SecOps-Pro Practice Test 13 — 15 Questions

Question 1

Which THREE of the following represent common challenges in SecOps threat intelligence integration that XSOAR helps address?

Accepted Answer

Fragmented and manual workflows. Data volume, false positives, and fragmented workflows are the top three challenges.

Answer

Lack of internet connectivity

Answer

Operating system compatibility

Question 2

You are creating a new detection rule. How do you ensure it only alerts on specific high-severity events?

Accepted Answer

By applying a severity filter in the detection rule configuration. Detection rules include severity settings that allow filtering and prioritization of alerts.

Answer

By editing the dashboard widget settings

Answer

By modifying the XQL query syntax

Answer

By creating a playbook that changes severity

Question 3

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Accepted Answer

actor_process_command_line. The command line arguments contain the encoded script block, which is essential for detecting obfuscated PowerShell activity.

Answer

file_hash

Answer

target_process_path

Answer

process_name

Question 4

In the Cortex XDR console, where can you see the current status of all your endpoints?

Accepted Answer

Endpoint Inventory. The Endpoint Inventory (or Endpoint view) lists all managed agents and their current connectivity and health status.

Answer

System logs

Answer

Alerts dashboard

Answer

Policy management

Question 5

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Accepted Answer

Alert Exclusion. Alert Exclusions allow you to define criteria to suppress specific alerts based on process, user, or hash.

Answer

Agent Uninstallation

Answer

Policy Deletion

Answer

Threat Intel Ingestion

Question 6

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Creating a Hash-based Blocklist (IOC) is the standard, enterprise-wide method to block known malicious files.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 7

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Accepted Answer

Cortex XDR Collector. Cortex XDR Collectors are used to ingest logs and telemetry from third-party sources and infrastructure.

Answer

Cortex Data Lake

Answer

Broker Service

Answer

Cortex XDR Agent

Question 8

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Accepted Answer

View current agent status.. The inventory page is for managing endpoint state, such as grouping them or viewing their status.

Answer

Configure global firewall settings.

Answer

Change the agent's source code.

Answer

Update the agent's OS.

Question 9

During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?

Accepted Answer

WildFire. WildFire is the cloud-based malware analysis service that tracks global file reputation.

Answer

Cortex XDR

Answer

Threat Vault

Answer

GlobalProtect

Question 10

An incident requires forensic acquisition of a compromised endpoint. Which feature within Cortex XDR enables you to pull specific file artifacts directly from the machine?

Accepted Answer

Retrieve File. Cortex XDR's 'Retrieve File' action allows analysts to pull forensic artifacts from endpoints.

Answer

Live Terminal

Answer

Scan Endpoint

Answer

Quarantine File

Question 11

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Accepted Answer

BIOCs detect behaviors, IOCs detect static identifiers. BIOC rules detect sequences of actions or behaviors, while IOCs look for static identifiers like hashes.

Answer

BIOCs only apply to network logs

Answer

BIOCs are cloud-based, IOCs are endpoint-based

Answer

BIOCs block traffic, IOCs alert

Question 12

During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?

Accepted Answer

Manual Incident Creation. Cortex XDR uses Incident Stitching based on causality and correlation logic to group related alerts into an incident automatically or manually.

Answer

Alert Grouping policy

Answer

Alert Suppression

Answer

Correlation Rule Execution

Question 13

Which view in the Cortex XDR console provides the most comprehensive timeline of all activities related to a specific endpoint?

Accepted Answer

Endpoint View. The Endpoint View provides a detailed historical log of processes, network connections, and file modifications on a per-host basis.

Answer

Alert View

Answer

Incident View

Answer

Dashboard View

Question 14

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Adding an exception for that specific process or behavior path allows the administrative script to run while keeping the BIOC active for other threats.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.

Question 15

You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?

Accepted Answer

${indicatorsList[0]}. Cortex XSOAR uses the ${var[index]} notation for list access in task inputs.

Answer

$indicatorsList(0)

Answer

${indicatorsList.[0]}

Answer

indicatorsList{0}