SecOps-Pro Practice Test 17 — 15 Questions

Question 1

A Cortex XSIAM administrator is configuring a new correlation rule to detect brute-force attacks against a cloud identity provider. The rule should trigger only when there are more than 10 failed authentication events from the same source IP within a 5-minute window. Which XSIAM component should the administrator use to define this time-based aggregation logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Correlation rule with a threshold condition. Correlation rules in Cortex XSIAM provide the logic engine for defining multi-event detections with conditions such as thresholds, time windows, and grouping. By configuring a threshold condition, the administrator can trigger an alert only when the count of failed authentication events from the same source IP exceeds 10 within a 5-minute window, thereby reducing false positives from isolated failures.

Answer

IOC (Indicator of Compromise) rule

Answer

BIOC (Behavioral Indicator of Compromise) rule

Answer

XQL query with a time-based aggregation function

Question 2

A security operations center (SOC) uses Cortex XSOAR to manage incidents. They want to measure the effectiveness of their threat intelligence sources by tracking how many incidents are generated from each source and the average time to resolution. Which Cortex XSOAR feature should they use to collect and visualize this data?

Accepted Answer

Widgets and dashboards in the Cortex XSOAR UI, configured to display incident metrics grouped by source.. The correct answer is to use widgets and dashboards configured to display incident metrics grouped by source. Cortex XSOAR dashboards are highly customizable and can pull data from incidents, allowing the SOC to track incident volume and resolution times per intelligence source. This provides a real-time, visual representation that aids in evaluating source effectiveness and making informed decisions about feed prioritization or tuning.

Answer

The built-in 'Threat Intel' report in the Reports section, which automatically includes source effectiveness metrics.

Answer

Incident fields and a custom report using the Report Builder.

Answer

The Threat Intelligence Management (TIM) dashboard and indicator scoring.

Question 3

You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?

Accepted Answer

integration-NAME.yml. In Cortex XSOAR, a custom integration is defined by a YAML file (conventionally `integration-NAME.yml`) that specifies the integration's metadata, parameters, commands, and points to the Python script implementing the logic. This YAML is the required definition file for the integration.

Answer

script-NAME.py

Answer

integration-NAME.json

Answer

README.md

Question 4

A Cortex XDR incident is auto-closed by the SOC's 'Malware Containment' playbook after the endpoint agent quarantines a suspicious executable. Three days later, threat intel confirms the file hash is a known ransomware dropper that had already established persistence via a scheduled task. Which SOC operational gap does this scenario most directly expose?

Accepted Answer

The playbook lacks a post-containment verification step to confirm no persistence mechanisms survived remediation.. The incident was closed because the malware was quarantined, but the adversary's scheduled-task persistence was never checked or removed. Effective SOC operations require playbooks to verify full eradication of persistence before closure, not just the success of a single containment action. The gap is a missing post-containment verification step, which allowed a known ransomware dropper to remain active on the endpoint.

Answer

Threat intel feeds were not integrated with the case management system, so the hash was unknown at triage time.

Answer

The SOC's shift-handover process did not escalate the incident to a senior analyst within the required SLA window.

Answer

The endpoint agent failed to report the quarantine action to Cortex XDR, so the incident record is incomplete.

Question 5

A Cortex XSOAR administrator is configuring a new threat intelligence feed that provides indicators in STIX 2.1 format. The administrator wants to ensure that the indicators are automatically tagged with a specific source name for easy filtering. Which configuration step is required?

Accepted Answer

Set the 'Source' field in the feed integration instance settings.. The correct answer is to set the 'Source' field in the feed integration instance settings. This field is specifically designed to assign a source name to all indicators from that feed, enabling easy filtering and attribution. It is a straightforward configuration that avoids custom scripting or rule creation.

Answer

Create a classification rule that adds the source name to the indicator.

Answer

Use a playbook that runs on indicator creation to add the tag.

Answer

Modify the indicator type definition to include a default source tag.

Question 6

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

Accepted Answer

Identifying root cause of an event. Option B is correct because Cortex XDR's Causality engine correlates alerts and telemetry across endpoints, networks, and clouds to trace an alert back to its originating root cause rather than treating each alert in isolation. Option E is correct because Causality builds a causal chain (the causality graph) that visualizes process lineage — parent-child process relationships, file and registry operations, and network connections — so analysts can see exactly how an attack unfolded. Options A, C, and D are incorrect: Causality does not automatically create firewall rules (that is the job of policy/response actions), it is not an identity management function (handled by IdP/User Directory integration), and it does not encrypt endpoint data (handled by disk encryption or DLP controls).

Answer

Automated firewall rule creation

Answer

Managing user identity

Answer

Encrypting endpoint data

Question 7

If an automation script is taking too long to run, how can you improve its performance?

