SecOps-Pro Practice Test 11 — 15 Questions

Question 1

Which TWO settings are configurable within an Integration Instance?

Accepted Answer

Integration timeout. Within an Integration Instance, the Integration timeout (A) is configurable because each instance defines how long the integration command may run before it is aborted, allowing tuning per instance to match the target system's response characteristics. Proxy settings (C) are also configurable at the Integration Instance level, since an instance can be routed through a specific proxy (or no proxy) to reach an on-prem or external endpoint. Incident retention policy (B) is a system/instance-wide data management setting, not part of an integration instance's configuration. Playbook triggering logic (D) belongs to playbook configuration (triggers, tasks, and conditions), not to the integration instance. Indicator expiration time (E) is governed by indicator type/reputation settings, not by an integration instance.

Answer

Incident retention policy

Answer

Playbook triggering logic

Answer

Indicator expiration time

Question 2

Which TWO types of logs are critical for investigating a potential data exfiltration event?

Accepted Answer

Traffic logs. Traffic logs and file access/system logs are necessary to reconstruct data exfiltration movements.

Answer

Printer configuration logs

Answer

Power management logs

Answer

Room temperature logs

Question 3

Which TWO of the following are valid ways to ingest log data into Cortex XSIAM?

Accepted Answer

API-based ingestion. API-based ingestion (A) is correct because Cortex XSIAM supports programmatic data ingestion through its public APIs, allowing external sources and custom integrations to push logs directly into the platform. XSIAM Log Collector (B) is correct because it is the dedicated broker/collector component used to receive and forward logs from various sources into XSIAM, supporting both agent-based and agentless collection. Manual file upload through the browser (C) is not a supported ingestion method for ongoing log data, as XSIAM is designed for automated, scalable data pipelines rather than ad hoc uploads. Physical media shipping (D) is not part of XSIAM's ingestion architecture, which relies on network-based collection rather than offline transfer. Direct database query connection (E) is not a valid ingestion method, since XSIAM does not ingest logs by querying source databases directly; data must be sent via supported collectors or APIs.

Answer

Manual file upload through the browser

Answer

Physical media shipping

Answer

Direct database query connection

Question 4

An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?

Accepted Answer

Report Builder. Report Builder in Cortex XSIAM allows analysts to create customized reports with data from incidents, cases, and other sources. It supports scheduling recurring reports, making it ideal for providing regular trend summaries to management. This feature automates the generation and distribution of reports, saving time and ensuring consistency.

Answer

Incident Feed

Answer

Case Summary Widget

Answer

Playbook documentation

Question 5

In Cortex XSOAR, which feature allows you to automatically create an incident when a specific email is received in a monitored inbox?

Accepted Answer

Mail Listener. The Mail Listener in Cortex XSOAR is a built-in integration that monitors a dedicated mailbox (e.g., via IMAP or Exchange Web Services) and automatically creates incidents from incoming emails. It is designed specifically for email-driven incident creation, allowing security teams to ingest alerts, phishing reports, or other email-based notifications without manual intervention. The Mail Listener continuously polls the inbox and applies parsing rules to extract relevant fields, then generates a new incident in XSOAR. This makes it the correct feature for automatically creating incidents from received emails.

Answer

Incident Classifier

Answer

Data collection rule

Answer

Automation script

Question 6

Which of the following describes the 'Agent Content' component?

Accepted Answer

The latest threat signatures and detection logic.. Agent Content in Cortex XDR refers to the latest threat signatures and detection logic that are delivered to the agent. It is regularly updated to ensure the agent can detect new threats. It is not the configuration file, logs, or executable.

Answer

The configuration file for the agent.

Answer

The logs generated by the agent.

Answer

The main executable file of the agent.

Question 7

A security operations center (SOC) receives a report that a nation-state actor is targeting the organization's industry. The report includes indicators of compromise (IOCs) such as IP addresses, domain names, and file hashes. The SOC manager wants to prioritize the response efforts based on the threat actor's known tactics, techniques, and procedures (TTPs). Which framework should the SOC use to map the observed TTPs to a standardized knowledge base for prioritization?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the de facto standard for mapping adversary TTPs to a structured knowledge base. It allows SOC teams to translate threat intelligence into actionable defenses by identifying specific techniques used by the actor. The other frameworks provide broader or different perspectives but lack the detailed TTP catalog necessary for this scenario.

Answer

NIST Cybersecurity Framework

Answer

Cyber Kill Chain

Answer

Diamond Model

Question 8

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious outbound connection from a server to an unknown external IP. To determine if this connection is part of a larger attack, the analyst wants to see all other endpoints that communicated with the same external IP within the last 24 hours. Which Cortex XDR query should the analyst run?

