Threat Detection And Incident Response

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

A Cortex XDR administrator needs to ensure that a newly created custom BIOC rule is evaluated against endpoint activity in real time without waiting for the next scheduled rule refresh. The rule must also be able to reference the parent process of the triggering event. Which combination of rule configuration choices should the administrator make?

A Cortex XDR analyst notices that a single endpoint generated over 200 alerts in the last hour, all tied to the same parent process tree and the same remote IP. The analyst wants to reduce analyst fatigue while preserving the full investigation timeline. Which Cortex XDR capability should the analyst use to consolidate these related alerts?

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

During an investigation, a Cortex XDR analyst needs to determine whether a suspicious PowerShell process was spawned by a known-good parent such as explorer.exe or by a malicious macro-enabled document. The analyst wants to visualize the full chain of process creation events leading to the alert. Which Cortex XDR feature should the analyst use?

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious process on an endpoint that is communicating with an external IP address. To determine the full scope of the incident, the analyst needs to retrieve all network connections initiated by that process and any child processes. Which Cortex XDR action should the analyst take to efficiently gather this information?

During an active incident, a Cortex XDR analyst wants to stop a compromised endpoint from communicating with a known command-and-control server while still allowing the rest of the SOC to collect forensic evidence from the host. Which Cortex XDR response action should the analyst use?

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

A SecOps analyst receives an alert indicating a possible credential dumping attempt on a Windows server. The analyst wants to quickly determine which user account initiated the suspicious process and what other commands were run in the same session. Which Cortex XDR data source should the analyst query?

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

A Cortex XDR analyst is investigating a series of alerts across multiple endpoints that appear to be part of a coordinated attack. The analyst wants to identify the common root cause and see how the attack spread from the initial endpoint to others. Which Cortex XDR capability provides this cross-endpoint correlation?

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious outbound connection from a server to an unknown external IP. To determine if this connection is part of a larger attack, the analyst wants to see all other endpoints that communicated with the same external IP within the last 24 hours. Which Cortex XDR query should the analyst run?

A Cortex XSOAR playbook is triggered by a phishing incident. The playbook automatically extracts indicators from the email and enriches them using threat intelligence integrations. The analyst wants to ensure that any malicious URLs found are blocked on the next-generation firewall (NGFW) and that the incident is documented. Which XSOAR feature should the analyst use to automatically push the malicious URLs to the NGFW block list?

A Cortex XSOAR analyst is building a playbook to automate the response to phishing incidents. The playbook must extract indicators from the reported email, check their reputation against integrated threat intelligence sources, and then decide whether to block the sender domain or close the incident as benign. Which type of XSOAR task should the analyst use to perform the reputation check?

A Cortex XSOAR analyst is designing a playbook that must automatically enrich every new phishing alert by querying VirusTotal, then create a ticket in ServiceNow only when the verdict is malicious. Which playbook construct should the analyst use to branch execution based on the enrichment verdict?

A Cortex XDR analyst notices an endpoint generating a high volume of process creation events that match a known attack pattern, but the pattern is not tied to any file hash or network indicator. The analyst wants Cortex XDR to alert on this behaviour automatically in the future without creating a signature-based rule. Which Cortex XDR capability should the analyst use?

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

A SOC manager wants to ensure that during a major incident, all analysts see the same set of indicators, tasks, and investigation findings without duplicating effort across shifts. Which Cortex XSOAR feature should the manager rely on to provide this shared investigation workspace?

A SOC analyst receives a Cortex XDR alert indicating that a workstation attempted to contact a domain associated with a known malware family. The analyst confirms the domain is malicious and wants to prevent any further communication from the endpoint to that domain while keeping the endpoint online for continued investigation. Which Cortex XDR response action should the analyst take?

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

A SOC analyst receives an alert from Cortex XDR indicating that a known malicious hash was executed on an endpoint. The analyst wants to quickly determine if this hash has been seen on other endpoints in the organization and what processes were involved. Which Cortex XDR feature provides a centralized view of all endpoint events related to a specific indicator?

During a Cortex XDR investigation, an analyst notices that a single suspicious process spawned multiple child processes, created several files, and made outbound network connections over a short period. The analyst wants to preserve the entire set of related events and artifacts as a single unit so that other team members can review the full context rather than individual alerts. Which Cortex XDR feature should the analyst use to group these related events into one reviewable entity?

An analyst is reviewing a Cortex XDR alert where a user's credentials were used to authenticate from an IP address in a foreign country, but the user is known to be on a business trip in that country. The analyst wants to determine whether this is a true positive or a false positive. Which Cortex XDR feature should the analyst use to correlate this authentication event with other activity from the same user and endpoint over time?

A security analyst is investigating a potential data exfiltration incident. They have identified a suspicious process on an endpoint that is making outbound connections to an unknown IP address. The analyst wants to determine the parent process that spawned this suspicious process and the command line arguments used. Which Cortex XDR data source should the analyst query to obtain this information?

A security operations center (SOC) analyst receives an alert about a suspicious PowerShell script execution on a user's workstation. The analyst wants to quickly determine if this script has been seen in the environment before and if it is associated with any known threats. Which Cortex XDR feature should the analyst use to search for the script's hash across the environment and threat intelligence?

A Cortex XDR analyst is investigating a security incident where an attacker used RDP to move laterally from a compromised workstation to a server. The analyst wants to create a BIOC rule to detect future RDP lateral movement attempts. Which of the following XQL queries would best accomplish this?

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a Windows endpoint. The process is powershell.exe with a command line that includes 'Invoke-Expression' and a Base64-encoded string. The analyst wants to gather additional context to determine if this is malicious. Which two actions should the analyst take next? (Choose two.)

A Cortex XSOAR analyst is creating a new incident type for phishing reports. The analyst wants to ensure that the incident includes predefined fields for the sender's email address, the subject line, and the list of recipients. Which feature in Cortex XSOAR should the analyst use to define these fields?