SecOps-Pro Practice Test 10 — 10 Questions

Question 1

A security analyst needs to ensure that a playbook only proceeds to the containment phase if the severity of the incident is 'High' or 'Critical'. The severity is stored in the incident field 'severity'. Which task type should be used to implement this branching logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional task. The need is to automatically branch the playbook based on the incident's severity. A Conditional task is designed for this purpose: it evaluates a condition (e.g., severity equals 'High' or 'Critical') and directs the playbook flow accordingly. Other task types either require manual input or do not provide branching.

Answer

Manual task

Answer

Data Collection task

Answer

Script task

Question 2

A Cortex XSIAM administrator needs to ensure that a newly onboarded cloud log source is parsed correctly so that its events map to the XDM fields used by correlation rules. The raw logs arrive in JSON format with vendor-specific field names. Which Cortex XSIAM capability should the administrator use to normalize these fields?

Accepted Answer

A parsing rule attached to the data source.. Normalization of vendor-specific log fields into the XDM schema is the responsibility of parsing rules. These rules run during ingestion, extracting values from raw JSON and mapping them to standard XDM fields so that correlation rules, XQL queries, and dashboards can operate consistently. Correlation rules, dashboards, and playbooks all consume already-normalized data and cannot perform the required mapping.

Answer

A correlation rule that matches the vendor's field names directly.

Answer

A playbook that renames fields after the event is stored.

Answer

A dashboard widget configured with a custom filter.

Question 3

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. In a playbook workflow, the three supported task types are Condition, Manual, and Automated tasks. A Condition task (A) is correct because it evaluates a logical expression or check and branches the workflow based on whether the result is true or false, enabling decision logic. A Manual task (C) is correct because it pauses the workflow and requires a human user to perform an action or provide input before the playbook can continue. An Automated task (D) is correct because it executes a predefined script, command, or integration action without human intervention. The remaining options do not belong: a Database cleanup task (B) is not a distinct playbook task type but rather a specific action that could be implemented inside an Automated task, and an Encryption task (E) is likewise not a separate task category but a function that would be performed by an Automated task or script.

Answer

Database cleanup task

Answer

Encryption task

Question 4

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?

Accepted Answer

User Risk. The User Investigation dashboard or User Risk view in Cortex XDR provides a consolidated view of user-linked alerts and behavioral history.

Answer

Threat Intelligence

Answer

Endpoint Status

Answer

Network Activity

Question 5

Which THREE of the following represent common challenges in SecOps threat intelligence integration that XSOAR helps address?

Accepted Answer

Fragmented and manual workflows. Option B is correct because XSOAR addresses fragmented and manual workflows by orchestrating playbooks that automate repetitive SOC tasks and connect disparate tools through its integration framework, replacing swivel-chair operations with standardized, machine-driven processes. Option C is correct because XSOAR helps reduce the high rate of false positives by enriching indicators with threat intelligence, applying automated deduplication and scoring, and enabling consistent triage logic so analysts focus only on genuine incidents. Option D is correct because XSOAR handles the excessive volume of indicators through indicator extraction, deduplication, and reputation-based scoring, allowing the platform to ingest and process large feeds without overwhelming analysts. Option A is not a typical SecOps threat-intelligence integration challenge XSOAR is designed to solve, since XSOAR itself requires network access to reach external services and threat feeds. Option E is not relevant because XSOAR is a platform-agnostic automation and orchestration layer, and operating system compatibility is not a core challenge in threat-intelligence integration that it addresses.

Answer

Lack of internet connectivity

Answer

Operating system compatibility

Question 6

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

Accepted Answer

Containment, Eradication, and Recovery. The incident response lifecycle as defined by NIST SP 800-61 and supported by Palo Alto Networks tools includes Preparation (E), Detection and Analysis (C), and Containment, Eradication, and Recovery (A). Preparation (E) is the first phase, covering policies, tools, training, and readiness activities such as configuring Cortex XDR, WildFire, and AutoFocus before an incident occurs. Detection and Analysis (C) is where telemetry from sources like Cortex XDR, firewalls, and WildFire is correlated to identify and validate malicious activity. Containment, Eradication, and Recovery (A) is the response phase where threats are isolated, removed, and systems restored, using capabilities such as endpoint isolation and automated playbooks. Public relations campaigning (B) is a communications activity, not a lifecycle phase, and manual hardware procurement (D) is a logistics task unrelated to the standard incident response framework.

