SecOps-Pro Practice Test 19 — 15 Questions

Question 1

You want to automate the response to a specific type of alert. Where should you configure this?

Accepted Answer

Automation/Playbooks. Automation rules (often part of the Cortex XDR Orchestration or Playbook features) allow for automated responses to alerts.

Answer

Data Lake settings

Answer

Endpoint Policy

Answer

BIOC rules

Question 2

A security analyst is investigating a phishing alert in Cortex XSOAR. Which workflow component is best utilized to standardize the response process for repetitive phishing email triage?

Accepted Answer

Playbook. Playbooks are the standard method in Cortex XSOAR for automating and standardizing incident response workflows.

Answer

Integration instance

Answer

Indicator auto-extraction

Answer

Dashboard widget

Question 3

An analyst needs to collect and analyze forensic data from a compromised endpoint without disrupting the user's work. The endpoint is running Windows 10 and has the Cortex XDR agent installed. Which capability should the analyst use?

Accepted Answer

Live Terminal. Live Terminal is designed for interactive, remote investigation on an endpoint. It lets analysts execute commands, inspect running processes, retrieve files, and gather forensic artifacts in real time without needing to isolate the endpoint or interrupt the user. This makes it the ideal capability for non-disruptive forensic analysis.

Answer

Full Disk Encryption

Answer

Memory Scraping

Answer

Endpoint Isolation

Question 4

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Accepted Answer

Automatic email ingestion. Automatic email ingestion (A) is a valid trigger because Cortex XSOAR can connect to a mailbox via an email integration (e.g., the built-in Mail Listener v2), which continuously fetches incoming messages and automatically creates incidents from them, so a phishing report or alert email can start an investigation without human action. Manual incident creation (C) is also valid because an analyst can create an incident directly in the XSOAR UI (Incidents > New Incident) or via the API, which is the standard way to open an investigation by hand. The remaining options do not belong: a hardware power reset (B) is a physical action with no incident-triggering capability in XSOAR, a direct firewall firmware update (D) is a network-device maintenance task unrelated to XSOAR's incident lifecycle, and OS kernel patching (E) is a host operating-system maintenance activity that cannot create or trigger a XSOAR investigation.

Answer

Hardware power reset

Answer

Direct firewall firmware update

Answer

OS kernel patching

Question 5

During an active incident, a Cortex XDR analyst wants to stop a compromised endpoint from communicating with a known command-and-control server while still allowing the rest of the SOC to collect forensic evidence from the host. Which Cortex XDR response action should the analyst use?

Accepted Answer

Isolate the endpoint using network isolation. Network isolation is the correct containment action because it cuts off all external communication from the endpoint while preserving the Cortex XDR management tunnel. This allows the SOC to continue remote investigation, run live terminal commands, and collect evidence without letting the attacker retain C2 access, which is exactly the balance the scenario requires.

Answer

Quarantine the file using the 'Quarantine File' action

Answer

Block the C2 IP address using a Cortex XDR IOC rule

Answer

Terminate the suspicious process with the 'Kill Process' action

Question 6

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Accepted Answer

Centralized log storage. Cortex Data Lake serves as the centralized repository for logs collected from firewalls, endpoints, and other security devices.

Answer

Network policy enforcement

Answer

Endpoint management

Answer

Automated incident response

Question 7

Which THREE roles are commonly involved in the SOC operational structure?

Accepted Answer

SOC Manager. Tier 1, Tier 2, and SOC Managers are standard components of a functional SOC team.

Answer

IT Helpdesk Lead

Answer

Sales Engineer

Question 8

An analyst is reviewing a firewall policy. Which feature allows them to view the traffic logs that specifically match that rule?

Accepted Answer

Log Viewer. The 'Log' icon or 'View Logs' option in the policy window allows jumping directly to the logs associated with that specific rule.

Answer

Security Profile

Answer

Rule Base View

Answer

Policy Optimizer

Question 9

A security operations center (SOC) analyst receives an alert about a suspicious PowerShell script execution on a user's workstation. The analyst wants to quickly determine if this script has been seen in the environment before and if it is associated with any known threats. Which Cortex XDR feature should the analyst use to search for the script's hash across the environment and threat intelligence?

