SecOps-Pro Practice Test 20 — 15 Questions

Question 1

A SecOps engineer is building a Cortex XSOAR playbook to process phishing incidents. They need a task that will execute a custom Python script to parse email headers and then pass the extracted sender domain to the next task. Which type of playbook task should they use to run the custom Python code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A 'Script' task that runs a custom automation script.. The Script task is specifically designed to execute custom automation scripts within a playbook. It allows the engineer to run Python code that can parse email headers, extract the sender domain, and save it to the context for use by later tasks. Manual, Conditional, and Data Collection tasks do not support running custom code and are intended for human interaction or branching logic.

Answer

A 'Conditional' task that evaluates the email headers against a set of rules.

Answer

A 'Manual' task that requires an analyst to input the sender domain.

Answer

A 'Data Collection' task that prompts for the sender domain via a form.

Question 2

A SOC analyst is building a playbook in Cortex XSOAR to automate the investigation of suspicious login alerts. The playbook needs to query an external threat intelligence platform for the reputation of the source IP address. Which type of task should the analyst use to perform this action?

Accepted Answer

A 'Command' task that executes an integration command to query the threat intelligence platform.. To query an external threat intelligence platform, the playbook should use a Command task that runs the appropriate integration command. This task type executes the command and automatically stores the results in the playbook context, enabling subsequent tasks to use the reputation data.

Answer

A 'Data Collection' task to prompt the analyst for the IP reputation.

Answer

A 'Conditional' task to evaluate the IP address against a list of known malicious IPs.

Answer

A 'Manual' task to instruct the analyst to look up the IP reputation manually.

Question 3

Which THREE of the following are valid components of a standard Content Pack?

Accepted Answer

Scripts. A standard Content Pack is a bundled, versioned collection of reusable configuration and automation assets that can be installed into a platform (such as Cortex XSOAR or a similar SOAR/security platform). Option A (Scripts) is correct because automation scripts are a core content-pack component, packaged so they can be executed by playbooks or commands. Option B (Dashboards) is correct because dashboards and widgets are commonly shipped inside content packs to provide prebuilt visualizations and reporting. Option D (Playbooks) is correct because playbooks are the primary automation artifacts distributed in content packs, defining the orchestrated response workflows. Option C (System Logs) is not a component of a content pack; logs are runtime output generated by the platform, not packaged content. Option E (Integration instances) is not a component either; instances are environment-specific configurations created when an integration is enabled, whereas the content pack contains the integration definition itself, not the configured instance.

Answer

System Logs

Answer

Integration instances

Question 4

A Tier 1 analyst at a healthcare SOC receives a Cortex XDR alert for 'Behavioral Threat detected' on a nurse's workstation. The alert details show a process tree where winword.exe spawned powershell.exe with an encoded command. The analyst's playbook states that all 'Behavioral Threat' alerts must be triaged within 15 minutes. What is the FIRST action the analyst should take according to standard SOC triage procedures?

Accepted Answer

Review the alert details, including the process tree and command line, to validate the alert.. The correct first action is to validate the alert by reviewing the process tree and command line. This step confirms whether the activity is malicious, such as a malware download or execution, or benign. Only after validation should containment or escalation occur. This aligns with standard SOC triage procedures and avoids unnecessary disruption.

Answer

Escalate the alert to Tier 2 immediately without further investigation.

Answer

Immediately isolate the endpoint using the Cortex XDR isolate endpoint action.

Answer

Close the alert as a false positive because Word can legitimately spawn PowerShell.

Question 5

While designing a playbook, an automation engineer needs a task to execute only when the incident severity is exactly 'High'. Which of the following conditions should be used in the task's 'Run if' field?

Accepted Answer

severity == 'High'. In Cortex XSOAR playbook tasks, the 'Run if' field uses Python-like expressions to evaluate conditions. To check if the incident severity equals 'High', the equality operator '==' is required. This ensures the task runs only when the condition is true.

Answer

severity equals 'High'

Answer

severity = 'High'

Answer

severity is 'High'

Question 6

A SOC analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious external IP address that the compromised host communicated with. To determine if other hosts in the organization have communicated with the same IP, which Cortex XDR feature should the analyst use?

Accepted Answer

Cortex XDR Query Builder. Query Builder is the correct feature because it enables a search across all endpoint network connection events for the specific external IP address. This search will return every host that communicated with that IP, allowing the analyst to identify the full scope of the incident and take appropriate containment measures on all affected endpoints.

Answer

Cortex XDR Causality Chain

Answer

Cortex XDR Threat Intelligence Module

Answer

Cortex XDR Incident Response Playbook

Question 7

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Accepted Answer

Live Terminal. The Remote Terminal or Live Terminal feature in Cortex XDR allows for direct command-line interaction with managed endpoints.

Answer

Endpoint File Search

Answer

Snapshot Manager

Answer

Policy Editor

Question 8

A security analyst receives a threat intelligence report indicating that a specific IP address is associated with a command-and-control (C2) server. The analyst wants to automatically block this IP on the Palo Alto Networks firewall when it is detected in future incidents. Which Cortex XSOAR feature should the analyst use to ensure the IP is automatically blocked?

Accepted Answer

Playbook with a blocking task. The correct approach is to use a playbook with a blocking task because Cortex XSOAR playbooks orchestrate automated responses across integrated security tools. When an incident contains the malicious IP, the playbook can execute a firewall integration command to block it, ensuring consistent and immediate enforcement without manual intervention.