Accepted Answer

dataset = xdr_data | filter action_remote_ip = "<external_ip>" | fields agent_hostname, action_remote_ip, timestamp. The correct query filters the xdr_data dataset by the remote IP address and projects the hostname, remote IP, and timestamp. This provides a list of all endpoints that communicated with the suspicious external IP, along with when those connections occurred. The other queries either filter on the wrong field, target process events instead of network events, or remove critical context through deduplication.

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "<external_ip>" | fields agent_hostname, timestamp

Answer

dataset = xdr_data | filter action_local_ip = "<external_ip>" | fields agent_hostname, action_local_ip, timestamp

Answer

dataset = xdr_data | filter action_remote_ip = "<external_ip>" | dedup agent_hostname | fields agent_hostname

Question 9

Your organization has adopted a Zero Trust architecture. Which SOC operational process is most critical to validate that identity-based policies are effective?

Accepted Answer

User Behavior Analytics. User Behavior Analytics (UBA) and identity monitoring are central to verifying Zero Trust policies.

Answer

Hardware Lifecycle

Answer

Patch Management

Answer

Vulnerability Scanning

Question 10

What happens if a playbook task is configured to 'Continue on error' and the task fails?

Accepted Answer

The playbook proceeds to the next task. When a playbook task is configured with 'Continue on error', a failure of that task does not halt the playbook; execution proceeds to the next task in the flow. This is used for non-critical steps where a failure should be logged but not block the overall response. The error is typically recorded in the task output or war room for later review.

Answer

The incident is closed

Answer

The playbook stops immediately

Answer

The task is automatically retried

Question 11

Which THREE methods can be used in Cortex XSOAR to ingest indicators?

Accepted Answer

Manual entry via the UI. Option B (Manual entry via the UI) is correct because Cortex XSOAR allows analysts to create indicators directly through the Indicators page or the indicator creation form, populating fields such as indicator type, value, and reputation. Option C (Auto-extraction from incidents) is correct because XSOAR can automatically extract indicators from incident artifacts, evidence, and task outputs using indicator extraction rules and the built-in extractIndicators command, then push them into the indicators database. Option D (Integrated threat intelligence feeds) is correct because XSOAR supports ingesting indicators from external TI sources via integrations and feed configurations (e.g., TIM feeds, threat intel management), which fetch and store indicators on a schedule. Option A (Direct database SQL injection) is not a supported ingestion method and is a security attack, not a feature. Option E (Hardware port mirroring) is a network capture technique and is unrelated to how XSOAR ingests indicators.

Answer

Direct database SQL injection

Answer

Hardware port mirroring

Question 12

What is the primary benefit of using Cortex XSIAM's 'Unified SOC' capability?

Accepted Answer

It consolidates EDR, SIEM, and SOAR into one interface. Consolidation of functions eliminates the need to jump between separate tools for EDR, SIEM, and SOAR.

Answer

It limits the amount of raw data stored

Answer

It allows users to switch between different browser tabs for tools

Answer

It increases the number of licenses required

Question 13

A SOC analyst receives an alert from Cortex XDR indicating that a process on a finance workstation attempted to write to a suspicious registry key commonly associated with persistence. The analyst needs to quickly determine if this activity is part of a known benign software update or a true threat. Which Cortex XDR feature should the analyst use to gain immediate context about the process and its behavior?

Accepted Answer

Causality Chain. The Causality Chain is a core Cortex XDR investigation feature that reconstructs the sequence of events leading to an alert. By viewing the parent-child process relationships and command lines, the analyst can quickly assess whether the registry write is from a trusted updater or an attacker. This directly addresses the need for immediate context about the process and its behavior.

Answer

Threat Intelligence Platform

Answer

Vulnerability Assessment Scan

Answer

Endpoint DLP Policy

Question 14

A SOC manager is designing a new operational process for handling advanced persistent threats (APTs) that span multiple weeks. The process must ensure that analysts can track the full scope of the campaign and coordinate response efforts across shifts. Which TWO Cortex XDR features should be integrated into this process to meet these requirements? (Choose two.)

Accepted Answer

Incident notes and collaboration features within the incident view. Incident grouping consolidates related alerts into a single case, providing a holistic view of the APT campaign. Incident notes and collaboration features enable analysts to document and share findings across shifts, ensuring continuity. Together, these features support tracking the full scope and coordinating response efforts over extended periods.

Answer

Endpoint isolation policy applied to all affected endpoints

Answer

Custom dashboards with widgets for alert trends and analyst workload

Answer

Automated playbook execution for each alert without grouping

Question 15

An analyst is investigating an alert where a process launched by Microsoft Word spawned a child process that executed an encoded PowerShell command. The analyst wants to view the full process lineage, including parent-child relationships and command-line arguments, for this specific alert. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality View. Causality View is the correct feature because it visualizes the process tree and provides detailed metadata such as command-line arguments, parent-child relationships, and execution timestamps. This allows the analyst to trace the sequence of events from the initial Word process to the spawned PowerShell command, which is essential for understanding the attack chain and determining the scope of the incident.

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Answer

Endpoint DLP Policy