SecOps-Pro Practice Test 16 — 15 Questions

Question 1

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 2

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Accepted Answer

Indicator Extraction. Indicator Extraction in Cortex XSOAR is the component that automatically parses raw text (such as log strings, email bodies, or incident fields) to identify and extract indicators like IP addresses, domains, URLs, and email addresses. It uses predefined regex patterns and can be configured per incident type, then enriches those indicators via integrations. This is exactly what is needed to structure an email address from a raw log string.

Answer

Playbook Workflow

Answer

War Room Note

Answer

Incident Layout

Question 3

A Tier 1 SOC analyst receives an alert about a suspicious login attempt. According to the SOC escalation matrix, which action should the analyst take first?

Accepted Answer

Validate the alert by checking the source IP and user activity. The correct first action is to validate the alert by examining the source IP and user activity. This step is fundamental in SOC triage and is typically mandated by the escalation matrix. It prevents unnecessary escalations and ensures that only credible threats are passed to higher tiers, optimizing resource use and response accuracy.

Answer

Immediately escalate to Tier 2 for further investigation

Answer

Disable the user account to prevent potential compromise

Answer

Ignore the alert as a likely false positive

Question 4

A security operations center (SOC) wants to automatically block IP addresses that are identified as malicious by a high-confidence threat intelligence feed. They are using Cortex XSOAR and a Palo Alto Networks Next-Generation Firewall. Which Cortex XSOAR feature should they use to automate the blocking action?

Accepted Answer

Playbook. Playbooks are the automation engine in Cortex XSOAR. They can be triggered by incidents, including those generated from threat intelligence feeds, and can execute integration commands to block IPs on a Palo Alto Networks firewall. By using a playbook, the SOC can ensure that high-confidence malicious IPs are blocked automatically without manual intervention, reducing response time.

Answer

Layout rule

Answer

Indicator exclusion list

Answer

Incident type

Question 5

A security analyst is reviewing a threat intelligence report that includes indicators of compromise (IOCs) such as IP addresses and domain names. The analyst wants to import these IOCs into Cortex XSOAR for future correlation with security events. Which Cortex XSOAR component is specifically designed to ingest and manage external threat intelligence feeds?

Accepted Answer

Threat Intelligence Management. Threat Intelligence Management is the dedicated module in Cortex XSOAR for ingesting, managing, and distributing threat intelligence. It supports various feed formats and integrations, allowing analysts to import IOCs from reports and other sources. Once ingested, these indicators can be used for correlation with security events, enabling proactive defense.

Answer

Automation Engine

Answer

Case Management

Answer

Incident Management

Question 6

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a Windows endpoint. The process is powershell.exe with a command line that includes 'Invoke-Expression' and a Base64-encoded string. The analyst wants to gather additional context to determine if this is malicious. Which two actions should the analyst take next? (Choose two.)

Accepted Answer

Check the parent process of powershell.exe to understand how it was launched.. Decoding the Base64 payload and examining the parent process are essential steps to understand the nature of the suspicious PowerShell execution. These actions provide immediate context without disrupting operations, allowing the analyst to determine if the activity is malicious. They align with best practices for incident response, where identification and analysis precede containment.

Answer

Submit the Base64 string to a public sandbox for analysis.

Answer

Immediately isolate the endpoint to prevent potential spread.

Answer

Disable PowerShell on the endpoint to prevent further execution.

Question 7

A Cortex XDR analyst is investigating a high-severity alert involving a suspicious process on a critical server. The analyst needs to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Accepted Answer

The Causality Chain view in the alert details.. The Causality Chain view in Cortex XDR visually maps the sequence of processes that led to an alert, including parent-child relationships and command line arguments. It is the primary tool for understanding the root cause and execution flow of a detected threat, enabling analysts to quickly identify malicious parent processes and their parameters.

Answer

The Alerts table, by filtering on the process name and exporting to CSV.

Answer

The BIOC rule that triggered the alert, by reviewing its logic.

Answer

The Endpoint Investigation page, by running a script to list processes.

Question 8

A Cortex XSOAR engineer is designing a playbook that requires user interaction to approve a remediation action. The engineer needs to configure a task that pauses the playbook until an analyst responds. Which two task types can be used to achieve this? (Choose two.)

Accepted Answer

Data Collection task. Manual tasks and Data Collection tasks are both designed to involve human interaction. A Manual task pauses the playbook until an analyst performs a specified action, while a Data Collection task presents a form and waits for submission. Both can be used to obtain approval before proceeding with remediation.

Answer

Timer task

Answer

Conditional task

Answer

Automated task

Question 9

A Cortex XDR analyst is investigating a security incident where an attacker used RDP to move laterally from a compromised workstation to a server. The analyst wants to create a BIOC rule to detect future RDP lateral movement attempts. Which of the following XQL queries would best accomplish this?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK and action_network_dest_port = 3389 | fields agent_hostname, action_network_remote_ip, action_network_remote_port. To detect RDP lateral movement, the analyst should focus on network events indicating outbound connections to port 3389. The correct query filters network events by destination port 3389, capturing the remote IP and port, which are critical for identifying the source and target of lateral movement. This approach directly targets the RDP protocol's default port and provides actionable context for incident response.

