SecOps-Pro Practice Test 18 — 15 Questions

Question 1

A SOC analyst is reviewing a Cortex XDR incident that involves a suspicious PowerShell script execution on multiple endpoints. The analyst wants to determine the scope of the compromise by identifying all endpoints where the same script was executed. Which Cortex XDR feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query Builder with XQL. Query Builder with XQL is the correct tool because it enables the analyst to search across all endpoints for the specific PowerShell script execution, using fields like process name, command line, and file hash. This broad search reveals all affected endpoints, allowing the analyst to scope the incident accurately and take remediation actions on every compromised host.

Answer

Incident Widgets

Answer

Causality Chain

Answer

Threat Intelligence Module

Question 2

A Cortex XSIAM analyst is reviewing an incident and wants to see the raw, unnormalized log entries that contributed to the alert. The analyst needs to examine the original fields as they were received from the source. Where in the incident investigation interface can the analyst access these raw logs?

Accepted Answer

The 'Events' tab. When investigating an incident in Cortex XSIAM, the 'Events' tab lists all the individual events that contributed to the alert. Each event entry contains the original raw log fields as they were ingested, in addition to the normalized fields. This allows an analyst to inspect the exact data received from the source system, which is crucial for verifying detection logic and understanding the context of the alert.

Answer

The 'War Room'

Answer

The 'Timeline' view

Answer

The 'Issues' tab

Question 3

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Creating an exception for the BIOC rule based on the process path or hash allows the legitimate administrative script to bypass the rule without disabling it entirely. This maintains detection for other processes while suppressing false positives for known good scripts. Exceptions are a standard feature in security tools to handle benign activity.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.

Question 4

A user is reporting that their XSIAM dashboard widgets are displaying 'No Data'. What is the most likely cause?

Accepted Answer

Incorrect time range filter in the dashboard. If widgets display no data, the time range or query filter is usually the culprit for the current environment.

Answer

Agent is disconnected

Answer

Insufficient disk space

Answer

Global XSIAM outage

Question 5

A SOC manager wants Cortex XSIAM to automatically enrich every new incident with the reputation of the involved IP addresses before an analyst opens it. Which Cortex XSIAM capability should the manager use to accomplish this?

Accepted Answer

A playbook that runs automatically on incident creation and calls the enrichment integrations.. Automated enrichment on incident creation is implemented through playbooks, which can be configured to trigger when an incident is created and to invoke integrations that return IP reputation. Dashboards, XQL-only approaches, and exclusions do not execute response or enrichment actions, so a playbook is the correct capability for adding context before analyst review.

Answer

A custom XQL query that runs on a schedule and writes IP reputation into the incidents table.

Answer

An alert exclusion that prevents incidents from being created until reputation is available.

Answer

A dashboard widget that displays the reputation of IPs observed in the last 24 hours.

Question 6

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Accepted Answer

Malicious files. The Evidence Board in a Cortex XSOAR incident is designed to hold the artifacts and context gathered during an investigation, so option B (Malicious files) is correct because suspicious or malicious file samples attached to the incident are stored there for analysis and reference. Option C (Extracted IOCs) is correct because indicators such as IP addresses, domains, URLs, and file hashes extracted from the incident are surfaced on the Evidence Board to support enrichment and pivoting. Option E (Screenshots of the incident) is correct because visual evidence like screenshots can be attached to the board to document findings and support the investigation narrative. Option A (Playbook source code) does not belong because playbooks are automation logic managed in the Playbooks section, not evidence artifacts, and option D (System boot logs) is not a standard Evidence Board item unless specifically attached as an artifact, so it is not one of the commonly included items.

Answer

Playbook source code

Answer

System boot logs

Question 7

A security analyst is using the Structured Threat Information Expression (STIX) format to share threat intelligence with a partner organization. The analyst wants to include a relationship between an indicator and a malware object. Which STIX Domain Object (SDO) should the analyst use to represent this relationship?

Accepted Answer

Relationship. In STIX, relationships between SDOs are represented using the Relationship SDO. It connects two objects and specifies the nature of their association, such as 'indicates' or 'uses'. This allows for a graph-based model of threat intelligence. The analyst should use a Relationship object to link the Indicator and Malware, ensuring the partner organization understands the connection.

Answer

Observed Data

Answer

Indicator

Answer

Malware

Question 8

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Accepted Answer

Threat intelligence and hunting. AutoFocus is a threat intelligence service that provides context and hunting capabilities for threats.

Answer

Endpoint isolation

Answer

Log storage

Answer

Automated firewall rule creation

Question 9

A SOC analyst notices that a critical alert was not generated when a known malicious IP address was contacted by an internal host. The analyst confirms that the IP is present in the threat intelligence feed and that the firewall is configured to log all traffic. Which component of the SOC's detection pipeline should the analyst investigate FIRST?

Accepted Answer

The log ingestion and normalization process. The detection pipeline relies on logs being ingested, normalized, and then correlated against threat intelligence. Since the firewall logs the traffic and the IP is in the feed, the failure likely occurs during log ingestion or normalization. Without proper parsing, the SIEM cannot match the IP against the feed, resulting in a missed alert. Thus, the analyst should first investigate the log ingestion and normalization process.

