SecOps-Pro Practice Test 2 — 10 Questions

Question 1

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Accepted Answer

Executing system commands. Live Terminal in Cortex XDR provides a remote shell on the endpoint, so option A (Executing system commands) is correct because it lets analysts run OS-level commands directly on the host for investigation or remediation. Option C (Deleting files on the endpoint) is correct because the terminal can issue file-deletion commands to remove malicious artifacts from the endpoint. Option E (Listing running processes) is correct because analysts can run process-listing commands (e.g., tasklist on Windows or ps on Linux/macOS) to enumerate active processes during triage. Option B (Automating incident closure in XSOAR) is not a Live Terminal capability, as that is handled by XSOAR playbooks and incident management workflows, not a remote endpoint shell. Option D (Modifying firewall policy rules) is not performed through Live Terminal, since firewall policy changes are made in the firewall management console or policy configuration, not via endpoint command execution.

Answer

Automating incident closure in XSOAR

Answer

Modifying firewall policy rules

Question 2

A security analyst at a healthcare company notices that a Cortex XSIAM correlation rule is generating an incident every time a clinician accesses a patient record after hours, even though the access is expected during on-call shifts. The analyst wants to stop these recurring incidents without disabling the underlying rule entirely. Which action should the analyst take?

Accepted Answer

Add an exception to the correlation rule that excludes the on-call clinician accounts from triggering the incident.. Exceptions are the surgical control for recurring false positives because they scope the exclusion to the specific accounts, hosts, or indicators that are generating noise while leaving the rule active for everything else. Disabling, re-scoping, or suppressing incidents either removes detection coverage or only hides individual occurrences, so the exception is the only option that preserves both signal and coverage.

Answer

Disable the correlation rule and create a new rule that only fires for accounts outside the clinical department.

Answer

Increase the severity threshold of the correlation rule so that only high-severity events generate incidents.

Answer

Suppress the incident from the Incidents table and rely on the audit log to capture future occurrences.

Question 3

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Accepted Answer

Use the data source onboarding wizard to preview parsed fields from a sample of the log data.. Validating ingestion and mapping requires observing the parsed output, which the onboarding wizard's preview provides, and then confirming the mapped fields in ingested data with XQL. Disabling rules, waiting for incidents, or editing mappings without previewing the data do not provide reliable validation and can harm production detection quality.

Answer

Edit the XDM mapping directly in the dataset schema without previewing the source data.

Answer

Disable all correlation rules that reference firewall data until the new source is confirmed working.

Answer

Add the source to a production dataset and wait for an incident to be generated before checking field values.

Question 4

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Accepted Answer

Use the Cortex XDR - Get Endpoint Forensic Data command to collect volatile evidence from the endpoint. The playbook must isolate the endpoint and collect forensic evidence. The Cortex XDR - Isolate Endpoint command quarantines the endpoint from the network, achieving containment. The Cortex XDR - Get Endpoint Forensic Data command retrieves volatile evidence for analysis. The other commands perform remediation or scanning, which are out of sequence and do not meet the stated goals.

Answer

Use the Cortex XDR - Scan Endpoint command to run a full antivirus scan on the endpoint

Answer

Use the Cortex XDR - Block File command to delete the malicious executable from the endpoint

Answer

Use the Cortex XDR - Quarantine File command to move the malicious file to a quarantine folder

Question 5

What is the benefit of using 'Incident Tags' in the SecOps process?

Accepted Answer

To categorize incidents for reporting and filtering. Incident Tags in Cortex XSOAR/SecOps are labels applied to incidents to categorize them, enabling filtering, grouping, and reporting across large incident volumes. They provide a flexible taxonomy (e.g., 'phishing', 'malware', 'VIP') that supports dashboards, saved searches, and metrics. This is why the benefit is categorization for reporting and filtering.

Answer

To automate the deletion of data

Answer

To define the password for the incident

Answer

To change the incident priority

Question 6

A security analyst is investigating a phishing incident and wants to determine if the sender's IP address has been associated with any known malicious campaigns. Which threat intelligence platform feature should the analyst use to quickly obtain this context?

Accepted Answer

Indicator enrichment. Indicator enrichment is the correct feature because it automatically queries threat intelligence sources to add context to an indicator, such as an IP address. This allows the analyst to quickly determine if the sender's IP has been associated with malicious campaigns, providing actionable intelligence for the phishing investigation. Other features like playbook automation, classification, or dashboards serve different purposes and do not directly provide this context.

Answer

Incident classification

Answer

Dashboard reporting

Answer

Playbook automation

Question 7

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 8

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Script complexity (A) is correct because the amount and intricacy of the automation logic — number of tasks, conditional branches, loops, and API calls — directly determines how long a playbook takes to execute. The number of active workers (C) is correct because workers are the execution engines that run playbook tasks; more available workers allow tasks to be processed in parallel rather than queued, improving throughput. The number of concurrent tasks (D) is correct because running many tasks simultaneously increases resource contention (CPU, memory, API rate limits), which can either speed up or degrade overall playbook performance depending on capacity. Incident display layout (B) is incorrect because it is purely a UI presentation concern and has no effect on backend playbook execution. User password length (E) is incorrect because it only affects authentication strength and has no bearing on how fast or efficiently a playbook runs.

Answer

Incident display layout

Answer

User password length

Question 9

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Accepted Answer

xdr_memory. To detect credential dumping via LSASS memory access, the analyst needs to correlate process execution with memory access events. The xdr_process dataset provides process context, while xdr_memory captures the actual memory access. Together, they enable detection of suspicious processes reading LSASS memory.

Answer

xdr_registry

Answer

xdr_network

Answer

xdr_file

Question 10

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. Option D is correct because the XDM (Extended Data Model) schema in Cortex XSIAM maps ingested data from many sources into a consistent set of fields, so analysts can write XQL queries against stable, predictable field names instead of vendor-specific ones, greatly simplifying query authoring. Option E is correct because XDM normalizes data across different products and telemetry types (endpoint, network, cloud, identity, etc.) into a common taxonomy, enabling cross-source correlation and detection without per-vendor parsing logic. The unmarked options do not belong: XDM is a data-modeling/normalization layer and does not perform automated hardware replacement (A), does not directly increase endpoint processing speed (B), and while normalization can improve storage efficiency, it does not guarantee a specific 90% storage-cost reduction (C).

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%