Cybersecurity-Apprentice Security Operations Practice Test 3 — 15 Questions

Question 1

A SOC analyst is reviewing the primary log categories generated by a Palo Alto Networks Next-Generation Firewall. Which TWO log types are natively available in PAN-OS for security monitoring and incident analysis? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat logs. Threat logs (A) are a native PAN-OS log type that records security events detected by the firewall's security profiles, such as antivirus, anti-spyware, vulnerability protection, URL filtering, and WildFire verdicts, making them essential for incident analysis. Traffic logs (B) are also natively generated by PAN-OS and capture details of sessions traversing the firewall, including source/destination, application, action, and bytes, which supports security monitoring and forensic review. Kernel memory core-dump logs (C) are OS-level diagnostic artifacts, not a PAN-OS security log category. BIOS hardware diagnostic logs (D) belong to hardware/firmware diagnostics and are unrelated to firewall security logging. Local switch VLAN spanning-tree logs (E) are Layer 2 switch logs and are not a native PAN-OS log type.

Answer

Kernel memory core-dump logs

Answer

BIOS hardware diagnostic logs

Answer

Local switch VLAN spanning-tree logs

Question 2

A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)

Accepted Answer

Process execution events. The Cortex XDR agent collects rich endpoint telemetry for behavioral analytics and threat hunting, and process execution events (A) are core because they capture process creation, command lines, parent-child relationships, and related metadata used by the causality chain and Behavioral Threat Protection. Network connection events (B) are also collected, recording endpoint network activity such as connections, ports, and remote IPs so the agent can correlate network behavior with process activity for threat detection and investigation. File modification and creation events (C) are likewise collected, tracking file writes, creations, and related file operations that are essential for detecting malware drops, ransomware behavior, and persistence. The remaining options do not belong: physical datacenter environmental temperature readings (D) are facility/environmental monitoring data not gathered by an endpoint agent, and monitored Wi-Fi router SSID signal strengths (E) are wireless infrastructure metrics outside the Cortex XDR agent's endpoint telemetry scope.

Answer

Physical datacenter environmental temperature readings

Answer

Monitored Wi-Fi router SSID signal strengths

Question 3

Which TWO roles or responsibilities are typically associated with a Tier-1 SOC analyst in a standard security operations structure? (Choose two)

Accepted Answer

Performing initial triage and alert categorization of incoming security events.. Option C is correct because a Tier-1 SOC analyst's core duty is monitoring the SIEM/alert queue and performing initial triage and categorization of incoming security events, determining whether alerts are true or false positives before deeper investigation. Option D is correct because Tier-1 analysts follow documented, standardized runbooks/SOPs for known alert types and escalate complex or confirmed incidents to Tier-2/Tier-3 for advanced analysis. Option A is wrong because configuring enterprise BGP routing policies on edge routers is a network engineering task, not a SOC analyst responsibility. Option B is wrong because writing custom kernel-level endpoint sensor drivers is a low-level software/EDR development task performed by engineers, not Tier-1 analysts. Option E is wrong because reverse-engineering unknown zero-day malware binaries in a sandbox is advanced malware analysis typically handled by Tier-3/threat research or reverse-engineering specialists.

Answer

Configuring enterprise BGP routing policies on edge routers.

Answer

Writing custom kernel-level endpoint sensor drivers from scratch.

Answer

Reverse-engineering unknown zero-day malware binaries in a secure sandbox.

Question 4

An administrator is reviewing Cortex XDR investigation tools. Which THREE features are available when investigating an incident in the Cortex XDR Incident View? (Choose three)

Accepted Answer

List of impacted endpoints and user accounts.. Option A is correct because the Cortex XDR Incident View aggregates the affected assets of an incident, presenting the list of impacted endpoints and the associated user accounts so the analyst knows the scope of the compromise. Option B is correct because the Incident View includes the attack story graph, which visualizes the correlated causality chain of alerts and events, letting the investigator trace how the attack progressed across the environment. Option D is correct because the Incident View exposes response action buttons that let the analyst contain and remediate directly, such as isolating an endpoint from the network or terminating a malicious process on the host. Options C and E are not part of Cortex XDR's investigation capabilities: payroll deduction processing is an HR/finance function unrelated to security operations, and real-time webcam monitoring is neither a Cortex XDR feature nor a legitimate incident-response tool.

Answer

Automated payroll deduction processing for compromised users.

Answer

Real-time physical webcam monitoring of the user's workspace.

