SecOps-Pro Practice Test 12 — 15 Questions

Question 1

A Cortex XDR administrator is configuring a new External Data Ingestion (EDI) integration to collect logs from a third-party cloud application. The administrator needs to ensure that the logs are parsed and mapped to Cortex XDR's data model for correlation with endpoint telemetry. Which configuration step is mandatory to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a unique dataset name and define field mappings in the EDI integration configuration.. External Data Ingestion requires that incoming logs are parsed and mapped to Cortex XDR's data model. This is achieved by defining a dataset name and specifying field mappings during integration setup. Without these mappings, the data remains unstructured and cannot be correlated with endpoint telemetry, rendering it ineffective for detection and response.

Answer

Define a custom parsing rule in the Cortex XDR XQL query editor.

Answer

Enable the Cortex XDR Data Lake and select the third-party application from the predefined list.

Answer

Create a Broker VM and install the third-party application's agent on it.

Question 2

You are creating a new detection rule. How do you ensure it only alerts on specific high-severity events?

Accepted Answer

By applying a severity filter in the detection rule configuration. In Cortex XSIAM/XDR detection rules, you can apply a severity filter directly in the rule configuration to ensure the rule only triggers alerts for events that meet specific severity criteria. This is done by defining conditions on the severity field within the rule logic, so only high-severity events generate alerts.

Answer

By editing the dashboard widget settings

Answer

By modifying the XQL query syntax

Answer

By creating a playbook that changes severity

Question 3

In the Cortex XDR console, where can you see the current status of all your endpoints?

Accepted Answer

Endpoint Inventory. The Endpoint Inventory in the Cortex XDR console provides a consolidated view of all registered endpoints, including their online/offline status, agent version, OS, and last check-in. It is the designated place to monitor endpoint health and coverage. This directly answers where to see the current status of all endpoints.

Answer

System logs

Answer

Alerts dashboard

Answer

Policy management

Question 4

Which TWO actions are considered 'Best Practices' for maintaining SOC operational documentation?

Accepted Answer

Maintain clear version control. Option D (Maintain clear version control) is correct because SOC runbooks, playbooks, and escalation procedures change as tools, threats, and personnel evolve, so version control ensures responders always work from the current approved revision and can trace what changed and why. Option E (Regular review and update cycles) is correct because scheduled reviews keep documentation aligned with current detection rules, contact lists, tooling, and compliance requirements, preventing stale procedures from degrading incident response. Options A, B, and C are not best practices: printed-only binders are hard to update and search, restricting access to the manager only creates a bottleneck and single point of failure during incidents, and creating documentation only once guarantees it becomes outdated as the environment changes.

Answer

Store only in printed binders

Answer

Limit access to the manager only

Answer

Create documentation only once

Question 5

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Accepted Answer

Cortex XDR Collector. The Cortex XDR Collector is the component designed to ingest logs and data from non-endpoint sources such as network devices, firewalls, and third-party systems. It forwards this telemetry into Cortex XDR for correlation and analytics. This makes it the correct answer for collecting from non-endpoint sources.

Answer

Cortex Data Lake

Answer

Broker Service

Answer

Cortex XDR Agent

Question 6

A SOC manager wants to track the 'Mean Time to Acknowledge' (MTTA) for critical incidents. Which feature in Cortex XSOAR provides this visualization?

Accepted Answer

Dashboard Metrics. Dashboard Metrics in Cortex XSOAR provides configurable widgets and reports that can compute and visualize incident KPIs such as MTTA, MTTR, and incident volume. SOC managers use dashboards to track these operational metrics over time and by severity.

Answer

Playbook Indicators

Answer

War Room logs

Answer

Incident Layouts

Question 7

A SOC analyst is investigating a suspected data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 30 days. The organization uses Cortex XDR with Cortex Data Lake for log retention. Which Cortex XDR query should the analyst use to search for network connections to that IP?

Accepted Answer

Use the Cortex XDR Query Builder and select the 'Network Connections' dataset, filtering by remote IP address.. The correct approach is to use the Cortex XDR Query Builder to search the Network Connections dataset for the malicious IP. This leverages Cortex Data Lake's retained logs to identify all internal hosts that communicated with the IP over the past 30 days. This method is efficient and provides historical context necessary for scoping the incident.

Answer

Use the Cortex XSOAR incident timeline to search for the IP address.

Answer

Run a Cortex XDR script on all endpoints to check active network connections.

Answer

Check the Cortex XDR alert table for any alerts mentioning the IP address.

Question 8

A SOC analyst is reviewing the daily dashboard in Cortex XDR and notices a high number of 'Benign' severity alerts. To reduce alert fatigue and focus on critical threats, which action should the analyst take?

Accepted Answer

Create a custom alert exclusion rule to filter out Benign alerts.. Creating a custom alert exclusion rule for Benign severity alerts is the most effective way to reduce noise without losing critical detection coverage. This targeted approach allows the SOC to suppress only the non-actionable alerts while continuing to monitor for higher-severity threats. It also aligns with operational efficiency and helps maintain analyst focus on incidents that truly require investigation.

Answer

Disable the specific detection rule that generates the Benign alerts.

Answer

Assign the Benign alerts to a junior analyst for manual review.

