Cybersecurity-Practitioner SOC Operations Practice Test 4 — 15 Questions

Question 1

A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obfuscated Files or Information (e.g., encoded scripts or packed binaries). Option A, Obfuscated Files or Information, is correct because it belongs to the Defense Evasion tactic (T1027) and covers encoding scripts, packing binaries, and encrypting payloads to hide malicious content from static and dynamic analysis. Option B, Indicator Removal on Host, is correct because it is a Defense Evasion technique (T1070) that includes clearing Windows event logs, deleting audit trails, and removing artifacts to hinder forensic investigation. Option C, Masquerading, is correct because it is a Defense Evasion technique (T1036) where adversaries rename or place malicious files to appear as legitimate system executables or trusted utilities, deceiving users and security tools. Option D, Remote System Discovery via network ping sweeps, is not correct because it falls under the Discovery tactic (T1018), used for mapping remote systems rather than evading defenses. Option E, Data Staged for Exfiltration, is not correct because it belongs to the Collection tactic (T1074), involving centralizing data prior to exfiltration, not defense evasion.

Answer

Remote System Discovery via network ping sweeps

Answer

Data Staged for Exfiltration

Question 2

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

Accepted Answer

Least-privilege principles. Least-privilege principles dictate that users are granted only the minimum permissions required to perform their job functions. In Cortex XDR, administrative access should be scoped to specific roles and responsibilities, avoiding excessive privileges. This reduces the attack surface and potential for insider threats or credential misuse.

Answer

Role-Based Access Control expansion

Answer

Zero Trust Architecture

Answer

Federated Identity Management

Question 3

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

Accepted Answer

Zero Trust Architecture. Zero Trust Architecture (ZTA) is built on the principle 'never trust, always verify' — every user and device must be continuously authenticated and authorized regardless of network location. Prisma Access implements ZTA by combining identity-based policy, device posture checks, and continuous session evaluation at a global security cloud. This directly replaces the implicit-trust assumption of perimeter defense.

Answer

Secure Access Service Edge (SASE) core routing

Answer

Defense-in-Depth

Answer

Network Access Control (NAC)

Question 4

During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?

Accepted Answer

Execution. In MITRE ATT&CK, Execution includes techniques that result in adversary-controlled code running on a local or remote system. WMI remote execution (e.g., via Win32_Process Create) is a classic Execution technique (T1047). The attacker is actively running commands, not just gathering information or maintaining control.

Answer

Discovery

Answer

Command and Control

Answer

Credential Access

Question 5

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

Accepted Answer

Authentication. Authentication is the IAM function that verifies a claimed identity by validating credentials such as passwords, MFA tokens, or SAML assertions. In a SAML 2.0 flow, the Okta Identity Provider authenticates the user and issues a signed assertion that Prisma Cloud (the Service Provider) trusts. Authorization, by contrast, determines what the authenticated user is permitted to do.

Answer

Authorization

Answer

Auditing

Answer

Accounting

Question 6

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

Accepted Answer

Custom command and control infrastructure and objectives focused on espionage. The [CORRECT] answer is D because APTs are defined by their tailored, persistent approach: they build or rent custom C2 infrastructure (e.g., Cobalt Strike, Sliver, or bespoke implants) and pursue long-term intelligence collection rather than immediate financial gain. This contrasts with opportunistic ransomware, which typically uses commodity tooling and prioritizes speed over stealth. The espionage objective explains the long dwell times, stealthy lateral movement, and custom tooling described in the scenario.

Answer

Rapid data encryption and extortion demands

Answer

Low dwell time and heavy reliance on automated scanners

Answer

Exclusive use of built-in Living off the Land binaries

Question 7

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

Accepted Answer

Persistence and Privilege Escalation. The question describes two distinct adversary behaviors: 'leveraged valid accounts to maintain persistence' and 'modifying group memberships to escalate privileges.' In MITRE ATT&CK, Valid Accounts (T1078) is explicitly categorized under both Initial Access and Persistence, while Account Manipulation (T1098) — which includes modifying group memberships — is categorized under Persistence and Privilege Escalation. Therefore, the two tactics that best describe these observed phases are Persistence and Privilege Escalation.

