SecOps-Pro Practice Test 13 — 15 Questions

Question 1

An analyst is reviewing an incident in Cortex XSOAR that contains an IP indicator. They want to automatically enrich this indicator with geolocation and reputation data from a third-party service during playbook execution. Which Cortex XSOAR component is specifically designed to perform this enrichment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook task using an integration command. The correct answer is a playbook task using an integration command. In Cortex XSOAR, enrichment is typically automated by adding tasks to a playbook that execute commands from configured integrations. These tasks can retrieve geolocation, reputation, and other data for indicators, and the results are stored in the incident context for further analysis or decision-making.

Answer

Indicator query in the threat intelligence management (TIM) module

Answer

Classification and mapping rules

Answer

Incident type configuration

Question 2

A security analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious IP address communicating with an internal server. To determine if this IP is associated with known malicious activity, the analyst queries a threat intelligence platform. The platform returns a confidence score of 85% and tags the IP as 'C2'. However, the analyst notices that the IP belongs to a cloud hosting provider and could be legitimate. What should the analyst do next to validate the threat intelligence?

Accepted Answer

Correlate the IP with additional internal telemetry, such as proxy logs and endpoint data, to assess the context of the communication.. The analyst should correlate the IP with internal telemetry to understand the communication's context. This validation step is essential when threat intelligence has ambiguity, such as an IP from a cloud provider. It allows the analyst to make an informed decision about whether to block, monitor, or dismiss the indicator.

Answer

Immediately block the IP at the firewall based on the high confidence score.

Answer

Ignore the threat intelligence because the IP is from a cloud provider and likely legitimate.

Answer

Submit the IP to a public blocklist to prevent other organizations from communicating with it.

Question 3

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious process on an endpoint that is communicating with an external IP address. To determine the full scope of the incident, the analyst needs to retrieve all network connections initiated by that process and any child processes. Which Cortex XDR action should the analyst take to efficiently gather this information?

Accepted Answer

Use the Cortex XDR Causality Chain to view the process and its network connections.. The Causality Chain is the optimal tool because it integrates process execution and network connection telemetry, allowing the analyst to see all connections made by the suspicious process and its children in a single view. This accelerates incident scoping and root cause analysis, unlike manual methods or signature-based scans.

Answer

Create an XQL query to search for all network connections from the endpoint and manually filter by process name.

Answer

Run a live terminal session on the endpoint and use netstat -ano to list connections.

Answer

Initiate a malware scan on the endpoint to identify the process and its network activity.

Question 4

A Cortex XSOAR analyst is designing a playbook that must automatically enrich every new phishing alert by querying VirusTotal, then create a ticket in ServiceNow only when the verdict is malicious. Which playbook construct should the analyst use to branch execution based on the enrichment verdict?

Accepted Answer

A conditional task that evaluates the VirusTotal verdict and routes execution down the malicious or benign path. Conditional tasks are the XSOAR construct designed for decision logic: they inspect the output of prior tasks and route execution down different branches. This allows the playbook to create a ServiceNow ticket only when the enrichment verdict is malicious, while benign alerts follow a separate closure path without human intervention.

Answer

A section header task that groups the enrichment commands into a labeled block

Answer

A manual task that assigns the alert to the SOC queue for triage

Answer

A data collection task that prompts the analyst to manually choose the verdict

Question 5

A SOC analyst is building a scheduled XQL query in Cortex XSIAM that must run every 15 minutes and automatically create a high-severity incident whenever a Cortex XDR endpoint generates a 'Malware Detected' event on a server asset. The analyst has written the query and validated the results manually. Which XSIAM component must the analyst configure to make this query run on a schedule and generate the incident automatically?

Accepted Answer

A Correlation Rule in the Detection Rules engine that references the saved XQL query and defines the severity and incident fields.. Detection engineering in Cortex XSIAM centers on Correlation Rules, which bind an XQL query to a schedule and to incident-generation settings such as severity, category, and field mapping. The analyst has already validated the query, so the remaining work is scheduling and incident creation, both native to a Correlation Rule. Reports, dashboard widgets, and playbook triggers all operate after detection or serve presentation, so none creates the required automatic high-severity incident.