Answer

Indicator relationship mapping

Answer

Indicator enrichment

Answer

Indicator exclusion

Question 9

A SOC manager is evaluating the team's incident response process and wants to improve the efficiency of alert triage. Which TWO metrics should the manager track to identify bottlenecks in the triage phase? (Choose two.)

Accepted Answer

Mean time to acknowledge (MTTA). To identify bottlenecks in alert triage, the SOC manager should track metrics that directly reflect the triage process. Mean time to acknowledge (MTTA) measures how quickly analysts pick up alerts, highlighting delays in initial review. Alert volume per analyst shows the workload, which can indicate if analysts are overwhelmed. Together, these metrics help pinpoint whether delays are due to slow acknowledgment or excessive alert volume, enabling targeted improvements.

Answer

Percentage of false positives

Answer

Mean time to resolve (MTTR)

Answer

Mean time to detect (MTTD)

Question 10

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Accepted Answer

actor_process_command_line. To detect PowerShell executed with an encoded command, the rule must inspect the command line used to launch PowerShell. The 'actor_process_command_line' field captures the full command line of the process that initiated the action, including '-EncodedCommand' or '-enc' arguments. This is the correct field for detecting encoded PowerShell.

Answer

file_hash

Answer

target_process_path

Answer

process_name

Question 11

You are creating a new playbook and need to add a task that will send an email to the security team with the details of the incident. Which task type should you use to accomplish this?

Accepted Answer

Email task. The Email task is the built-in playbook task designed for sending emails. It provides fields for recipients, subject, and body, and supports context variables to include incident details. This automates notification without requiring manual intervention or complex integration configuration. Other task types serve different purposes: integration tasks run specific commands, manual tasks pause for human action, and conditional tasks control flow.

Answer

Conditional task

Answer

Integration task

Answer

Manual task

Question 12

A Cortex XDR analyst is investigating a series of alerts across multiple endpoints that appear to be part of a coordinated attack. The analyst wants to identify the common root cause and see how the attack spread from the initial endpoint to others. Which Cortex XDR capability provides this cross-endpoint correlation?

Accepted Answer

Incident grouping that correlates alerts across endpoints based on shared indicators and causality. Cortex XDR incident grouping correlates alerts across endpoints by shared indicators, causality, and attack patterns. This gives the analyst a unified view to identify the common root cause and trace lateral movement. Isolation, WildFire reports, and manual XQL queries do not provide automated cross-endpoint correlation for a coordinated campaign.

Answer

The XQL query editor, which can search for alerts by endpoint name across the dataset

Answer

The WildFire analysis report, which shows the behavior of the malicious file in a sandbox

Answer

The endpoint isolation feature, which quarantines each affected endpoint individually

Question 13

A SOC analyst is triaging a Cortex XDR alert indicating a possible ransomware infection on a Windows endpoint. The analyst needs to gather additional context to determine the scope and severity. Which TWO actions should the analyst take using Cortex XDR? (Choose two.)

Accepted Answer

Review the Causality Chain to identify the root cause process.. To effectively triage a ransomware alert, the analyst must understand both the root cause and the scope. The Causality Chain reveals how the infection occurred, while querying the file hash across all endpoints identifies other potential victims. These actions provide the necessary context to assess severity and plan containment. Other options are either response actions or do not directly aid in scoping the incident.

Answer

Initiate a live terminal session to manually delete the ransomware executable.

Answer

Isolate the endpoint immediately without further investigation.

Answer

Check the Cortex XDR Threat Intelligence module for the ransomware's reputation.

Question 14

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Accepted Answer

Blocking a C2 IP address on the firewall. In the Containment phase, the goal is to stop the spread of the incident and limit its impact while preserving evidence. Option C (Blocking a C2 IP address on the firewall) is correct because blocking command-and-control traffic at the perimeter prevents compromised hosts from communicating with attacker infrastructure, a standard containment action. Option D (Isolating the affected endpoint) is correct because quarantining or network-isolating the endpoint stops lateral movement and further compromise. Option A (Updating system documentation) is a post-incident or documentation activity, not containment. Option B (Rebuilding the infected server) is part of Eradication/Recovery, since it removes and restores the system. Option E (Conducting a root cause analysis) belongs to the Post-Incident/Lessons Learned phase, not Containment.

Answer

Updating system documentation

Answer

Rebuilding the infected server

Answer

Conducting a root cause analysis

Question 15

A security analyst is investigating an incident in Cortex XSIAM and wants to see the chronological sequence of all activities related to a specific host, including process executions, network connections, and registry modifications. Which XSIAM feature should the analyst use to obtain this timeline view?

Accepted Answer

The Timeline view, which aggregates and displays all events for a selected host or entity in chronological order.. The Timeline view in Cortex XSIAM is specifically designed to present a chronological sequence of events for an entity like a host. It automatically aggregates events from various sources, including process, network, and registry activities, into a single timeline. This makes it the ideal feature for analysts needing a comprehensive chronological view during an investigation.

Answer

The Incident War Room, which displays all alerts and artifacts associated with the incident.

Answer

The Causality View, which visualizes the chain of events leading to an alert.

Answer

The Query Builder, which allows running XQL queries to retrieve events and manually sort them by timestamp.