Cybersecurity-Practitioner SOC Operations Practice Test 5 — 15 Questions

Question 1

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Collect and analyze the process hash, parent process, and network connection details to validate the alert.. The correct first step in incident response is to validate the alert by collecting and analyzing relevant artifacts. The suspicious process path and network connection require investigation to determine if they indicate malicious activity. This aligns with the 'identification' phase of the incident response lifecycle, ensuring that containment and remediation are based on confirmed threats.

Answer

Escalate the alert to the incident response team without further investigation.

Answer

Isolate the endpoint from the network to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the endpoint to remove any potential malware.

Question 2

A SOC analyst at a financial institution receives a high-severity alert from Cortex XDR indicating that a user's workstation executed a PowerShell script that downloaded and ran a file from a known malicious IP. The analyst wants to immediately contain the endpoint to prevent lateral movement, but must preserve forensic evidence. Which action should the analyst take first?

Accepted Answer

Isolate the endpoint from the network using the Cortex XDR isolate endpoint action.. The correct action is to isolate the endpoint using Cortex XDR's isolation capability. This immediately severs network connectivity while preserving the endpoint's state, including memory and running processes, which are essential for forensic analysis. Shutting down, scanning, or disabling the user account do not achieve immediate containment while preserving evidence.

Answer

Run a full antivirus scan on the endpoint to remove the malware.

Answer

Disable the user's Active Directory account to prevent further access.

Answer

Shut down the endpoint to stop any malicious processes.

Question 3

A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?

Accepted Answer

Modify the BIOC rule to exclude known benign processes or users.. Tuning a BIOC rule by excluding known benign processes or users is the most effective way to reduce false positives while preserving detection for malicious behavior. It directly addresses the noise source without sacrificing security coverage, aligning with best practices for SOC alert management.

Answer

Increase the severity of the BIOC rule to prioritize it.

Answer

Create a new BIOC rule with a narrower scope.

Answer

Disable the BIOC rule and rely on other detections.

Question 4

A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?

Accepted Answer

Create an exception in the rule to exclude the specific administrative activity.. Creating an exception for the specific administrative activity allows the rule to continue detecting malicious behavior while filtering out known benign actions. This fine-tuning reduces false positives without compromising detection capabilities, aligning with best practices in SOC operations for alert management.

Answer

Disable the rule and rely on other detections.

Answer

Modify the rule's severity to low.

Answer

Add a suppression rule to ignore alerts from the administrative user account.

Question 5

A SOC analyst is reviewing a Palo Alto Networks firewall traffic log and notices a large number of outbound connections to various IP addresses on port 53. The connections are using UDP and the payload appears to contain encoded data. Which type of malicious activity is most likely occurring?

Accepted Answer

DNS tunneling for command-and-control or data exfiltration.. The correct answer is DNS tunneling, which involves encoding data within DNS queries and responses to bypass security controls. The use of UDP port 53, encoded payload, and multiple destination IPs are classic indicators. This technique is often used by attackers for command-and-control or data exfiltration, making it a critical detection for SOC analysts.

Answer

A denial-of-service attack against external DNS servers.

Answer

A misconfigured application performing DNS lookups.

Answer

Peer-to-peer file sharing using the DNS protocol.

Question 6

A SOC analyst is reviewing a Cortex XDR incident involving a suspicious executable that was flagged as malware. The analyst wants to determine the initial infection vector and whether the malware has spread to other endpoints. Which Cortex XDR feature should the analyst use to visualize the process execution chain and related network activity?

Accepted Answer

Causality view. The Causality view is the correct tool because it visually maps the sequence of process executions, network connections, and file operations related to an alert. This enables the analyst to trace the attack back to its origin and identify any lateral movement or additional affected endpoints, which are key to understanding the infection vector and spread.

Answer

Threat intelligence platform

Answer

Incident response playbook

Answer

Alerts dashboard

Question 7

A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?

Accepted Answer

T1218: Signed Binary Proxy Execution. The abuse of a legitimate signed binary to execute malicious code is best mapped to T1218: Signed Binary Proxy Execution. This technique is specifically designed to describe such defense evasion tactics, where attackers leverage trusted system binaries to bypass application control and other security mechanisms. It is a precise match for the scenario.

Answer

T1204: User Execution

Answer

T1059: Command and Scripting Interpreter

Answer

T1055: Process Injection

Question 8

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately isolate the endpoint and initiate a malware scan.. The correct answer is to immediately isolate the endpoint and initiate a malware scan. The process masquerading as svchost.exe from an unusual path with a suspicious parent process is a strong indicator of compromise. Isolation contains the threat, and a scan helps identify and remediate any additional malicious files or persistence mechanisms.

Answer

Ignore the alert because svchost.exe is a legitimate Windows process.

Answer

Kill the process and delete the file from the endpoint.