Answer

A Playbook trigger defined on the Cortex XDR 'Malware Detected' event type with a cron schedule of every 15 minutes.

Answer

A Report Template that includes the XQL query as a data source and is scheduled for delivery every 15 minutes.

Answer

A Dashboard widget bound to the XQL query with a 15-minute refresh interval and a severity threshold configured on the widget.

Question 6

A SOC analyst receives a Cortex XDR alert indicating that a workstation attempted to contact a domain associated with a known malware family. The analyst confirms the domain is malicious and wants to prevent any further communication from the endpoint to that domain while keeping the endpoint online for continued investigation. Which Cortex XDR response action should the analyst take?

Accepted Answer

Add the domain to a block list in the Cortex XDR policy so the agent blocks resolution and connection attempts to it.. The analyst has confirmed the domain is malicious and wants targeted containment that preserves the endpoint's usability. Adding the domain to the Cortex XDR block list causes the endpoint agent to block resolution and connection attempts to that specific domain, stopping the malicious traffic while keeping the host online. Full isolation is too broad, and process termination or scanning do not directly block the domain communication.

Answer

Run a full malware scan on the endpoint and wait for the results before taking any network action.

Answer

Isolate the endpoint from the network entirely using the endpoint isolation action.

Answer

Terminate the offending process and delete the associated file from the endpoint.

Question 7

A Cortex XSIAM administrator is designing a detection strategy for credential abuse. The administrator wants to leverage XQL to identify suspicious authentication behavior. Which two XQL capabilities should the administrator use to detect a user account that authenticates successfully from multiple geographically distant locations within a short time window? (Choose two.)

Accepted Answer

Use the comp function to aggregate distinct source locations per user within each time bucket.. Detecting impossible travel in XQL requires bucketing authentication events by time and then aggregating distinct source locations per user within those buckets. The bin function creates the time windows, and the comp function counts distinct locations, exposing users who authenticated from multiple distant geographies in a short period. Joining with process events, deduplicating, or filtering out successful logins do not produce this specific detection.

Answer

Use the filter stage to exclude all successful authentications from the query results.

Answer

Use the join function to combine authentication events with endpoint process events.

Answer

Use the dedup function to remove duplicate authentication events from the dataset.

Question 8

A security engineer is onboarding a new firewall log source into Cortex XSIAM. Raw logs are arriving in the tenant and are visible in the raw data view, but the parsed events show empty fields for source IP, destination IP, and action, and no incidents are being generated from this source. The engineer needs to correct the parsing so the fields populate and detections can fire. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Create or update a parsing rule in the data normalization configuration that maps the raw log fields to the XDM schema attributes.. When raw events arrive but XDM fields remain empty, the fault lies in the normalization path: either the raw fields lack mappings to XDM attributes, or the source is not associated with the dataset and vendor/product that selects the correct parser. Both must be addressed together, since a correct mapping on a misrouted source never executes. Retention, endpoint agents, and licensing tiers cannot populate missing fields or restore detection coverage for this firewall source.

Answer

Enable the Cortex XSIAM agent on the firewall appliance so the logs can be normalized locally before forwarding.

Answer

Raise the ingestion license tier so additional parsing capacity is allocated to the tenant for this source.

Answer

Increase the retention period of the raw logs dataset so the parser has more time to process the backlog of events.

Question 9

A Cortex XSIAM administrator wants to give a new analyst the ability to view and triage incidents but not to modify playbooks or system configurations. Which Cortex XSIAM mechanism should the administrator use to enforce this?

Accepted Answer

Role-based access control with a role scoped to incident handling permissions.. Role-based access control is the correct mechanism for granting a user the ability to view and triage incidents while denying playbook and system configuration changes. Assigning a properly scoped role enforces least privilege within a single tenant. Separate tenants, shared API keys, and dashboard sharing do not provide the granular, per-user permission control required.

Answer

A dashboard shared with the analyst's user group.

