Cybersecurity-Apprentice Security Operations — 15 Questions

Question 1

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'. Cortex XDR's XQL uses a dataset-based syntax where you specify the dataset (e.g., xdr_data) and then apply filters with the 'filter' stage. Option B correctly uses 'dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'', which is valid XQL for filtering process-start events with hidden window styles. This matches XQL's pipe-based, dataset-oriented query structure.

Answer

search xdr_data | stats count by command_line | where command_line = 'Hidden'

Answer

SELECT * FROM xdr_data WHERE event_type == 'PROCESS_START' AND command_line LIKE '%Hidden%'

Answer

collect xdr_data where event_type = 'PROCESS_START' | parse command_line as Hidden

Question 2

A SOC manager wants to review the overall security posture and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Which dashboard area in Cortex XDR provides these operational metrics?

Accepted Answer

Cortex XDR Dashboards > Incident Management widgets. The Cortex XDR Dashboard includes built-in widgets for SOC metrics, including MTTD and MTTR, under the Dashboards and BI-Capping views.

Answer

Panorama > Managed Devices > Health Summary

Answer

WildFire > Portal > Statistics

Answer

Prisma Access > Monitoring > Traffic Logs

Question 3

During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?

Accepted Answer

Run an automated Phishing Investigation Playbook in Cortex XSOAR that calls enrichment and blocking integrations.. Cortex XSOAR is a SOAR platform that automates incident response through playbooks. A Phishing Investigation Playbook can automatically extract URLs from the reported email, run enrichment (e.g., VirusTotal, URLhaus, WildFire), and invoke blocking integrations (e.g., Palo Alto Networks firewall, EDL) without manual intervention. This is the core SOAR use case for phishing triage.

Answer

Enable User-ID redistribution via Panorama to invalidate the user session.

Answer

Configure a WildFire Analysis Profile to inspect inbound SMTP traffic streams.

Answer

Deploy a Decryption Profile to re-sign TLS certificates on the mail server.

Question 4

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. CEF (Common Event Format) and JSON are the standard structured, parsable output formats used when forwarding logs or incidents to a SIEM, and the SIEM server profile in Cortex XDR lets you select CEF or JSON formatting. These formats preserve field-value structure so the SIEM can parse and correlate events reliably. This is the correct configuration for a legacy SIEM integration.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 5

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

Accepted Answer

SNMP Trap destination. PAN-OS Log Forwarding Profiles natively support three destination types: SNMP Trap, Email, and Syslog. Option A (SNMP Trap destination) is correct because PAN-OS can send SNMP traps to an SNMP manager for alerting on matched log events. Option C (Email recipient) is correct because the firewall can forward logs as email messages to configured recipients, including built-in or custom email servers. Option E (Syslog server) is correct because PAN-OS natively forwards logs to external syslog servers over UDP, TCP, or SSL using RFC-compliant syslog formats. Option B (Bluetooth peer-to-peer relay) is not a supported log forwarding method in PAN-OS, as Bluetooth is not used for log transport. Option D (Local BIOS firmware flash memory) is not a log destination; BIOS flash is firmware storage, not a log forwarding target.

Answer

Bluetooth peer-to-peer relay

Answer

Local BIOS firmware flash memory

Question 6

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 24 hours. Which Cortex XDR query should the analyst use to find this information?

Accepted Answer

XQL Query. XQL in Cortex XDR is a powerful query language that enables analysts to search and filter through large datasets, including network events. By writing a query that filters for the malicious IP and the 24-hour window, the analyst can quickly identify which internal host communicated with it. This is the most direct and efficient approach.

Answer

Endpoint Inventory

Answer

Incident Timeline

Answer

Network Connections

Question 7

A Tier-1 SOC analyst is reviewing an escalated alert about an internal workstation repeatedly authenticating to a domain controller over NTLM instead of Kerberos. The analyst has no endpoint agent data, only Windows Security event logs forwarded to the SIEM. Which event should the analyst use to determine the source process that initiated the NTLM authentication?

Accepted Answer

Event ID 4624 with logon type 3 on the workstation, which records network logons and the process name in the Process Information field. When only Windows Security logs are available, the workstation's own 4624 event with logon type 3 captures the Process Information for the network logon session. That field names the executable and process ID that initiated the NTLM authentication. Domain controller events such as 4776 or 5140 show the account and source host but not the originating process, so they cannot resolve the analyst's question.

Answer

Event ID 5140 on the domain controller, which logs that a network share was accessed

Answer

Event ID 4776 on the domain controller, which validates the credentials for the account

Answer

Event ID 4688 on the domain controller, which records process creation for services running on that server

Question 8

A security analyst is reviewing alerts in a Security Operations Center. The analyst notices a pattern of failed login attempts for a single user account, originating from multiple different geographic locations within a short time window. The analyst wants to determine if this activity is a brute-force attack or a password-spraying attack. Which characteristic should the analyst examine to differentiate between these two attack types?

Accepted Answer

The distribution of failed attempts across many different user accounts.. Password spraying and brute-force attacks differ primarily in their targeting strategy. Brute-force concentrates many password guesses on a single account, while password spraying tries a few common passwords across many accounts to avoid account lockouts. Examining how failed login attempts are distributed across user accounts reveals this pattern, allowing the analyst to correctly classify the attack.

