Cybersecurity-Apprentice Security Operations — Timed 20 Questions

Question 1

An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?

20 minute time limit — choose an answer to begin.

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'. Cortex XDR's XQL uses a dataset-based syntax where you specify the dataset (e.g., xdr_data) and then apply filters with the 'filter' stage. Option B correctly uses 'dataset = xdr_data | filter event_type = 'PROCESS_START' and command_line contains 'Hidden'', which is valid XQL for filtering process-start events with hidden window styles. This matches XQL's pipe-based, dataset-oriented query structure.

Answer

search xdr_data | stats count by command_line | where command_line = 'Hidden'

Answer

SELECT * FROM xdr_data WHERE event_type == 'PROCESS_START' AND command_line LIKE '%Hidden%'

Answer

collect xdr_data where event_type = 'PROCESS_START' | parse command_line as Hidden

Question 2

A SOC manager wants to review the overall security posture and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Which dashboard area in Cortex XDR provides these operational metrics?

Accepted Answer

Cortex XDR Dashboards > Incident Management widgets. The Cortex XDR Dashboard includes built-in widgets for SOC metrics, including MTTD and MTTR, under the Dashboards and BI-Capping views.

Answer

Panorama > Managed Devices > Health Summary

Answer

WildFire > Portal > Statistics

Answer

Prisma Access > Monitoring > Traffic Logs

Question 3

During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?

Accepted Answer

Run an automated Phishing Investigation Playbook in Cortex XSOAR that calls enrichment and blocking integrations.. Cortex XSOAR is a SOAR platform that automates incident response through playbooks. A Phishing Investigation Playbook can automatically extract URLs from the reported email, run enrichment (e.g., VirusTotal, URLhaus, WildFire), and invoke blocking integrations (e.g., Palo Alto Networks firewall, EDL) without manual intervention. This is the core SOAR use case for phishing triage.

Answer

Enable User-ID redistribution via Panorama to invalidate the user session.

Answer

Configure a WildFire Analysis Profile to inspect inbound SMTP traffic streams.

Answer

Deploy a Decryption Profile to re-sign TLS certificates on the mail server.

Question 4

A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?

Accepted Answer

Configure the SIEM server profile to export logs using CEF (Common Event Format) or JSON formatting.. CEF (Common Event Format) and JSON are the standard structured, parsable output formats used when forwarding logs or incidents to a SIEM, and the SIEM server profile in Cortex XDR lets you select CEF or JSON formatting. These formats preserve field-value structure so the SIEM can parse and correlate events reliably. This is the correct configuration for a legacy SIEM integration.

Answer

Disable all header encryption and export logs using raw ASCII carriage returns only.

Answer

Rewrite the PAN-OS kernel to natively output syslog in Microsoft Word DOCX format.

Answer

Convert all log files into uncompressed raw bitmap graphics prior to export.

Question 5

An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)

Accepted Answer

SNMP Trap destination. PAN-OS Log Forwarding Profiles natively support three destination types: SNMP Trap, Email, and Syslog. Option A (SNMP Trap destination) is correct because PAN-OS can send SNMP traps to an SNMP manager for alerting on matched log events. Option C (Email recipient) is correct because the firewall can forward logs as email messages to configured recipients, including built-in or custom email servers. Option E (Syslog server) is correct because PAN-OS natively forwards logs to external syslog servers over UDP, TCP, or SSL using RFC-compliant syslog formats. Option B (Bluetooth peer-to-peer relay) is not a supported log forwarding method in PAN-OS, as Bluetooth is not used for log transport. Option D (Local BIOS firmware flash memory) is not a log destination; BIOS flash is firmware storage, not a log forwarding target.

Answer

Bluetooth peer-to-peer relay

Answer

Local BIOS firmware flash memory

Question 6

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 24 hours. Which Cortex XDR query should the analyst use to find this information?

Accepted Answer

XQL Query. XQL in Cortex XDR is a powerful query language that enables analysts to search and filter through large datasets, including network events. By writing a query that filters for the malicious IP and the 24-hour window, the analyst can quickly identify which internal host communicated with it. This is the most direct and efficient approach.

Answer

Endpoint Inventory

Answer

Incident Timeline

Answer

Network Connections

Question 7

A Tier-1 SOC analyst is reviewing an escalated alert about an internal workstation repeatedly authenticating to a domain controller over NTLM instead of Kerberos. The analyst has no endpoint agent data, only Windows Security event logs forwarded to the SIEM. Which event should the analyst use to determine the source process that initiated the NTLM authentication?

Accepted Answer

Event ID 4624 with logon type 3 on the workstation, which records network logons and the process name in the Process Information field. When only Windows Security logs are available, the workstation's own 4624 event with logon type 3 captures the Process Information for the network logon session. That field names the executable and process ID that initiated the NTLM authentication. Domain controller events such as 4776 or 5140 show the account and source host but not the originating process, so they cannot resolve the analyst's question.