Accepted Answer

XQL Search. XQL Search is the correct feature because it enables the analyst to query the extensive telemetry collected by Cortex XDR, including process execution details and file hashes. This allows the analyst to check if the script has been executed elsewhere and to correlate with threat intelligence, providing a comprehensive view of its prevalence and potential maliciousness.

Answer

Threat Intelligence

Answer

Incident Response

Answer

Endpoint Management

Question 10

You need to automate the enrichment of IP addresses during incident investigation. Which component in XSOAR facilitates this process?

Accepted Answer

Playbooks. Playbooks are the primary automation engine for enrichment.

Answer

Layouts

Answer

Dashboard

Answer

Indicator Types

Question 11

You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?

Accepted Answer

Cortex XSOAR Settings > Integrations > Instances. Integration instances are managed under Settings > Integrations > Instances, where each configured instance shows its connection status (e.g., 'Connected', 'Disconnected', 'Error') and provides access to instance-specific logs. This is the canonical location to verify that a third-party threat intel feed is reachable and authenticated.

Answer

Cortex XSOAR Settings > Advanced > Server Configuration

Answer

Cortex XSOAR Settings > Playbooks > Automation

Answer

Cortex XSOAR Settings > Objects > Indicators

Question 12

A security analyst needs to ensure that all endpoints in the organization are protected against a newly discovered fileless malware that exploits PowerShell. The analyst wants to configure Cortex XDR to block this threat automatically. Which component should the analyst configure?

Accepted Answer

Behavioral Threat Protection Profile. Behavioral Threat Protection profiles are specifically designed to detect and block malicious behaviors, including fileless attacks that leverage PowerShell. By configuring a BTP profile, the analyst can ensure that the endpoint agent automatically blocks the threat without relying on signatures. Other profiles focus on different aspects of protection, such as known malware or vulnerability exploits, and are not the primary control for behavioral threats.

Answer

Exploit Protection Profile

Answer

Malware Profile

Answer

Exceptions Policy

Question 13

A security operations team is using Cortex XSOAR to manage threat intelligence. They want to ensure that indicators from a newly added feed are automatically tagged with a specific source name and that their reputation is set to 'Suspicious' by default. Which configuration should the team apply in Cortex XSOAR?

Accepted Answer

Configure the feed integration settings to assign a source tag and set the default reputation to 'Suspicious'.. Feed integration settings in Cortex XSOAR include options for source tagging and default reputation, allowing automatic application to all indicators from that feed. This ensures consistent handling and reduces manual effort, directly fulfilling the team's requirement.

Answer

Modify the indicator extraction rules to include the source tag and reputation.

Answer

Create a new indicator type with the desired default reputation and source tag.

Answer

Use a playbook that triggers on feed ingestion to update indicator fields.

Question 14

Which TWO of the following are primary objectives of a post-incident review (PIR) using XSOAR reports?

Accepted Answer

Improve future automation playbooks. Option B is correct because a primary objective of a post-incident review using XSOAR reports is to feed lessons learned back into the automation content, refining playbook tasks, conditions, and integrations so future incident response is faster and more consistent. Option D is correct because PIRs are designed to surface weaknesses in detection, triage, containment, and remediation workflows, and XSOAR reports provide the incident timeline, task-level data, and metrics needed to pinpoint those gaps. The unmarked options do not belong: A is wrong because increasing project cost is not a goal of a PIR, C is wrong because resetting a firewall to factory settings is a destructive remediation action rather than a review objective, and E is wrong because deleting evidence files would violate forensic preservation and audit requirements.

Answer

Increase the cost of the project

Answer

Reset the firewall to factory settings

Answer

Delete all evidence files

Question 15

A security team is using Cortex XSOAR to automate phishing investigations. An engineer needs to store the original sender's email address from the incident's custom fields into a playbook context key for later use in a conditional task. Which of the following is the correct way to reference and assign this value?

Accepted Answer

Use the ${incident.customFields.sender} syntax to read the value and assign it to a context key using a Set task.. In Cortex XSOAR, incident custom fields are stored under the incident.customFields object. To use a custom field value in a playbook, you reference it as ${incident.customFields.fieldName}. A Set task can then assign this to a context key. This is the standard and correct method for extracting and storing custom field data for later use.

Answer

Use a script task to call the getIncident function and extract the sender field.

Answer

Use the ${incident.details} syntax to access the sender's email address from the incident details.

Answer

Use the ${incident.sender} syntax to directly access the sender's email address from the incident.