Answer

The source IP addresses used for the login attempts.

Answer

The number of failed login attempts per user account.

Answer

The time interval between consecutive failed login attempts.

Question 9

During a shift handover, a Tier-1 analyst is asked to verify whether a suspicious executable reported by the EDR was actually executed on a Windows 10 workstation. The endpoint agent is installed and forwarding telemetry. Which data source should the analyst consult first to confirm execution and capture the command line used?

Accepted Answer

Windows Security event log, Event ID 4688 process creation with command line auditing enabled. On a Windows 10 endpoint with the built-in Security log forwarding, Event ID 4688 with command line auditing provides process creation details, including the image path, parent process, and full command line. That combination confirms whether the suspicious executable ran and how it was invoked. Defender detection events and PowerShell script block logs cover narrower scopes and do not substitute for process creation auditing.

Answer

Windows PowerShell operational log, Event ID 4104, which records script block logging

Answer

Windows Defender Antivirus operational log, Event ID 1116, which records malware detection

Answer

Sysmon Event ID 1, which records process creation with hashes and command line

Question 10

A SOC analyst is triaging an alert indicating that a user's credentials were used to log into a critical server from an unusual location. The analyst suspects the account may be compromised. Which TWO immediate actions should the analyst take to contain the incident? (Choose two.)

Accepted Answer

Initiate a session revocation for the user's active sessions.. When a credential compromise is suspected, immediate containment focuses on cutting off the attacker's access. Disabling the account prevents new logins, while revoking active sessions terminates existing authenticated sessions. Together, these actions quickly neutralize the threat without unnecessarily disrupting critical servers or relying on ineffective IP blocking.

Answer

Isolate the critical server from the network.

Answer

Reset the user's password and force a change at next logon.

Answer

Block the suspicious external IP address at the firewall.

Question 11

A security analyst is examining a suspicious email reported by a user. The email appears to be from the company's CEO and urgently requests that the user purchase gift cards for a client. The analyst notices that the sender's email address is slightly misspelled but looks similar to the CEO's actual address. Which type of attack is this?

Accepted Answer

Business email compromise (BEC). The scenario describes an attacker impersonating the CEO with a look-alike email address to request gift card purchases. This is a classic business email compromise (BEC) attack, which targets employees who have access to company funds. The urgency and specific request are typical of BEC, distinguishing it from general phishing or whaling.

Answer

Spear phishing

Answer

Whaling

Answer

Phishing

Question 12

A Tier-1 SOC analyst is triaging a Cortex XDR alert for a Windows workstation that shows a suspicious process spawned from Microsoft Word, and the process is making outbound network connections to an IP address with a poor reputation. The analyst wants to gather additional context before escalating to Tier-2. Which TWO actions should the analyst take to collect relevant evidence within the Cortex XDR console? (Choose two.)

Accepted Answer

Check the 'Alerts' table for other alerts involving the same endpoint or the same file hash.. The Causality Chain view provides a visual map of process execution, showing how the suspicious process was spawned and its network activity, which is crucial for understanding the attack chain. Checking other alerts for the same endpoint or file hash helps determine if the incident is isolated or part of a larger pattern, aiding in prioritization and escalation. Together, these actions gather essential context without disrupting the endpoint or relying on external tools.

Answer

Submit the suspicious file to VirusTotal directly from the Cortex XDR console using the 'Submit to VirusTotal' option.

Answer

Use the Cortex XDR 'Action Center' to isolate the endpoint immediately.

Answer

Run the 'tasklist' command on the endpoint via the Cortex XDR Live Terminal to list all running processes.

Question 13

A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?

Accepted Answer

A configured Cortex XSOAR Integration instance polling the Prisma Cloud API.. Cortex XSOAR ingests external alerts through Integration instances — configured connectors that authenticate to third-party APIs (like the Prisma Cloud API) and poll or receive events on a schedule. Once ingested, these events can trigger playbooks via incident types and classification. The Integration instance is the architectural ingestion point for API-based alert sources.

Answer

A Log Forwarding Profile configured on the Prisma Access cloud service.

Answer

A Syslog Collector script running on a Panorama Log Collector.

Answer

An External Dynamic List hosted on an internal web server.

Question 14

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

Accepted Answer

Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.. Cortex XSIAM uses Parsing Rules to transform raw, non-standard log data into the Cortex XDM (Extended Data Model) schema by mapping source fields to normalized schema fields. This is the correct component for ingesting custom application logs that don't conform to standard RFC formats like syslog or CEF. Parsing Rules are applied during data ingestion before the data is stored and queried.

Answer

Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.

Answer

Modify the firewall Zone Protection profile to drop unparsed packets.

Answer

Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.

Question 15

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

Accepted Answer

Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.. Cortex XDR's incident response tools include a built-in 'Isolate Endpoint' action that can be triggered directly from an incident, immediately cutting the endpoint off from the network except for the Cortex XDR management channel. This is the correct automated response when a compromised account shows impossible-travel authentication, because isolating the host stops lateral movement and further exfiltration. The action is available in the incident response view and can also be automated via playbooks.

Answer

Change the Authentication Profile to drop Kerberos ticket grants.

Answer

Enable strict Zone Protection profiles on the local switch interface.

Answer

Apply a Global Protect Portal lockout via Panorama Device Groups.