printed notes, or a second device unless the provider explicitly permits them.
Break and timing expectations
Know the total appointment time, whether scheduled or unscheduled breaks exist, and whether the clock stops during breaks. Confirm with the provider how breaks are requested and whether leaving the camera view is permitted.
Scoring and result-delivery expectations
Confirm the passing score, score-report format, and when results are released. Know whether a failed attempt has a waiting period before retake; confirm with the provider rather than relying on forum posts.
Content-domain review plan
Use the published exam blueprint to list domains and weights. In the final days, review your weakest two domains rather than rereading everything. If the blueprint is not public, confirm with the provider what domains are covered.
Hands-on familiarity with the platform's core workflows
Be able to describe, in your own words, how incidents are ingested, how playbooks and tasks are structured, how integrations and commands are configured, and how automation and indicators are handled. This is conceptual readiness, not a substitute for the official blueprint.
Time-management strategy
Decide in advance how you will handle long scenario questions: flag and return, or answer immediately. Practice with a timer so you know your average pace per question and can leave time for review.
Backup plan for technical failure
Know the provider's support contact and reconnect procedure if the session drops. Confirm with the provider whether lost time is restored and how an interrupted attempt is handled; do not assume.
Plan the day
Re-read the official exam blueprint and map each domain to your confidence level. Spend the remaining time on the two weakest domains. Do one timed practice set to calibrate pace, then stop adding new topics.
Resolve logistics: confirm appointment time and time zone, test-center address or remote check-in link, ID requirements, and permitted materials. Send any accommodation or name-mismatch questions to the provider now, not later.
Run the remote-proctoring system test if applicable. Charge devices, update the browser, and clear the testing area. Prepare ID, confirmation details, water, and any permitted items in one place.
Do a light review of key concepts and your own notes only. Avoid cramming new material. Set two alarms, confirm travel time, and plan a normal night's sleep.
Eat a normal meal, hydrate moderately, and avoid heavy caffeine if you are sensitive. Log in or arrive early per the provider's check-in window. Keep the desk clear and your ID ready before the proctor connects.
Read each scenario fully before answering; note who the actor is and what outcome is asked for. Answer confident questions first, flag uncertain ones, and return with remaining time. Watch the clock at the halfway point and adjust pace.
If a technical issue occurs, pause and contact the proctor or support immediately; note the time. Do not attempt to fix proctoring software by yourself in ways the provider has not authorized.
Follow the provider's process for the score report. If you did not pass, note which domains the report identifies as weak and confirm retake waiting rules with the provider before scheduling.
Rules to check
Present the exact ID the provider requires; the name must match your registration. If your documents differ in name form, confirm with the provider before exam day which combination is accepted.
Keep only permitted items at your desk. Phones, smart watches, notes, and additional screens are generally prohibited during a proctored exam; confirm with the provider what counts as permitted.
Stay within camera and microphone view for the entire session if remotely proctored. Request breaks through the proctor or the on-screen process; do not leave the view unannounced.
Do not communicate with anyone other than the proctor during the exam, and do not copy, screenshot, or share exam content. Content confidentiality terms are set by the provider and should be read in advance.
Follow the provider's rules on breaks and clock behavior. Whether breaks are scheduled, unscheduled, or counted against your time varies; confirm with the provider rather than assuming.
Understand the scoring model before you sit: passing score, whether questions are weighted, and whether partial credit exists. If this is not published, confirm with the provider what can be disclosed.
Report technical problems immediately and follow the provider's incident process. Do not restart, reinstall, or reconfigure proctoring tools unless support instructs you to.
If you need accommodations, request them through the provider's process well before the appointment. Approval and documentation requirements are provider-specific; confirm with the provider early.