SecOps-Pro Practice Test 2 — 10 Questions

Question 1

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 2

You want to automate the response to a specific type of alert. Where should you configure this?

Accepted Answer

Automation/Playbooks. Automation rules (often part of the Cortex XDR Orchestration or Playbook features) allow for automated responses to alerts.

Answer

Data Lake settings

Answer

Endpoint Policy

Answer

BIOC rules

Question 3

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 4

You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?

Accepted Answer

Cortex XSIAM Forwarder. The Log Forwarder is the designated component for on-premise log ingestion.

Answer

Cortex Collector Pro

Answer

Cortex Agent Relay

Answer

XSIAM API Gateway

Question 5

You need to export data from Cortex XSIAM to a third-party SIEM. Which feature facilitates the automated forwarding of data?

Accepted Answer

Log Forwarding. Log Forwarding profiles or API-based integration tools are used to send data out of XSIAM.

Answer

Data Ingestion Pipeline

Answer

XQL Export Tool

Answer

Incident Export API

Question 6

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 7

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.

Question 8

Which THREE actions are available when responding to an incident via the Response feature?

Accepted Answer

Isolate host.. Common response actions include isolating a host, killing a process, and quarantining a file.

Answer

Change the user password.

Answer

Perform a remote OS reinstall.

Question 9

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 10

Which configuration setting in the Malware profile determines if the agent should move a file to a secure location upon detection?

Accepted Answer

File Action. The 'Quarantine' action in the Malware profile instructs the agent to move the malicious file to a hidden, encrypted folder on the endpoint.

Answer

Endpoint Protection Rule

Answer

Detection Mode

Answer

Scan Frequency

Answer

Remediation Policy