SecOps-Pro Practice Test 1 — 10 Questions

Question 1

Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?

Accepted Answer

Content Packs. Content Packs are the Cortex XSOAR mechanism for packaging playbooks, scripts, integrations, incident types, layouts, and classifiers into a single installable unit. They are versioned and can be installed across tenants or environments, which is exactly the 'bundle and deploy' behavior the question describes. This makes them the canonical answer for cross-environment deployment of content.

Answer

Export to PDF

Answer

Backup and Restore

Answer

Archive

Answer

Git Integration

Question 2

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize process relationships and event sequences in Cortex XDR. It allows analysts to quickly trace the origin of an alert by following the chain of process executions, which is essential for root cause analysis during incident response. Other options either detect but don't visualize, or require manual querying.

Answer

XQL Query Builder

Answer

IOC Rules

Answer

BIOC Rules

Question 3

A SecOps analyst is investigating a phishing incident in Cortex XSOAR. The incident includes an email with a malicious attachment. The analyst wants to automatically extract and enrich all indicators from the attachment and then block them on the firewall. Which Cortex XSOAR component should the analyst use to orchestrate this workflow?

Accepted Answer

Playbook. A playbook in Cortex XSOAR is the orchestration component that automates multi-step processes, including indicator extraction, enrichment, and response actions like blocking. It allows the analyst to define the sequence and conditions for each step, ensuring consistent and efficient incident handling.

Answer

Indicator Extraction Rule

Answer

Incident Type

Answer

Integration

Question 4

A SOC analyst is triaging a Cortex XDR alert for a suspicious PowerShell script execution on a server. The analyst wants to quickly determine the user account that initiated the process and the command line used. Which Cortex XDR alert detail field provides this information directly?

Accepted Answer

Process Execution Details. Process Execution Details is the Cortex XDR alert field that captures the command line, user account, parent process, and other metadata about the process that triggered the alert. This is exactly what the analyst needs to quickly identify who ran the script and what it did, enabling efficient triage.

Answer

Alert Name

Answer

Alert Severity

Answer

MITRE ATT&CK Technique

Question 5

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Accepted Answer

Directory services logs ingested through a log collection integration, which provides authentication events from the identity provider.. To correlate endpoint process execution, network connections, and directory authentication events in one XQL query, the administrator needs the data that actually generates those events. Cortex XDR agent telemetry supplies endpoint process and network events, while directory services logs ingested through a log collection integration supply authentication events. WildFire verdicts, Cortex Data Lake storage, and threat intel feeds add enrichment or storage but do not produce the required event types.

Answer

Threat intelligence feeds from third-party providers, which supply indicators of compromise for matching.

Answer

WildFire sandbox verdicts, which provide file reputation and behavioral reports for submitted samples.

Answer

Cortex Data Lake raw log storage, which retains all ingested logs for long-term query and compliance.

Question 6

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Accepted Answer

Line Chart. A Line Chart is the correct widget type for visualizing how a metric (count of indicator types) changes over time, since it plots data points across a time axis. In Cortex XSOAR dashboards, line charts are used for trend analysis over time, which matches tracking threat intelligence trends.

Answer

Counter Widget

Answer

Pie Chart

Answer

Table Widget

Question 7

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Accepted Answer

Isolate Endpoint. Isolating the endpoint in Cortex XDR immediately cuts off all network communication (except to the Cortex XDR management console) while preserving the endpoint's state for forensic investigation. This prevents lateral movement by the attacker while allowing analysts to investigate without the risk of the attacker pivoting to other systems.

Answer

Delete Process

Answer

Reboot Endpoint

Answer

Disable User Account

Question 8

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Accepted Answer

War Room. The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.

Answer

Summary Tab

Answer

Evidence Board

Answer

Playbook Tab

Question 9

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Accepted Answer

Alert Exclusion. Alert Exclusion in Cortex XDR allows analysts to create exclusion rules that suppress future alerts matching specific criteria (e.g., hash, path, process, user). This is the correct mechanism to prevent a known false positive from re-triggering. It preserves detection logic while reducing noise.

Answer

Agent Uninstallation

Answer

Policy Deletion

Answer

Threat Intel Ingestion

Question 10

A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?

Accepted Answer

join. The join operator is specifically designed to combine records from two datasets based on a matching field. By joining failed and successful login events on the 'user' field, the administrator can identify users who experienced a failed login followed by a successful one, which is a common indicator of brute-force or credential-stuffing attacks. This correlation is essential for accurate detection.

Answer

filter

Answer

union

Answer

sort