Answer

Event ID 5140 on the domain controller, which logs that a network share was accessed

Answer

Event ID 4776 on the domain controller, which validates the credentials for the account

Answer

Event ID 4688 on the domain controller, which records process creation for services running on that server

Question 8

A security analyst is reviewing alerts in a Security Operations Center. The analyst notices a pattern of failed login attempts for a single user account, originating from multiple different geographic locations within a short time window. The analyst wants to determine if this activity is a brute-force attack or a password-spraying attack. Which characteristic should the analyst examine to differentiate between these two attack types?

Accepted Answer

The distribution of failed attempts across many different user accounts.. Password spraying and brute-force attacks differ primarily in their targeting strategy. Brute-force concentrates many password guesses on a single account, while password spraying tries a few common passwords across many accounts to avoid account lockouts. Examining how failed login attempts are distributed across user accounts reveals this pattern, allowing the analyst to correctly classify the attack.

Answer

The source IP addresses used for the login attempts.

Answer

The number of failed login attempts per user account.

Answer

The time interval between consecutive failed login attempts.

Question 9

During a shift handover, a Tier-1 analyst is asked to verify whether a suspicious executable reported by the EDR was actually executed on a Windows 10 workstation. The endpoint agent is installed and forwarding telemetry. Which data source should the analyst consult first to confirm execution and capture the command line used?

Accepted Answer

Windows Security event log, Event ID 4688 process creation with command line auditing enabled. On a Windows 10 endpoint with the built-in Security log forwarding, Event ID 4688 with command line auditing provides process creation details, including the image path, parent process, and full command line. That combination confirms whether the suspicious executable ran and how it was invoked. Defender detection events and PowerShell script block logs cover narrower scopes and do not substitute for process creation auditing.

Answer

Windows PowerShell operational log, Event ID 4104, which records script block logging

Answer

Windows Defender Antivirus operational log, Event ID 1116, which records malware detection

Answer

Sysmon Event ID 1, which records process creation with hashes and command line

Question 10

A SOC analyst is triaging an alert indicating that a user's credentials were used to log into a critical server from an unusual location. The analyst suspects the account may be compromised. Which TWO immediate actions should the analyst take to contain the incident? (Choose two.)

Accepted Answer

Initiate a session revocation for the user's active sessions.. When a credential compromise is suspected, immediate containment focuses on cutting off the attacker's access. Disabling the account prevents new logins, while revoking active sessions terminates existing authenticated sessions. Together, these actions quickly neutralize the threat without unnecessarily disrupting critical servers or relying on ineffective IP blocking.

Answer

Isolate the critical server from the network.

Answer

Reset the user's password and force a change at next logon.

Answer

Block the suspicious external IP address at the firewall.

Question 11

A security analyst is examining a suspicious email reported by a user. The email appears to be from the company's CEO and urgently requests that the user purchase gift cards for a client. The analyst notices that the sender's email address is slightly misspelled but looks similar to the CEO's actual address. Which type of attack is this?

Accepted Answer

Business email compromise (BEC). The scenario describes an attacker impersonating the CEO with a look-alike email address to request gift card purchases. This is a classic business email compromise (BEC) attack, which targets employees who have access to company funds. The urgency and specific request are typical of BEC, distinguishing it from general phishing or whaling.

Answer

Spear phishing

Answer

Whaling

Answer

Phishing

Question 12

A Tier-1 SOC analyst is triaging a Cortex XDR alert for a Windows workstation that shows a suspicious process spawned from Microsoft Word, and the process is making outbound network connections to an IP address with a poor reputation. The analyst wants to gather additional context before escalating to Tier-2. Which TWO actions should the analyst take to collect relevant evidence within the Cortex XDR console? (Choose two.)

Accepted Answer

Check the 'Alerts' table for other alerts involving the same endpoint or the same file hash.. The Causality Chain view provides a visual map of process execution, showing how the suspicious process was spawned and its network activity, which is crucial for understanding the attack chain. Checking other alerts for the same endpoint or file hash helps determine if the incident is isolated or part of a larger pattern, aiding in prioritization and escalation. Together, these actions gather essential context without disrupting the endpoint or relying on external tools.

Answer

Submit the suspicious file to VirusTotal directly from the Cortex XDR console using the 'Submit to VirusTotal' option.

Answer

Use the Cortex XDR 'Action Center' to isolate the endpoint immediately.

Answer

Run the 'tasklist' command on the endpoint via the Cortex XDR Live Terminal to list all running processes.

Question 13

A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?

Accepted Answer

A configured Cortex XSOAR Integration instance polling the Prisma Cloud API.. Cortex XSOAR ingests external alerts through Integration instances — configured connectors that authenticate to third-party APIs (like the Prisma Cloud API) and poll or receive events on a schedule. Once ingested, these events can trigger playbooks via incident types and classification. The Integration instance is the architectural ingestion point for API-based alert sources.

Answer

A Log Forwarding Profile configured on the Prisma Access cloud service.