Answer

The endpoint detection and response (EDR) agent on the internal host

Answer

The threat intelligence feed update frequency

Answer

The firewall's logging configuration

Question 10

A SOC team is implementing a new detection rule in Cortex XDR to identify lateral movement via Windows Admin Shares. The rule should trigger only when a remote process creates a file on an administrative share (e.g., ADMIN$) and the source process is not a known management tool. Which Cortex XDR rule configuration element is most critical to achieve this specificity?

Accepted Answer

BIOC (Behavioral Indicator of Compromise) with process and file operation conditions. BIOC rules enable the creation of behavioral detection logic that combines multiple event types and conditions. Specifying a file creation on an administrative share and excluding known management tools via process attributes directly meets the requirement for high specificity. This approach detects lateral movement techniques like PsExec or SMB file copies while reducing noise from legitimate admin activity.

Answer

Exception policy based on user account

Answer

Analytics alert with machine learning threshold

Answer

IOC (Indicator of Compromise) with a hash of the remote process

Question 11

A security operations team is using Cortex XSOAR to manage threat intelligence. They receive a large number of indicators from various feeds, and analysts are overwhelmed by the volume. The team wants to prioritize indicators that are most relevant to their organization's threat landscape. Which Cortex XSOAR feature should they use to automatically assign a score to indicators based on multiple factors such as source reliability, indicator type, and age?

Accepted Answer

Indicator scoring using the built-in scoring engine.. The correct answer is to use the built-in indicator scoring engine. Cortex XSOAR's scoring engine automatically assigns a score to indicators based on configurable factors such as source reliability, indicator type, and age. This allows the team to prioritize indicators that are most relevant and actionable, effectively managing large volumes of threat intelligence without manual intervention.

Answer

Creating a custom playbook that calculates a score using a script.

Answer

Manual tagging of indicators with a 'priority' tag.

Answer

Using the 'Reputation' field provided by each feed integration.

Question 12

An automation engineer is creating a playbook in Cortex XSOAR that must run a custom Python script to parse a raw email attachment. The script requires access to the incident's custom field 'attachment_hash' and must return a dictionary with keys 'verdict' and 'score'. Which task type should be used, and how are inputs and outputs configured for this task?

Accepted Answer

Use a 'Script' task; specify the script name in the task configuration, map the incident field to a script argument, and the script returns a dictionary that is accessible in later tasks via the task's context key.. The scenario requires executing a custom Python script that takes an incident field as input and returns structured data. A Script task is the correct choice because it allows running a custom script with mapped arguments and captures the returned dictionary under a context key for later use. Command tasks run integration commands, Manual tasks require human input, and Conditional tasks only evaluate logic.

Answer

Use a 'Manual' task; the analyst manually enters the required hash and the script's output must be manually copied into the incident context.

Answer

Use a 'Command' task; the script must be integrated as a command in an integration, and the output is automatically mapped to incident fields without additional configuration.

Answer

Use a 'Conditional' task; the script is embedded in the task's condition expression, and the output is stored in the incident's custom fields automatically.

Question 13

A security analyst is investigating a high-severity alert in Cortex XDR. The alert details show a process named 'svchost.exe' with a parent process 'services.exe'. The analyst notices that the 'svchost.exe' process has a digital signature from Microsoft but is exhibiting unusual network behavior, connecting to an external IP address on port 443. The analyst wants to determine if this is a malicious process injection. Which Cortex XDR feature should the analyst use to inspect the memory of the 'svchost.exe' process?

Accepted Answer

Process Memory Dump. To inspect the memory of a specific process for signs of injection, the analyst should use the Process Memory Dump feature. This captures the memory space of the process, which can then be analyzed offline with tools like Volatility or via Cortex XDR's built-in analysis. Other features like Live Terminal or Causality View do not provide memory contents.

Answer

XQL Query with 'memory' dataset

Answer

Causality View

Answer

Live Terminal

Question 14

A Cortex XSOAR analyst is building a playbook to automate the response to phishing incidents. The playbook must extract indicators from the reported email, check their reputation against integrated threat intelligence sources, and then decide whether to block the sender domain or close the incident as benign. Which type of XSOAR task should the analyst use to perform the reputation check?

Accepted Answer

Automated task. An automated task is designed to execute integration commands or scripts without human intervention, making it the correct choice for querying threat intelligence sources. It can retrieve reputation scores and pass them to conditional tasks for decision-making. Manual, conditional, and data collection tasks serve different purposes: human input, branching logic, and form submission, respectively, and none of them automatically perform the reputation check.

Answer

Data collection task

Answer

Conditional task

Answer

Manual task

Question 15

When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?

Accepted Answer

Incident Correlation and Grouping. Incident Correlation and Grouping in Cortex XSIAM aggregates related alerts — for example, multiple alerts from the same host or same attack chain — into a single incident, reducing the number of items an analyst must triage. This directly combats alert fatigue by presenting one actionable incident instead of dozens of duplicate alerts.

Answer

Alert Suppression Lists

Answer

Query Aggregation

Answer

Notification Thresholds