SecOps-Pro Practice Test 15 — 15 Questions

Question 1

What is the role of a 'Classification' in the context of XSOAR incident management?

Accepted Answer

To identify the type of incident and assign it to the correct playbook. In Cortex XSOAR, a Classification is a mapping rule that examines incoming incident fields (such as the incident type, source, or custom fields) and determines which Incident Type the alert belongs to, which in turn drives which playbook is attached and executed. It is the mechanism that routes raw alerts from integrations into the correct automated response workflow. Without a classification, XSOAR cannot automatically decide which playbook to trigger for a given alert.

Answer

To encrypt the alert content

Answer

To define the severity of the alert

Answer

To list the analysts assigned to the incident

Question 2

In the context of SecOps processes, which TWO of the following are benefits of using automated playbooks for threat intelligence?

Accepted Answer

Consistent enforcement of security policies. Option B is correct because automated playbooks codify response steps and policy checks into repeatable workflows, so every threat-intelligence alert is handled the same way and security policies are enforced consistently rather than varying by analyst or shift. Option D is correct because automation executes enrichment, containment, and remediation actions immediately upon trigger, removing manual delays and thereby reducing Mean Time to Remediate (MTTR). Option A is not correct because playbooks still require human oversight, tuning, and escalation for complex or novel threats, so they do not eliminate analysts. Option C is not correct because playbooks orchestrate security tools and processes; they do not increase hardware performance such as CPU or memory capacity. Option E is not correct because firmware upgrades are a patch-management task, not a threat-intelligence playbook benefit, and should not happen automatically without change control.

Answer

Elimination of the need for human analysts

Answer

Increased hardware performance

Answer

Automatic upgrade of firewall firmware

Question 3

An administrator needs to restrict access to specific sensitive incident logs. Which XSIAM feature should be used to enforce this access control?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) allows administrators to define granular permissions for users and groups.

Answer

Data Retention Policies

Answer

IP Whitelisting

Answer

Detection Rule Exceptions

Question 4

In XSOAR, an analyst wants to share a finding with another team member. Which feature allows for real-time collaboration within the incident workspace?

Accepted Answer

War Room. The War Room allows multiple analysts to comment, run commands, and share findings in a single collaborative interface.

Answer

Work Plan

Answer

Indicator Tab

Answer

Incident Summary

Question 5

Which THREE pieces of information are displayed in the Incident View?

Accepted Answer

Associated alerts.. The incident view provides an overview of the affected entities, the associated alerts, and the status of the investigation.

Answer

The names of all users in the organization.

Answer

The current CPU usage of the cloud console.

Question 6

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.

Question 7

During a threat hunting mission in XDR Query Builder, you need to find all processes running from the 'temp' directory. Which XDR language is utilized?

Accepted Answer

XQL. XDR Query Language (XQL) is used for advanced hunting and data exploration in Cortex XDR.

Answer

Python

Answer

Regex

Answer

SQL

Question 8

You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?

Accepted Answer

Conditional Task. Conditional Task allows you to define branching conditions so that a task only executes if the previous task returned a specific status. This is a core feature in playbook design for controlling flow based on task outcomes. It enables conditional logic without writing custom scripts.

Answer

Data Pipeline

Answer

Task Locking

Answer

Task Transformation scripts

Question 9

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Accepted Answer

BIOCs detect behaviors, IOCs detect static identifiers. BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR detect malicious behaviors — sequences of actions like process injection, credential dumping, or lateral movement — rather than static artifacts. IOCs (Indicators of Compromise) are static identifiers such as file hashes, IP addresses, domains, or registry keys that are matched against telemetry. This behavioral vs. static distinction is the core difference and makes option A correct.

Answer

BIOCs only apply to network logs

Answer

BIOCs are cloud-based, IOCs are endpoint-based

Answer

BIOCs block traffic, IOCs alert

Question 10

Which TWO of the following are considered 'Entities' in the Cortex XSIAM investigation workbench?