Answer

Execution and Credential Access

Answer

Collection and Exfiltration

Answer

Initial Access and Defense Evasion

Question 8

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

Accepted Answer

Requiring multi-factor authentication (MFA) with continuous risk-based adaptive validation. Option A is correct because Zero Trust identity requires strong authentication such as MFA combined with continuous, risk-based adaptive validation, meaning access decisions are re-evaluated based on signals like user behavior, location, and device health rather than granted once at login. Option C is correct because Zero Trust enforces least-privilege access, granting only the minimum permissions needed and dynamically scoping them to user role, device posture, and contextual factors such as time and location. Option B is incorrect because permanent administrative access after a one-time compliance check violates Zero Trust's continuous verification and least-privilege principles. Option D is incorrect because implicitly trusting traffic from a corporate VPN contradicts the Zero Trust tenet of never trusting based on network location. Option E is incorrect because bypassing authentication for internal applications, even from managed assets, undermines the requirement to authenticate and authorize every access request.

Answer

Granting permanent administrative access once a device passes initial corporate compliance checks

Answer

Trusting internal network traffic implicitly once the user connects via corporate VPN

Answer

Allowing users to bypass authentication prompts when accessing internal web applications from managed assets

Question 9

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

Accepted Answer

Brute Force. Option C, Brute Force, is correct because it is listed under the MITRE ATT&CK Credential Access tactic (technique T1110), covering password guessing, credential stuffing, and password spraying to obtain valid accounts. Option E, OS Credential Dumping, is also correct because it belongs to the Credential Access tactic (technique T1003), describing extraction of credential material such as hashes or plaintext passwords from operating system memory or files (e.g., LSASS). The unmarked options do not belong: Masquerading (A) is a Defense Evasion technique (T1036), while Data Exfiltration Over C2 Channel (B, T1041) and Automated Exfiltration (D, T1020) are Exfiltration techniques, not Credential Access.

Answer

Masquerading

Answer

Data Exfiltration Over C2 Channel

Answer

Automated Exfiltration

Question 10

A security architect is designing a Zero Trust network segmentation model using Palo Alto Networks Next-Generation Firewalls. To prevent lateral movement of malware across internal VLANs, which operational rule must be strictly enforced?

Accepted Answer

Inspect and restrict all east-west internal traffic based on least-privilege application context. In a Zero Trust model, no traffic is trusted by default, even if it originates from internal subnets. To prevent lateral movement of malware, all east-west traffic between internal VLANs must be inspected and restricted based on least-privilege application context. This means enforcing granular security policies that allow only necessary applications and services, and denying all other traffic. This approach ensures that if a host is compromised, the malware cannot freely spread to other segments.

Answer

Trust all traffic originating from authenticated internal subnets by default

Answer

Permit all communication between endpoints sharing the same Active Directory domain

Answer

Rely solely on perimeter firewalls to block inbound threats from the internet

Question 11

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

Accepted Answer

Utilization of stealthy techniques designed to evade standard security monitoring tools. Option B is correct because APT actors prioritize operational security, employing stealthy techniques such as living-off-the-land binaries (LOLBins), fileless malware, and encrypted C2 channels specifically to evade EDR, SIEM, and other standard monitoring tools. Option C is correct because APTs typically build or acquire bespoke command-and-control infrastructure (e.g., custom implants, domain fronting, or victim-specific redirectors) tailored to the target's environment, rather than using commodity tooling that defenders can easily signature. Option E is correct because the defining characteristic of an APT is the 'persistent' element: adversaries establish long-term footholds using mechanisms like scheduled tasks, WMI subscriptions, or registry Run keys, maintaining access for months or years to conduct espionage or lateral movement. Option A is incorrect because exclusive reliance on public pentest scripts describes commodity or script-kiddie activity, whereas APTs develop or purchase custom exploits and zero-days. Option D is incorrect because short dwell times and noisy, aggressive encryption describe ransomware or smash-and-grab operations, not the low-and-slow, stealthy, long-dwell behavior of APTs.