Accepted Answer

Refactor the script to use batch processing instead of individual API calls. The dominant performance cost in XSOAR automation scripts is usually the number of API calls made to the Cortex XSOAR server or external systems. Refactoring to batch operations — for example using demisto.executeCommand with multiple entries, or the batch endpoints of the underlying API — reduces round-trip overhead and dramatically speeds up execution. This addresses the root cause (I/O latency and per-call overhead) rather than masking it.

Answer

Add more logging to the script

Answer

Change the script language to Java

Answer

Increase the integration timeout limit

Question 8

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Accepted Answer

View current agent status.. Option A is correct because the Endpoint Inventory page displays each endpoint's current agent status (e.g., online/offline, healthy/unhealthy, last check-in), which is a core inventory function. Option D is correct because the Endpoint Inventory page lets administrators assign tags to endpoints for grouping, filtering, and policy targeting. Option B is not correct because global firewall settings are configured in a dedicated firewall or policy management area, not from the endpoint inventory list. Option C is not correct because the agent's source code is not editable from a management console page. Option E is not correct because updating an endpoint's operating system is an OS-level maintenance task, not an action available from the Endpoint Inventory page.

Answer

Configure global firewall settings.

Answer

Change the agent's source code.

Answer

Update the agent's OS.

Question 9

What is the purpose of the 'XQL Query' feature in Cortex XDR?

Accepted Answer

To perform advanced cross-data analysis and threat hunting.. XQL (XDR Query Language) in Cortex XDR is a powerful query language used for advanced cross-data analysis and threat hunting. It allows security analysts to search and correlate data across endpoints, network, and cloud logs to detect sophisticated threats. It is not used for agent updates, firewall rules, or incident rule creation.

Answer

To manage agent updates.

Answer

To configure firewall rules.

Answer

To create new incident rules.

Question 10

An analyst investigating a Cortex XSIAM incident wants to find every process on the affected endpoint that established an outbound network connection to a suspicious external IP address over the past 30 days, including processes that are no longer running. The analyst needs to query historical telemetry rather than view current process state. Which approach should the analyst use?

Accepted Answer

Run an XQL query against the network and process datasets filtered by the destination IP and time range, then correlate the process identifiers.. Historical endpoint telemetry in Cortex XSIAM is queried with XQL against stored datasets, allowing the analyst to filter network connection events by destination IP and a 30-day window and then correlate them with process records. This surfaces processes that have already terminated, which live tooling and inventory views cannot. Threat intelligence and current-state listings describe reputation or present conditions rather than the past connection activity the investigation requires.

Answer

Review the endpoint's current process list in the asset inventory to identify processes with network activity indicators.

Answer

Open a live terminal session on the endpoint and run a network connection listing command to enumerate current connections.

Answer

Check the threat intelligence platform for the suspicious IP and review any associated malware family reports.

Question 11

Which object in Cortex XSOAR is used to define the specific actions taken when a specific threat type is identified?

Accepted Answer

Playbook. Playbooks contain the logic and steps for handling specific threats.

Answer

Indicator

Answer

Incident

Answer

Integration

Question 12

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Accepted Answer

Causality View. The Causality View in Cortex XDR allows analysts to visualize the process tree and the chain of events that led to the security alert.

Answer

Forensics Tab

Answer

Network Activity

Answer

Alert Details

Question 13

You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?

Accepted Answer

Threat Intelligence Management. Threat feeds are configured in the Threat Intelligence management area of XSIAM.

Answer

XQL Global Variables

Answer

Data Ingestion Mapping

Answer

Detection Rule Editor

Question 14

Which THREE actions are available when responding to an incident via the Response feature?

Accepted Answer

Isolate host.. Common response actions include isolating a host, killing a process, and quarantining a file.

Answer

Change the user password.

Answer

Perform a remote OS reinstall.

Question 15

A security analyst is triaging a malware incident in Cortex XSIAM. The analyst wants to isolate the affected Windows endpoint from the network directly from the incident's War Room while preserving the forensic evidence on the disk. Which action should the analyst take?

Accepted Answer

Run the 'isolate endpoint' action on the agent from the incident's response actions.. Containment during triage in Cortex XSIAM is performed through response actions on the endpoint agent. The isolate endpoint action cuts network communication except for the management channel, which stops lateral movement and command-and-control traffic while keeping the disk and memory available for forensic collection. Other options either fail to stop the malicious process or destroy investigative evidence.

Answer

Disable the endpoint's user account in Active Directory to prevent further access.

Answer

Delete the endpoint record from the Endpoints inventory to sever its connection.

Answer

Create a firewall rule on the perimeter to block the endpoint's IP address.