Accepted Answer

User. In the Cortex XSIAM investigation workbench, an 'Entity' is a security-relevant object that can be pivoted on and enriched with threat intelligence, and both A (User) and C (Host) are canonical entity types representing accounts and endpoints involved in an incident. Users and hosts are the primary actors and assets that XSIAM correlates across alerts, so they appear as entities in the workbench graph and timeline. The remaining options are not entities: B (Log file size) is a metric about telemetry volume, D (Dashboard color) is a UI display setting, and E (Query execution speed) is a performance measurement of XQL queries, none of which represent an identifiable security object.

Answer

Log file size

Answer

Dashboard color

Answer

Query execution speed

Question 11

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Accepted Answer

Continues to function using locally stored policies.. The agent is designed to continue protecting the endpoint using its locally stored policies and protection engines even when offline.

Answer

Enters a default 'Allow All' state.

Answer

Stops all security monitoring.

Answer

Automatically uninstalls itself.

Question 12

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Accepted Answer

Network flow logs. Network flow logs (A) are a core Cortex XDR data source because the XDR Collectors and Broker VM ingest firewall, proxy, and network traffic telemetry into the Cortex Data Lake, where XQL can query fields such as source/destination IP and port. Endpoint process logs (B) are also correct, since the Cortex XDR agent streams endpoint telemetry including process execution, command-line arguments, and parent-child process relationships that XQL uses in the xdr_data dataset. Cloud service activity logs (E) are correct as well, because Cortex XDR ingests SaaS and cloud audit logs (for example, via the Cortex XDR cloud connectors or the Cortex Data Lake) so XQL can correlate cloud events with endpoint and network activity. Personal employee browser cookies (C) are not a supported data source, as they are personal user data unrelated to security telemetry and would raise privacy and compliance issues. Local printer error logs (D) are not a standard Cortex XDR data source, since printer diagnostics are not ingested by the agent, Collectors, or cloud connectors and are irrelevant to XQL threat hunting.

Answer

Personal employee browser cookies

Answer

Local printer error logs

Question 13

Which THREE items can be performed within the XSIAM Playbook editor?

Accepted Answer

Define incident remediation steps. In the Cortex XSIAM Playbook editor, C is correct because playbooks are built precisely to define and orchestrate incident remediation steps as a sequence of tasks, conditions, and actions that automate response workflows. D is correct because the editor lets you add integration commands and API-based tasks (for example, calling third-party tools through configured integration instances) so external systems can be invoked as part of the playbook. E is correct because the editor supports mapping task outputs to playbook context keys/variables (using the task output schema) so later tasks can reference and transform those values. A is not part of the Playbook editor, since user role and access permissions are managed in RBAC settings under administration, not inside playbook authoring. B is also unrelated, as database replication is an infrastructure/configuration concern handled outside the Playbook editor.

Answer

Manage user role access permissions

Answer

Configure database replication

Question 14

Which TWO of the following are valid ways to deploy the Cortex XDR agent?

Accepted Answer

Manually downloading and installing the agent package.. Option D is correct because the Cortex XDR agent can be deployed manually by downloading the installation package (MSI for Windows, PKG/DMG for macOS, or RPM/DEB for Linux) from the Cortex XDR console or support portal and running the installer locally on the endpoint. Option E is correct because the agent package can be distributed at scale through third-party software distribution or endpoint management systems such as Microsoft SCCM, allowing silent installation across many endpoints. Option A is not a valid deployment method because the console does not send an email link that installs the agent; email is only used for notifications or registration invitations, not for agent installation. Option B is incorrect because the Cortex XDR agent is not delivered through the Windows Update service, which only distributes Microsoft and driver updates. Option C is incorrect because a browser cannot push and install a system-level agent onto an endpoint; browsers lack the privileges and mechanism to perform such an installation.

Answer

Using an email link sent by the console.

Answer

Installing it through the Windows Update service.

Answer

Pushing the agent via the browser.

Question 15

An investigation indicates a process is being blocked by Cortex XSIAM's agent. Where can you find the specific block event log?

Accepted Answer

XQL Query Results for XDR data. When the Cortex XSIAM agent blocks a process, the block event is recorded as endpoint telemetry and is queryable via XQL against the XDR dataset. The XQL Query Results view lets you search and filter these events by fields such as action, process name, and agent ID, making it the correct place to find the specific block event log. This is where analysts perform forensic queries on raw and normalized endpoint events.

Answer

Endpoint Security Settings

Answer

Dashboard widgets

Answer

Playbook history