SecOps-Pro Practice Test 1 — 10 Questions

Question 1

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Accepted Answer

Continues to function using locally stored policies.. The agent is designed to continue protecting the endpoint using its locally stored policies and protection engines even when offline.

Answer

Enters a default 'Allow All' state.

Answer

Stops all security monitoring.

Answer

Automatically uninstalls itself.

Question 2

Which THREE pieces of information are displayed in the Incident View?

Accepted Answer

Associated alerts.. The incident view provides an overview of the affected entities, the associated alerts, and the status of the investigation.

Answer

The names of all users in the organization.

Answer

The current CPU usage of the cloud console.

Question 3

A user is reporting that their XSIAM dashboard widgets are displaying 'No Data'. What is the most likely cause?

Accepted Answer

Incorrect time range filter in the dashboard. If widgets display no data, the time range or query filter is usually the culprit for the current environment.

Answer

Agent is disconnected

Answer

Insufficient disk space

Answer

Global XSIAM outage

Question 4

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 5

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

Accepted Answer

Reporting. The Reporting section allows for the generation and scheduling of custom and predefined reports based on alert data.

Answer

Settings

Answer

Incident View

Answer

Query Center

Question 6

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

Accepted Answer

Content Update Policy. Update policies control when and how agents receive software and content updates.

Answer

Global Settings

Answer

Incident Management Settings

Answer

Endpoint Policy

Question 7

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 8

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

Accepted Answer

Endpoint View.. Analysts can use the Endpoint View for historical data and the Live Terminal for real-time interaction.

Answer

Sending a network broadcast.

Answer

Running a full system re-image.

Answer

Deleting the endpoint from the console.

Question 9

An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?

Accepted Answer

XQL. XQL (XDR Query Language) is the primary query language for searching and analyzing data in XSIAM.

Answer

SQL

Answer

SPL

Answer

KQL

Question 10

When reviewing an incident in the Investigation area, what does the 'Graph' view display?

Accepted Answer

The relationships between entities and alerts. The Graph view provides a visual representation of the relationships between entities involved in an incident.

Answer

The raw log structure

Answer

The status of the agent

Answer

The timeline of events only