Answer

dataset = xdr_data | filter event_type = ENUM.FILE and action_file_path contains "rdp" | fields agent_hostname, action_file_path

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "mstsc.exe" | fields agent_hostname, action_process_image_name

Answer

dataset = xdr_data | filter event_type = ENUM.REGISTRY and action_registry_key_name contains "Terminal Server" | fields agent_hostname, action_registry_key_name

Question 10

A Cortex XSIAM administrator is tuning a correlation rule that currently generates a high volume of false positives. The rule uses an XQL query that matches on a field named action with the value 'login'. The administrator wants the rule to fire only when the same source IP performs more than five failed logins within ten minutes, and to suppress duplicate alerts for the same source IP for one hour after the first alert. Which combination of XQL constructs and rule settings should the administrator use?

Accepted Answer

Use a group by on the source IP field with a time window of ten minutes, filter where the count of failed logins is greater than five, and set the rule's suppression period to one hour.. The rule must count failed logins per source IP within a ten-minute window and fire only when the count exceeds five. Grouping by the source IP with that window and filtering on the count achieves the threshold. Setting the suppression period to one hour ensures duplicate alerts for the same source IP are suppressed after the first alert, matching the requirement exactly.

Answer

Use a join between the login events and a lookup table of known IPs, filter where the action equals 'login', and set the rule's severity to high.

Answer

Use a dedup on the source IP field, filter where the count of failed logins is greater than five, and set the rule's schedule to run every ten minutes.

Answer

Use a group by on the source IP field with a time window of one hour, filter where the count of failed logins is greater than five, and set the rule's suppression period to ten minutes.

Question 11

During an investigation, a Cortex XDR analyst needs to determine whether a suspicious PowerShell process was spawned by a known-good parent such as explorer.exe or by a malicious macro-enabled document. The analyst wants to visualize the full chain of process creation events leading to the alert. Which Cortex XDR feature should the analyst use?

Accepted Answer

The Causality view, which displays the process tree and parent-child relationships for the alert. The Causality view in Cortex XDR is designed to visualize the process tree and parent-child relationships behind an alert. It lets the analyst trace whether PowerShell originated from a benign parent like explorer.exe or a malicious document. Other options provide raw data, file analysis, or alert lists but not the visual causal chain required.

Answer

The XQL query editor, which can search raw endpoint telemetry for process creation events

Answer

The Alerts table filtered by severity, which lists all alerts sorted by risk score

Answer

The WildFire report for the document, which shows the file's behavioral sandbox analysis

Question 12

A SOC analyst is investigating a potential insider threat. The analyst needs to determine whether a user accessed a sensitive file share outside of normal working hours. The organization uses Cortex XDR and has enabled the 'File and Folder' data collection. Which Cortex XDR query should the analyst run to find file access events by that user during a specific time window?

Accepted Answer

Query the 'File and Folder' dataset filtered by username and timestamp.. The 'File and Folder' dataset in Cortex XDR records file access events, including reads, writes, and deletions. By filtering on username and timestamp, the analyst can identify all file operations by that user during the specified time window. This is the most direct way to determine if the user accessed the sensitive file share outside normal hours.

Answer

Query the 'File Creation' dataset filtered by username and timestamp.

Answer

Query the 'Network Connections' dataset filtered by username and timestamp.

Answer

Query the 'Process Execution' dataset filtered by username and timestamp.

Question 13

A Cortex XSOAR administrator needs to ensure that a custom integration script can access an API key stored securely without hardcoding it in the script. Which method should be used to store and retrieve the API key?

Accepted Answer

Store the API key in the integration instance configuration as a credential parameter.. The secure and recommended method is to define a credential parameter in the integration instance configuration. This parameter is encrypted at rest and accessible in the integration script via demisto.params(). This approach centralizes secret management and allows administrators to update the key without modifying the script.

Answer

Store the API key in an environment variable on the Cortex XSOAR server.

Answer

Store the API key in the playbook context and pass it to the script as an argument.

Answer

Store the API key in a text file on the Cortex XSOAR server and read it from the script.

Question 14

A SOC analyst is reviewing a threat intelligence report that contains a list of IP addresses associated with a known botnet. The analyst wants to quickly determine which of these IPs have been observed in the organization's network logs. Which type of threat intelligence is most directly used for this purpose?

Accepted Answer

Technical threat intelligence. Technical threat intelligence provides the concrete IOCs needed to search logs and identify malicious activity. Strategic, operational, and tactical intelligence offer context and higher-level insights but do not supply the raw IPs for direct matching. The analyst requires technical indicators to perform the lookup.

Answer

Strategic threat intelligence

Answer

Tactical threat intelligence

Answer

Operational threat intelligence

Question 15

A security analyst is reviewing a playbook in Cortex XSOAR that automatically enriches IP addresses. The playbook uses the 'ip' command to query multiple threat intelligence integrations. The analyst wants to ensure that the playbook continues to execute even if one of the integrations fails to respond. Which playbook task configuration should be adjusted?

Accepted Answer

Set the task to 'Continue on error' in the task settings.. The correct answer is to set the task to 'Continue on error'. This playbook task setting allows the playbook to proceed even if the task fails, which is essential when querying multiple threat intelligence integrations. It ensures that a single integration failure does not stop the entire enrichment process, allowing the analyst to still receive data from other integrations and maintain workflow efficiency.

Answer

Configure a timeout for the task to prevent it from hanging indefinitely.

Answer

Modify the integration instance to retry the command automatically on failure.

Answer

Use a conditional task to check the integration status before executing the enrichment command.