Question 5

A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)

Accepted Answer

Reset the user password in Active Directory via integration command.. Option B is correct because a compromised-credential playbook must remediate the account itself, and Cortex XSOAR integrations such as Active Directory (e.g., ad-reset-password or ad-user-reset-password) let the playbook reset the user's password programmatically. Option C is correct because notifying the affected user and/or the security team is a standard containment/communication step, typically done with the Mail Sender or similar integration to trigger awareness and follow-up. Option E is correct because terminating the attacker's existing access is essential; integrations to firewalls, VPN gateways, or identity providers (e.g., session revocation or user logout commands) invalidate active sessions so stolen credentials or tokens can no longer be used. Option A does not belong because factory-resetting core routing switches is a destructive network action unrelated to credential compromise and would cause an outage. Option D does not belong because formatting the Domain Controller's hard drive is catastrophic and irrelevant to remediating a single compromised user account.

Answer

Factory reset all enterprise core routing switches.

Answer

Format the physical hard drive of the Active Directory Domain Controller.

Question 6

When performing threat hunting in Cortex XDR using XQL, an analyst needs to identify anomalous execution chains. Which THREE XQL query stages or clauses are valid and commonly used in building investigative queries? (Choose three)

Accepted Answer

stats count() by actor_process_image_path. Option C is correct because every XQL query must begin by specifying the data source with the dataset stage, and 'dataset = xdr_data' is the standard dataset for Cortex XDR endpoint telemetry. Option B is correct because 'filter' is the XQL stage used to narrow results by field conditions, and 'filter event_type = 'PROCESS_START'' validly restricts the query to process-creation events, which is essential for building execution chains. Option A is correct because 'stats count() by actor_process_image_path' is a valid XQL aggregation stage that groups process starts by their executable path, helping analysts spot anomalous or rare binaries. Option D is incorrect because 'SELECT * FROM root WHERE execute == true' is SQL syntax, not XQL, and XQL does not use SELECT/FROM/WHERE clauses. Option E is incorrect because 'RUN DIAGNOSTICS FOR ALL ENDPOINTS IMMEDIATE' is not an XQL stage or clause; it resembles a response-action command rather than a query construct.

Answer

SELECT * FROM root WHERE execute == true

Answer

RUN DIAGNOSTICS FOR ALL ENDPOINTS IMMEDIATE

Question 7

A security operations team is configuring threat intelligence feeds in Cortex XSIAM. Which THREE indicator types can typically be ingested and correlated against network and endpoint telemetry? (Choose three)

Accepted Answer

File cryptographic hashes (SHA256, MD5). Option A is correct because file cryptographic hashes such as SHA256 and MD5 are standard indicator types that Cortex XSIAM ingests and correlates against endpoint telemetry (e.g., process executions and file activity) to detect known malicious files. Option B is correct because malicious IP addresses and CIDR blocks are core network indicators that XSIAM correlates against network telemetry such as firewall, proxy, and connection logs to identify communication with known-bad infrastructure. Option D is correct because Fully Qualified Domain Names (FQDNs) are standard domain indicators that XSIAM matches against DNS, proxy, and endpoint telemetry to detect resolution or contact with malicious domains. Option C does not belong because biometric fingerprint templates are identity/authentication data, not threat intelligence indicators, and are not ingested as IOC types for network and endpoint correlation. Option E does not belong because printer toner cartridge serial numbers are asset/inventory data with no threat-intelligence relevance and are not correlated as indicators.

Answer

Internal employee biometric fingerprint templates

Answer

Local printer toner cartridge serial numbers

Question 8

A Tier-1 SOC analyst receives an alert from the endpoint agent indicating that a known malicious hash was blocked during execution. The analyst wants to confirm whether any other endpoints in the organization attempted to execute the same file and whether those attempts were blocked or allowed. Which data source should the analyst query to obtain this information?

Accepted Answer

The central management console's alert and event database. The central management console collects endpoint telemetry from all agents, so searching it by the malicious hash reveals every host that attempted execution and the resulting action. Local logs, firewall traffic, and DNS logs lack the endpoint execution context required. Using the central console enables rapid scoping and informed containment decisions.

Answer

The endpoint agent's local quarantine log stored on the affected host

Answer

The DNS server's query log for the affected subnet

Answer

The firewall's Application Command Center (ACC) traffic logs

Question 9

A Tier-1 SOC analyst receives an alert from the SIEM indicating a possible brute-force attack against the domain controller. The analyst needs to follow the standard incident response process. According to NIST SP 800-61, which phase of the incident response lifecycle involves determining whether an event is actually an incident and its scope?