Answer

Submit the file to WildFire for analysis and wait for the verdict.

Question 9

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script that downloads a file from a remote server. The analyst wants to determine if the file was executed and, if so, what child processes it spawned. Which Cortex XDR data source should the analyst query?

Accepted Answer

Process execution logs. Process execution logs are the definitive source for determining if a file was executed and what child processes it created. They capture command lines, parent process IDs, and execution timestamps, enabling the analyst to reconstruct the attack chain after the download.

Answer

Registry modification events

Answer

Network connection logs

Answer

File inventory

Question 10

A SOC team is using Cortex XDR to investigate a security incident. The analyst notices that a critical alert was automatically resolved without any analyst action. The team wants to ensure that all high-severity alerts are reviewed by a human before closure. Which Cortex XDR configuration should the analyst modify to enforce this requirement?

Accepted Answer

Modify the incident response playbook to require manual approval.. The correct configuration is to modify the incident response playbook to require manual approval for incident closure. Playbooks define the automated response actions, and adding a manual approval step ensures that high-severity alerts are not resolved without human intervention, aligning with the team's requirement.

Answer

Change the alert severity threshold to high.

Answer

Disable automatic updates for the Cortex XDR agent.

Answer

Adjust the alert exclusion rules to prevent auto-closure.

Question 11

A SOC analyst is investigating a Cortex XDR incident involving a Linux server. The analyst observes that a process named 'kworker' is making outbound DNS queries to a domain that is not in the approved list. The process is running from /tmp/kworker, and its parent process is 'bash'. Which of the following is the most likely explanation?

Accepted Answer

The process is a malicious binary masquerading as a kernel worker to evade detection.. The correct answer is that the process is a malicious binary masquerading as a kernel worker. The location in /tmp and parent process bash are inconsistent with legitimate kernel threads. The outbound DNS queries to an unapproved domain further indicate malicious activity, such as command-and-control or exfiltration.

Answer

The process is a legitimate application installed by the administrator in /tmp.

Answer

The process is a legitimate kernel worker thread performing DNS resolution.

Answer

The process is part of a scheduled task that performs DNS updates for dynamic DNS services.

Question 12

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

Accepted Answer

Causality View. Causality View is designed specifically for visualizing process ancestry and the details of each process, including command-line arguments. In a scenario where a suspicious process is spawned by an Office application, this view enables the analyst to quickly see whether the PowerShell command is obfuscated or contains malicious parameters, thereby accelerating triage.

Answer

Incident Timeline

Answer

Threat Intelligence

Answer

Alert Details

Question 13

A SOC team is using Cortex XDR to monitor for credential dumping attempts. They want to create a BIOC (Behavioral Indicator of Compromise) rule that detects when a process attempts to access the memory of lsass.exe. Which field combination should they use in the BIOC rule to specifically detect this behavior?

Accepted Answer

action = 'process memory read' AND target_process_name = 'lsass.exe'. Credential dumping from LSASS typically involves reading its memory to extract plaintext passwords or hashes. The BIOC rule must specify the memory read action and target lsass.exe to accurately detect such behavior. Other actions like write, process create, or file read do not align with the technique and would fail to identify the threat.

Answer

action = 'file read' AND target_process_name = 'lsass.exe'

Answer

action = 'process memory write' AND target_process_name = 'lsass.exe'

Answer

action = 'process create' AND target_process_name = 'lsass.exe'

Question 14

A SOC analyst is reviewing a Cortex XDR alert for a Windows endpoint. The alert indicates that a process has created a scheduled task to run a PowerShell script that downloads a file from a remote server. The analyst wants to gather additional evidence to determine the scope of the compromise. Which TWO of the following actions should the analyst take? (Choose two.)

Accepted Answer

Query the Cortex XDR database for all endpoints that have executed the same scheduled task name.. The correct answers are to query the Cortex XDR database for other endpoints with the same scheduled task and to retrieve the PowerShell script content. These actions help determine the scope of the compromise and understand the attacker's methods, enabling effective containment and remediation.

Answer

Disable the scheduled task without further investigation.

Answer

Immediately reboot the endpoint to clear any malicious processes.

Answer

Run a full antivirus scan on the endpoint only.

Question 15

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The process execution timeline for the endpoint, filtered by the initiating process hash.. The process execution timeline filtered by the initiating process hash provides a complete view of all processes spawned by the malicious macro, allowing the analyst to quickly identify additional ransomware behaviors such as file encryption, service stopping, or lateral movement tooling. This pivot is critical for determining the full scope of the attack on the endpoint and guiding containment efforts.

Answer

The network connections map for the endpoint, filtered by destination port 445.

Answer

The file quarantine list for the endpoint, sorted by most recent detection.

Answer

The registry modifications log for the endpoint, filtered by the user account that opened the document.