Cybersecurity-Apprentice Security Operations — 10 Questions

Question 1

A SOC manager wants to review the overall security posture and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Which dashboard area in Cortex XDR provides these operational metrics?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XDR Dashboards > Incident Management widgets. The Cortex XDR Dashboard includes built-in widgets for SOC metrics, including MTTD and MTTR, under the Dashboards and BI-Capping views.

Answer

Panorama > Managed Devices > Health Summary

Answer

WildFire > Portal > Statistics

Answer

Prisma Access > Monitoring > Traffic Logs

Question 2

A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?

Accepted Answer

A configured Cortex XSOAR Integration instance polling the Prisma Cloud API.. Integrations in Cortex XSOAR connect to third-party tools like Prisma Cloud via API to fetch incidents, which then trigger automated incident types and playbooks.

Answer

A Log Forwarding Profile configured on the Prisma Access cloud service.

Answer

A Syslog Collector script running on a Panorama Log Collector.

Answer

An External Dynamic List hosted on an internal web server.

Question 3

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'. XQL queries begin with the dataset name (e.g., dataset = xdr_data) followed by a pipe (|) and filter conditions using standard operators like filter or ~=.

Answer

search xdr_data | stats count by command_line | where command_line = 'Hidden'

Answer

SELECT * FROM xdr_data WHERE event_type == 'PROCESS_START' AND command_line LIKE '%Hidden%'

Answer

collect xdr_data where event_type = 'PROCESS_START' | parse command_line as Hidden

Question 4

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

Accepted Answer

Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.. Log Forwarder and Parser configurations in Cortex XSIAM use Analytics and Parsing rules, specifically leveraging Parsing Rules to transform raw logs into the XDM (XDR Data Model) common schema.

Answer

Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.

Answer

Modify the firewall Zone Protection profile to drop unparsed packets.

Answer

Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.

Question 5

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

Accepted Answer

Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.. Cortex XDR allows administrators and automated playbooks to isolate endpoints from the network using the 'Isolate Endpoint' action in the Action Center or incident response capabilities.

Answer

Change the Authentication Profile to drop Kerberos ticket grants.

Answer

Enable strict Zone Protection profiles on the local switch interface.

Answer

Apply a Global Protect Portal lockout via Panorama Device Groups.

Question 6

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

Accepted Answer

Create a Panorama Pre-Rule or Post-Rule blocking the destination IP address and push the policy to managed firewalls.. Panorama allows administrators to create security rules at the Pre-Rules or Post-Rules level, or use dynamic block lists pushed across managed firewalls.

Answer

Change the GlobalProtect Gateway IP pool configuration.

Answer

Modify the local hosts file on every endpoint via Cortex XDR Action Center.

Answer

Reboot the Panorama management server to flush active state tables.

Question 7

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles are configured under Device > Server Profiles > Syslog in the PAN-OS management interface.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 8

A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?

Accepted Answer

Navigate to Cortex XDR > Incident View to review the automated attack story and affected endpoints.. In Cortex XDR, the Incident View aggregates related alerts into a single incident graph, allowing analysts to quickly see the root cause, scope, and affected endpoints.

Answer

Run a manual threat hunting query in the Action Center to install new agents.

Answer

Access the Policy Editor to disable the infected endpoints from the network.

Answer

Open the Endpoint Protection profiles to manually delete the malware binaries.

Question 9

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire portal allows security professionals to manually search file hashes to view historical analysis reports and verdicts.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 10

During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?

Accepted Answer

Run an automated Phishing Investigation Playbook in Cortex XSOAR that calls enrichment and blocking integrations.. Cortex XSOAR uses automated playbooks containing integration commands to parse artifacts, check threat intelligence, and take enforcement actions.

Answer

Enable User-ID redistribution via Panorama to invalidate the user session.

Answer

Configure a WildFire Analysis Profile to inspect inbound SMTP traffic streams.

Answer

Deploy a Decryption Profile to re-sign TLS certificates on the mail server.