Accepted Answer

Detection and Analysis. The Detection and Analysis phase is where analysts validate alerts, determine if an event qualifies as an incident, and assess its scope. This matches the scenario where the analyst must decide if the brute-force alert is a real incident. Other phases occur before or after this critical validation step.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 10

A SOC analyst is triaging a phishing alert that includes an email attachment. The analyst needs to determine whether the attachment is malicious before escalating. Which TWO actions are appropriate first steps in this triage? (Choose two.)

Accepted Answer

Analyze the attachment in a sandboxed environment to observe its behavior. Reputation lookup and sandbox analysis are safe, fast, and evidence-based first steps. They determine maliciousness without exposing production systems or destroying evidence. Opening the file on a workstation, forwarding it broadly, or deleting it prematurely are unsafe or counterproductive. These two actions support an informed escalation decision.

Answer

Delete the original email from the mail server immediately without further analysis

Answer

Forward the attachment to all users asking if they recognize the sender

Answer

Open the attachment directly on the analyst's workstation to observe its behavior

Question 11

A security analyst is reviewing a suspicious email reported by a user. The email contains a link to a website that asks for login credentials. The analyst wants to safely determine if the link is malicious without exposing the corporate network. Which of the following is the BEST action to take?

Accepted Answer

Submit the URL to a threat intelligence platform like VirusTotal.. Using a threat intelligence platform like VirusTotal allows safe reputation checks and often provides sandbox reports without exposing the corporate network. Directly clicking the link or forwarding it are risky and do not provide controlled analysis. A sandbox with no network access cannot evaluate the site's behavior.

Answer

Click the link from the analyst's own workstation to see where it redirects.

Answer

Forward the email to all employees to warn them about the phishing attempt.

Answer

Open the link in a sandboxed virtual machine with no network access.

Question 12

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process. The analyst wants to determine the parent process that spawned the suspicious executable and the full command line used. Which Cortex XDR feature should the analyst use to obtain this information?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a visual and chronological representation of process execution, including parent-child relationships and full command lines. This is the correct tool for understanding how a suspicious process was spawned and what arguments it used. Other features like Process Execution History or Alert Triage do not offer this specific lineage view.

Answer

Endpoint Audit Log

Answer

Alert Triage

Answer

Process Execution History

Question 13

A SOC analyst is reviewing a SIEM alert that shows multiple failed login attempts followed by a successful login for the same user account from an unusual geographic location within a short time window. The account is used by a remote employee who normally connects from a single city. Which activity should the analyst prioritize to determine whether this represents a compromised account?

Accepted Answer

Review the authentication logs to confirm the source IP addresses and login timestamps. Reviewing authentication logs confirms the source IPs, timestamps, and success or failure patterns behind the alert. This evidence determines whether the login truly originated from an unusual location and whether the failures align with a brute-force or credential-stuffing attempt. Containment and deeper forensic checks should follow confirmation, not precede it.

Answer

Immediately disable the user account to prevent further unauthorized access

Answer

Check the user's mailbox rules for any forwarding or deletion rules created recently

Answer

Run a full antivirus scan on the user's endpoint to detect malware

Question 14

A SOC analyst receives an alert from Cortex XSIAM indicating a possible brute-force attack against a user account. The analyst wants to quickly see the raw log events that triggered the alert. Which Cortex XSIAM component should the analyst use to view the underlying log data?

Accepted Answer

Log Search. Log Search in Cortex XSIAM is the component that enables analysts to query and view raw log events. By searching for the user account and relevant time frame, the analyst can see the exact events that triggered the brute-force alert. This is essential for verifying the alert and understanding the attack details.

Answer

Automation Rules

Answer

Incident View

Answer

Threat Intelligence

Question 15

A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large outbound transfer to an unknown IP address over port 443. The analyst wants to determine if this is malicious. Which of the following actions should the analyst perform FIRST to gather more context?

Accepted Answer

Check the reputation of the destination IP using threat intelligence sources.. The first step should be to gather context without disrupting the environment. Checking the destination IP's reputation via threat intelligence is quick, non-intrusive, and can immediately indicate if the transfer is likely malicious. Blocking, packet capture, or user interviews are either premature or less efficient for initial triage.

Answer

Block the IP address at the firewall to stop the transfer.

Answer

Interview the user associated with the source IP to ask about the transfer.

Answer

Capture full packet capture of the traffic for later analysis.