Answer

Increase the severity threshold for all alerts to 'Medium' or higher.

Question 9

A SOC analyst at a financial institution receives an alert from Cortex XSIAM indicating a possible data exfiltration attempt. The analyst needs to quickly determine which internal host initiated the connection and which external IP it communicated with. Which Cortex XSIAM feature should the analyst use to visualize this relationship?

Accepted Answer

Cortex XSIAM Incident Graph. The Incident Graph in Cortex XSIAM is designed to provide a visual, interactive map of all entities and their relationships within an incident. For a data exfiltration alert, this allows the analyst to immediately see the internal host and the external IP it connected to, along with any other related artifacts. This accelerates triage and supports informed decision-making.

Answer

Cortex XSIAM Query Builder

Answer

Cortex XSIAM Automation Rules

Answer

Cortex XSIAM Threat Intelligence Management

Question 10

During a malware investigation in Cortex XSOAR, an analyst sees that an indicator's reputation has been automatically downgraded from 'Bad' to 'Suspicious' even though no analyst modified it. The indicator was originally ingested from a trusted threat feed. Which mechanism most likely caused this change?

Accepted Answer

The threat feed integration's reputation was reduced because of a feed reliability score or source confidence change, altering the aggregated indicator score.. Indicator reputation in Cortex XSOAR is calculated from contributing sources, each with a reliability or confidence score. When a feed's reliability score changes, the aggregated reputation is recalculated, which can move an indicator from Bad to Suspicious without any analyst action. This is the only mechanism among the choices that inherently alters reputation based on source trust rather than lifecycle or manual events.

Answer

A deduplication process merged the indicator with a duplicate that had a lower reputation, and the merged record inherited the lower value.

Answer

The indicator's expiration time elapsed, and the system automatically recalculated its reputation based on remaining active sources.

Answer

The indicator was manually excluded from the blocklist by a playbook, which immediately lowered its reputation to Suspicious.

Question 11

A security analyst wants to block a known malicious hash across all endpoints managed by Cortex XDR. Which component should the analyst use to enforce this block?

Accepted Answer

Indicators of Compromise (IoC) Policy. IoC Policies are specifically designed to let administrators define custom indicators, including file hashes, and apply actions such as block or alert across the environment. By adding the malicious hash to an IoC policy, the analyst ensures that the Cortex XDR agent blocks its execution on all managed endpoints, providing a precise and immediate mitigation.

Answer

Malware Policy

Answer

Behavioral Threat Protection (BTP) Rule

Answer

Exploit Protection Profile

Question 12

A Cortex XDR analyst is investigating a suspected ransomware incident on a Windows endpoint. The analyst has identified the malicious process but needs to quickly determine whether it spawned any child processes and what those children did. Which feature within the Cortex XDR console provides this information in a visual timeline?

Accepted Answer

Causality View. Causality View is designed to visualize the sequence and relationships of processes, including parent-child links, on an endpoint. For a ransomware investigation, it enables the analyst to rapidly trace how the malicious process spawned child processes and what actions they performed. Other features like Process Execution History or Endpoint Investigation lack the integrated visual timeline, making them less efficient for this specific need.

Answer

Alert Triage

Answer

Process Execution History

Answer

Endpoint Investigation

Question 13

During playbook development, an engineer needs to store a list of suspicious IP addresses extracted from an incident into a context key that can be accessed by multiple tasks. Which context key should they use to ensure the data is available throughout the playbook?

Accepted Answer

Playbook context. Playbook context is the appropriate place to store data that needs to be shared across tasks within a playbook. It provides a temporary storage area that is scoped to the playbook run. Incident context is for incident-level data, global context persists across incidents, and integration context is for integration-specific data.

Answer

Integration context

Answer

Global context

Answer

Incident context

Question 14

A Cortex XDR analyst is troubleshooting why a specific endpoint is not sending telemetry to the console. The analyst checks the agent status and sees that it is connected but no new events are appearing. Which action should the analyst take first to diagnose the issue?

Accepted Answer

Verify the agent's policy for telemetry collection settings.. The agent is connected but not sending telemetry, which points to a policy issue rather than connectivity. Telemetry collection settings in the agent policy control what data is sent. Verifying these settings is the quickest and least disruptive first step. Other actions like restarting or reinstalling are more invasive and unlikely to fix a policy misconfiguration.

Answer

Restart the Cortex XDR agent service on the endpoint.

Answer

Check the network firewall for blocked traffic on port 443.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Question 15

You are designing a playbook that must extract indicators from an incident's attachments. The attachments can be of various file types, including PDF and text. You want to use a built-in script to extract indicators such as IPs, URLs, and hashes from these files. Which Cortex XSOAR script should you use for this purpose?

Accepted Answer

ExtractIndicatorsFromAttachments. The correct script is ExtractIndicatorsFromAttachments, which is a built-in automation that processes file attachments and extracts indicators using the indicator extraction engine. It supports multiple file types and is designed for playbook use. Other options either are not suitable for attachments, do not exist, or serve different purposes. This script enables automated enrichment and response based on indicators found in files.

Answer

FileEnrichment

Answer

ParseAttachment

Answer

ExtractIndicators