Answer

Exclusive reliance on publicly available penetration testing scripts

Answer

Short dwell times with aggressive, noisy data encryption

Question 12

A SOC analyst at a company using Cortex XDR notices that several endpoints triggered a behavioral threat alert indicating a process injected code into a remote process and then created a network connection to an unfamiliar external IP. The analyst wants to quickly determine whether this activity is related to a known adversary technique and gather context about the process lineage. Which Cortex XDR feature should the analyst use to view the causal chain and map the activity to MITRE ATT&CK techniques?

Accepted Answer

The Causality View in the incident investigation, which shows the process ancestry and associated MITRE ATT&CK techniques.. The Causality View in Cortex XDR is designed to visualize the full process tree, including injection and network connections, and automatically correlates observed behaviors with MITRE ATT&CK techniques. This gives the analyst immediate context about the attack chain without manual query building or relying solely on indicator reputation, making it the most efficient tool for triaging a behavioral threat alert.

Answer

The Query Builder, which allows writing XQL queries to search for the specific process name across all endpoints.

Answer

The Threat Intelligence module, which provides reputation scores and WHOIS data for the external IP address.

Answer

The Policy Audit page, which shows which security policies were applied to the endpoint during the alert.

Question 13

A SOC team is using Cortex XDR to investigate a series of alerts indicating suspicious PowerShell execution on multiple endpoints. The analyst wants to create a custom detection rule that triggers when PowerShell is launched with the -EncodedCommand parameter and the parent process is not a known administrative tool. The analyst also wants to exclude a specific service account that legitimately uses encoded commands for automation. Which approach should the analyst take in Cortex XDR to meet these requirements?

Accepted Answer

Create a BIOC (Behavioral Indicator of Compromise) rule using the Cortex XDR rule editor, specifying the PowerShell command line pattern and a process exclusion for the service account.. BIOC rules in Cortex XDR are the correct mechanism for creating custom behavioral detections based on process and command-line attributes, with the ability to exclude specific users or processes. They operate in real time, integrate with the incident response workflow, and provide the granularity needed to detect encoded PowerShell while avoiding false positives from a known service account.

Answer

Configure a correlation rule in the Cortex XDR management console that uses the MITRE ATT&CK technique T1059.001 and applies a global allowlist for the service account.

Answer

Deploy a custom Cortex XDR agent script that monitors PowerShell execution and sends an alert to the management console, excluding the service account via a local configuration file.

Answer

Use the Cortex XDR Query Builder to schedule an XQL query that searches for the PowerShell command line and filters out the service account, then set it to generate an alert.

Question 14

A SOC analyst is investigating a Cortex XDR alert indicating that a process attempted to write to a suspicious registry key on a Windows endpoint. The analyst wants to determine if the process is malicious by examining its behavior. Which Cortex XDR capability provides the most comprehensive view of process activity, including command-line arguments and parent-child relationships?

Accepted Answer

Process Execution History. Process Execution History offers the most comprehensive view by capturing process creation events, command-line arguments, and parent-child relationships. This allows the analyst to trace the origin of the suspicious process and understand its behavior in context, which is crucial for determining malicious intent. Other capabilities provide complementary data but lack the depth needed for behavioral analysis.

Answer

File Inventory

Answer

Network Connection Logs

Answer

Registry Monitoring

Question 15

A SOC analyst is triaging a Cortex XDR incident where a suspicious process spawned from a Microsoft Word document. The process tree shows WINWORD.EXE launching powershell.exe with an encoded command. The analyst wants to quickly determine the parent-child relationship and command-line arguments across all endpoints in the incident. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality View. Causality View is specifically designed to visualize process execution chains in Cortex XDR, showing how one process spawned another along with full command-line details. This allows the analyst to quickly understand the attack sequence from the initial document to the encoded PowerShell command, which is essential for triage and further investigation.

Answer

Incident Response playbook

Answer

Behavioral Indicators dashboard

Answer

Threat Intelligence module