Answer

A Syslog Collector script running on a Panorama Log Collector.

Answer

An External Dynamic List hosted on an internal web server.

Question 14

A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?

Accepted Answer

Use Parsing Rules in Cortex XSIAM to map raw log fields to the XDM schema.. Cortex XSIAM uses Parsing Rules to transform raw, non-standard log data into the Cortex XDM (Extended Data Model) schema by mapping source fields to normalized schema fields. This is the correct component for ingesting custom application logs that don't conform to standard RFC formats like syslog or CEF. Parsing Rules are applied during data ingestion before the data is stored and queried.

Answer

Create an Incident Response Playbook in XSOAR to regex-parse the raw text file.

Answer

Modify the firewall Zone Protection profile to drop unparsed packets.

Answer

Configure Data Collection Rules in Expedition to automatically rewrite the syslog header.

Question 15

During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?

Accepted Answer

Trigger the 'Isolate Endpoint' action from the Cortex XDR Incident response tools.. Cortex XDR's incident response tools include a built-in 'Isolate Endpoint' action that can be triggered directly from an incident, immediately cutting the endpoint off from the network except for the Cortex XDR management channel. This is the correct automated response when a compromised account shows impossible-travel authentication, because isolating the host stops lateral movement and further exfiltration. The action is available in the incident response view and can also be automated via playbooks.

Answer

Change the Authentication Profile to drop Kerberos ticket grants.

Answer

Enable strict Zone Protection profiles on the local switch interface.

Answer

Apply a Global Protect Portal lockout via Panorama Device Groups.

Question 16

An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?

Accepted Answer

Create a Panorama Pre-Rule or Post-Rule blocking the destination IP address and push the policy to managed firewalls.. Panorama manages multiple firewalls centrally, and its Pre-Rules and Post-Rules are policy rulebases that are pushed to all managed firewalls. Creating a Pre-Rule or Post-Rule that blocks the destination C2 IP address and pushing the policy to managed firewalls immediately enforces the block enterprise-wide, which is the correct containment action for a known C2 destination. This leverages Panorama's centralized policy management to stop further communication across all managed enforcement points.

Answer

Change the GlobalProtect Gateway IP pool configuration.

Answer

Modify the local hosts file on every endpoint via Cortex XDR Action Center.

Answer

Reboot the Panorama management server to flush active state tables.

Question 17

An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?

Accepted Answer

Device > Server Profiles > Syslog. Syslog server profiles in PAN-OS are defined under Device > Server Profiles > Syslog, where you configure the server name, IP/FQDN, port, transport (UDP/TCP/SSL), format (BSD, IETF), and facility. This profile is then referenced in Log Forwarding profiles attached to Security, Threat, or other log types.

Answer

Objects > External Dynamic Lists > Syslog

Answer

Policies > Forwarding > Syslog

Answer

Network > Log Settings > Syslog

Question 18

A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?

Accepted Answer

Navigate to Cortex XDR > Incident View to review the automated attack story and affected endpoints.. Cortex XDR's Incident View is the central triage console that automatically correlates endpoint telemetry into an attack story, showing the causal chain of events, affected endpoints, and root cause. For a ransomware outbreak, this is where an analyst immediately sees scope (how many endpoints) and the initial infection vector. It is the designed starting point for incident triage, not policy or hunting tools.

Answer

Run a manual threat hunting query in the Action Center to install new agents.

Answer

Access the Policy Editor to disable the infected endpoints from the network.

Answer

Open the Endpoint Protection profiles to manually delete the malware binaries.

Question 19

A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?

Accepted Answer

Log into the WildFire Portal and search the file hash in the analysis search bar.. The WildFire Portal provides a public and private cloud analysis search interface where analysts can manually submit or look up a file hash (MD5, SHA-1, or SHA-256) to see whether WildFire has previously analyzed it and what verdict was returned. This is the standard manual hash lookup method in the Palo Alto Networks ecosystem. It is distinct from automated WildFire forwarding configured on firewalls.

Answer

Open Cortex XSOAR and run a manual ping command on the hash.

Answer

Check the User-ID agent status page for hash mapping tables.

Answer

Navigate to Panorama > ACC and filter by SHA256 signatures.

Question 20

An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?

Accepted Answer

Review the Cyvera.txt log file located in the Cortex XDR installation directory.. The Cyvera.txt log file is the primary diagnostic log for the Cortex XDR agent on Windows endpoints. It records detailed information about agent operations, including communication attempts with the Cortex XDR server, registration status, and any errors encountered during telemetry upload. Since the issue is specifically about agents failing to report telemetry, this log provides the most direct evidence of the communication failure. Other logs listed are either installation-related or pertain to different Palo Alto products (PAN-OS, log collector).

Answer

Open the msiexec.log file generated during the initial software installation.

Answer

Check the /var/log/pan/nsm.log file on the log collector.

Answer

Inspect the pan_event_log.csv file in the PAN-OS system partition.