Cybersecurity-Apprentice Security Operations — 10 Questions

Question 1

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'. Cortex XDR's XQL uses a dataset-based syntax where you specify the dataset (e.g., xdr_data) and then apply filters with the 'filter' stage. Option B correctly uses 'dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'', which is valid XQL for filtering process-start events with hidden window styles. This matches XQL's pipe-based, dataset-oriented query structure.

Answer

search xdr_data | stats count by command_line | where command_line = 'Hidden'

Answer

SELECT * FROM xdr_data WHERE event_type == 'PROCESS_START' AND command_line LIKE '%Hidden%'

Answer

collect xdr_data where event_type = 'PROCESS_START' | parse command_line as Hidden

Question 2

A SOC manager wants to review the overall security posture and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Which dashboard area in Cortex XDR provides these operational metrics?

Accepted Answer

Cortex XDR Dashboards > Incident Management widgets. The Cortex XDR Dashboard includes built-in widgets for SOC metrics, including MTTD and MTTR, under the Dashboards and BI-Capping views.

Answer

Panorama > Managed Devices > Health Summary

Answer

WildFire > Portal > Statistics

Answer

Prisma Access > Monitoring > Traffic Logs

Question 3

During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?

Accepted Answer

Run an automated Phishing Investigation Playbook in Cortex XSOAR that calls enrichment and blocking integrations.. Cortex XSOAR is a SOAR platform that automates incident response through playbooks. A Phishing Investigation Playbook can automatically extract URLs from the reported email, run enrichment (e.g., VirusTotal, URLhaus, WildFire), and invoke blocking integrations (e.g., Palo Alto Networks firewall, EDL) without manual intervention. This is the core SOAR use case for phishing triage.

Answer

Enable User-ID redistribution via Panorama to invalidate the user session.

Answer

Configure a WildFire Analysis Profile to inspect inbound SMTP traffic streams.

Answer

Deploy a Decryption Profile to re-sign TLS certificates on the mail server.

Question 4

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. CEF (Common Event Format) and JSON are the standard structured, parsable output formats used when forwarding logs or incidents to a SIEM, and the SIEM server profile in Cortex XDR lets you select CEF or JSON formatting. These formats preserve field-value structure so the SIEM can parse and correlate events reliably. This is the correct configuration for a legacy SIEM integration.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 5

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

Accepted Answer

SNMP Trap destination. PAN-OS Log Forwarding Profiles natively support three destination types: SNMP Trap, Email, and Syslog. Option A (SNMP Trap destination) is correct because PAN-OS can send SNMP traps to an SNMP manager for alerting on matched log events. Option C (Email recipient) is correct because the firewall can forward logs as email messages to configured recipients, including built-in or custom email servers. Option E (Syslog server) is correct because PAN-OS natively forwards logs to external syslog servers over UDP, TCP, or SSL using RFC-compliant syslog formats. Option B (Bluetooth peer-to-peer relay) is not a supported log forwarding method in PAN-OS, as Bluetooth is not used for log transport. Option D (Local BIOS firmware flash memory) is not a log destination; BIOS flash is firmware storage, not a log forwarding target.

Answer

Bluetooth peer-to-peer relay

Answer

Local BIOS firmware flash memory

Question 6

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 24 hours. Which Cortex XDR query should the analyst use to find this information?

Accepted Answer

XQL Query. XQL in Cortex XDR is a powerful query language that enables analysts to search and filter through large datasets, including network events. By writing a query that filters for the malicious IP and the 24-hour window, the analyst can quickly identify which internal host communicated with it. This is the most direct and efficient approach.

Answer

Endpoint Inventory

Answer

Incident Timeline

Answer

Network Connections

Question 7

A Tier-1 SOC analyst is reviewing an escalated alert about an internal workstation repeatedly authenticating to a domain controller over NTLM instead of Kerberos. The analyst has no endpoint agent data, only Windows Security event logs forwarded to the SIEM. Which event should the analyst use to determine the source process that initiated the NTLM authentication?

Accepted Answer

Event ID 4624 with logon type 3 on the workstation, which records network logons and the process name in the Process Information field. When only Windows Security logs are available, the workstation's own 4624 event with logon type 3 captures the Process Information for the network logon session. That field names the executable and process ID that initiated the NTLM authentication. Domain controller events such as 4776 or 5140 show the account and source host but not the originating process, so they cannot resolve the analyst's question.

Answer

Event ID 5140 on the domain controller, which logs that a network share was accessed

Answer

Event ID 4776 on the domain controller, which validates the credentials for the account

Answer

Event ID 4688 on the domain controller, which records process creation for services running on that server

Question 8

A security analyst is reviewing alerts in a Security Operations Center. The analyst notices a pattern of failed login attempts for a single user account, originating from multiple different geographic locations within a short time window. The analyst wants to determine if this activity is a brute-force attack or a password-spraying attack. Which characteristic should the analyst examine to differentiate between these two attack types?

Accepted Answer

The distribution of failed attempts across many different user accounts.. Password spraying and brute-force attacks differ primarily in their targeting strategy. Brute-force concentrates many password guesses on a single account, while password spraying tries a few common passwords across many accounts to avoid account lockouts. Examining how failed login attempts are distributed across user accounts reveals this pattern, allowing the analyst to correctly classify the attack.

Answer

The source IP addresses used for the login attempts.

Answer

The number of failed login attempts per user account.

Answer

The time interval between consecutive failed login attempts.

Question 9

During a shift handover, a Tier-1 analyst is asked to verify whether a suspicious executable reported by the EDR was actually executed on a Windows 10 workstation. The endpoint agent is installed and forwarding telemetry. Which data source should the analyst consult first to confirm execution and capture the command line used?

Accepted Answer

Windows Security event log, Event ID 4688 process creation with command line auditing enabled. On a Windows 10 endpoint with the built-in Security log forwarding, Event ID 4688 with command line auditing provides process creation details, including the image path, parent process, and full command line. That combination confirms whether the suspicious executable ran and how it was invoked. Defender detection events and PowerShell script block logs cover narrower scopes and do not substitute for process creation auditing.

Answer

Windows PowerShell operational log, Event ID 4104, which records script block logging

Answer

Windows Defender Antivirus operational log, Event ID 1116, which records malware detection

Answer

Sysmon Event ID 1, which records process creation with hashes and command line

Question 10

A SOC analyst is triaging an alert indicating that a user's credentials were used to log into a critical server from an unusual location. The analyst suspects the account may be compromised. Which TWO immediate actions should the analyst take to contain the incident? (Choose two.)

Accepted Answer

Initiate a session revocation for the user's active sessions.. When a credential compromise is suspected, immediate containment focuses on cutting off the attacker's access. Disabling the account prevents new logins, while revoking active sessions terminates existing authenticated sessions. Together, these actions quickly neutralize the threat without unnecessarily disrupting critical servers or relying on ineffective IP blocking.

Answer

Isolate the critical server from the network.

Answer

Reset the user's password and force a change at next logon.

Answer

Block the suspicious external IP address at the firewall.