Answer

An API key with read-only scope shared with the analyst.

Answer

A separate Cortex XSIAM tenant dedicated to the new analyst.

Question 10

During a Cortex XDR investigation, an analyst notices that a single suspicious process spawned multiple child processes, created several files, and made outbound network connections over a short period. The analyst wants to preserve the entire set of related events and artifacts as a single unit so that other team members can review the full context rather than individual alerts. Which Cortex XDR feature should the analyst use to group these related events into one reviewable entity?

Accepted Answer

Create a new incident and add the related alerts and events to it, so the full context is grouped for collaborative review.. Cortex XDR incidents serve as the grouping mechanism that consolidates related alerts and events into a single entity for collaborative review. Creating an incident and adding the related alerts and events preserves the full context, including process lineage and linked artifacts, so teammates can examine the complete picture. Exporting to CSV, creating watchlist entries, or saving an XQL report do not produce a unified, reviewable incident.

Answer

Export the raw events to a CSV file and share it with the team through email.

Answer

Create a new XQL query that returns all the events and save it as a scheduled report.

Answer

Add each event to a separate watchlist entry so they can be tracked individually.

Question 11

A SOC manager wants Cortex XSIAM to automatically contain a compromised endpoint the moment a 'Credential Dumping' incident is created, but only when the affected asset is tagged as a production server. The team already has a playbook that performs endpoint isolation. The manager wants the playbook to run only under those precise conditions without modifying the playbook's internal tasks. Where should the manager configure this conditional execution?

Accepted Answer

In the playbook trigger configuration, by setting the trigger to the incident type and adding a filter condition that requires the asset tag to equal production server.. Conditional automation in Cortex XSIAM belongs at the playbook trigger, which supports filtering by incident attributes and asset metadata such as tags. Placing the production server condition there means only matching credential dumping incidents invoke the existing isolation playbook, honoring the requirement not to alter the playbook's tasks. Field mapping and endpoint policies serve different purposes and cannot gate playbook execution, while editing the playbook violates the stated constraint.

Answer

In the endpoint policy for the production server group, by enabling auto-isolation when a credential dumping alert is detected.

Answer

In the incident field mapping configuration, by mapping the asset tag to a severity field so only production servers reach high severity.

Answer

Inside the playbook, by adding a conditional task before the isolation step that checks the asset tag value.

Question 12

You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?

Accepted Answer

Main Account. In a Cortex XSOAR multi-tenant deployment, playbooks intended for sharing across tenants must be placed in the Main Account, which acts as the parent tenant and distributes content to child tenants. Content in the Main Account is visible and usable by all child tenants, enabling centralized playbook management.

Answer

Private Content Folder

Answer

Child Tenant

Answer

Integration Settings

Question 13

An analyst is reviewing a Cortex XDR alert where a user's credentials were used to authenticate from an IP address in a foreign country, but the user is known to be on a business trip in that country. The analyst wants to determine whether this is a true positive or a false positive. Which Cortex XDR feature should the analyst use to correlate this authentication event with other activity from the same user and endpoint over time?

Accepted Answer

Causality view. Causality view is designed to correlate related events and alerts into a causal chain, providing context around a specific alert. By examining the sequence of activities associated with the user and endpoint, the analyst can see if the foreign login was followed by suspicious actions, which would indicate a true positive, or if it was an isolated legitimate event.

Answer

Threat Intelligence dashboard

Answer

Endpoint isolation policy

Answer

Incident response playbook

Question 14

Which type of alert in Cortex XDR represents a high-confidence threat that has been automatically grouped with related events?

Accepted Answer

Incident. An Incident in Cortex XDR is a collection of related alerts that represent a single threat narrative.

Answer

Log

Answer

Indicator

Answer

Exclusion

Answer

Exception

Question 15

What is the primary purpose of a SOC 'Daily Standup' meeting?

Accepted Answer

Operational alignment and incident status sync. The daily standup is for operational alignment, shift handovers, and discussing urgent high-priority incidents.

Answer

Technical training

Answer

Vendor management

Answer

Long-term strategy planning