Answer

Public relations campaigning

Answer

Manual hardware procurement

Question 7

Which THREE of the following represent common data sources for Cortex XSIAM?

Accepted Answer

Cloud infrastructure logs (e.g., AWS CloudTrail). Cortex XSIAM ingests cloud infrastructure logs such as AWS CloudTrail (A) because CloudTrail provides API activity and audit events from AWS accounts that feed its analytics and detection engines. Endpoint EDR telemetry (B) is a core data source since XSIAM correlates process, file, network, and registry events from endpoint agents to detect and investigate threats. Network firewall traffic logs (C) are also commonly ingested, as they supply connection, allow/deny, and flow metadata used for network-based detections and correlation. Employee payroll database (D) is not a standard security telemetry source and is unrelated to XSIAM's threat detection data ingestion. Coffee machine diagnostic logs (E) are irrelevant operational data with no security detection value for XSIAM.

Answer

Employee payroll database

Answer

Coffee machine diagnostic logs

Question 8

A Cortex XDR administrator needs to ensure that a newly created custom BIOC rule is evaluated against endpoint activity in real time without waiting for the next scheduled rule refresh. The rule must also be able to reference the parent process of the triggering event. Which combination of rule configuration choices should the administrator make?

Accepted Answer

Set the rule to 'Real-time' evaluation mode and include the 'causality' field in the rule condition.. Real-time evaluation causes the BIOC engine to assess endpoint telemetry as it arrives, eliminating the delay inherent in scheduled rule runs. The causality field exposes the parent process chain, allowing a condition to reference the process that spawned the triggering event. Selecting real-time mode together with causality satisfies both the latency and lineage requirements, so the rule fires promptly and can correlate the event with its originating parent process.

Answer

Set the rule to 'Scheduled' evaluation mode and include the 'actor_process_image_name' field in the rule condition.

Answer

Set the rule to 'Scheduled' evaluation mode and include the 'causality' field in the rule condition.

Answer

Set the rule to 'Real-time' evaluation mode and include the 'action_process_image_name' field in the rule condition.

Question 9

A SOC analyst receives a phishing report from an end user. The analyst needs to quickly determine if the email is malicious. Which action should the analyst take FIRST?

Accepted Answer

Check the sender's email address and domain reputation. The first step in phishing triage is to quickly assess the sender's email address and domain reputation. This provides immediate insight into whether the email is likely malicious. If the sender is known to be malicious, the analyst can quickly escalate and take containment actions. If not, further analysis of URLs and attachments can be performed. This approach balances speed and accuracy, avoiding premature actions that could disrupt users or spread the threat.

Answer

Delete the email from the user's mailbox

Answer

Forward the email to all users as a warning

Answer

Analyze the email headers and attachments in a sandbox

Question 10

A Cortex XSOAR administrator needs to ensure that a specific playbook only runs when an incident is created with a severity of 'High' and the incident type is 'Phishing'. Which configuration should they use to enforce this condition?

Accepted Answer

Set the playbook's trigger to filter incidents by severity and type.. Playbook triggers in Cortex XSOAR are designed to automatically start playbooks based on incident attributes. By configuring the trigger to filter on severity and incident type, the administrator ensures the playbook only runs for incidents that match both criteria. Other options either do not prevent the playbook from starting or are unrelated to execution control.

Answer

Create a custom incident field and use it in a playbook task condition.

Answer

Add a Conditional task at the beginning of the playbook to check severity and type.

Answer

Modify the incident type's layout to only show the playbook for high severity incidents.