SecOps-Pro Practice Exam 2 — 20 Questions

Question 1

A tier-one analyst receives a Cortex XSIAM incident about a suspicious PowerShell execution on a finance workstation. The analyst wants to immediately determine what the process did on the endpoint, including its parent process, command-line arguments, and any child processes it spawned, without leaving the incident view. Which XSIAM capability should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Causality view for the process, which shows the process tree with parent and child relationships and the associated event details.. The Causality view is designed for exactly this triage need: it renders the process tree around an event so analysts can see the parent, the full command line, and any child processes spawned on the endpoint. It lives inside the investigation experience, so no tool switching is required. Reputation panels, policy pages, and interactive shells either describe something other than runtime behavior or are heavier response actions unsuited to quick context gathering.

Answer

The threat intelligence enrichment panel, which correlates the process hash against known malware families.

Answer

The Cortex XSIAM agent console on the endpoint, where the analyst can run a live terminal session against the host.

Answer

The attack surface rule management page, which lists which endpoint protections were enforced at the time of the event.

Question 2

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

Accepted Answer

Value. The Value field is the actual indicator data (for example, an IP address, domain, file hash, or URL) that Cortex XSOAR uses to perform lookups and reputation scoring. If the Value is not correctly mapped from the external feed, the indicator cannot be matched against existing data or enriched by integrations, breaking the entire feed ingestion pipeline. Indicator Type, Expiration, and Source are metadata that describe the indicator but do not drive lookup or scoring.

Answer

Indicator Type

Answer

Expiration

Answer

Indicator Source

Question 3

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

Accepted Answer

join. The 'join' keyword is essential in XQL for correlating disparate datasets.

Answer

connect

Answer

union

Answer

merge

Question 4

In the SOC structure, which role is typically responsible for the initial triage and validation of security alerts?

Accepted Answer

Tier 1 Analyst. The Tier 1 Analyst is the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, validating whether an alert is a true positive, and escalating confirmed incidents to Tier 2 or Tier 3. This role is explicitly defined for initial alert validation and triage.

Answer

Threat Researcher

Answer

Tier 3 Analyst

Answer

SOC Manager

Question 5

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 6

Which THREE of the following are critical elements of the Indicator Lifecycle in Cortex XSOAR?

Accepted Answer

Indicator Ingestion. The Indicator Lifecycle in Cortex XSOAR describes how indicators (such as IPs, domains, and file hashes) are brought into the system, enriched, and eventually aged out. Indicator Ingestion (B) is correct because it is the entry point of the lifecycle, where indicators are pulled in from feeds, integrations, or incidents and stored in the indicators database. Indicator Expiration (C) is correct because indicators have a time-to-live (TTL) and must be automatically expired or removed when they are no longer relevant, which is a defined stage of the lifecycle. Reputation Scoring (D) is correct because assigning and updating reputation (e.g., malicious, suspicious, benign, or unknown) based on enrichment and threat intel is a core part of how indicators are evaluated and maintained throughout their lifecycle. Changing the server IP address (A) is a network/infrastructure administration task unrelated to indicator handling, and physical security of the data center (E) is a facilities/security concern, neither of which is a stage or element of the Indicator Lifecycle in Cortex XSOAR.

Answer

Changing the server IP address

Answer

Physical security of the data center

Question 7

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Accepted Answer

Real-time incident queue tracking. Option A is correct because the Cortex XSIAM Unified SOC dashboard is designed to give analysts a live, prioritized view of incidents, so real-time incident queue tracking is a core capability that lets teams monitor open cases, severity, and status as events stream in. Option E is correct because the dashboard is built on customizable widgets, allowing SOC teams to create and arrange widgets that surface the specific metrics, threat feeds, or case data relevant to their environment. The remaining options do not belong: Cortex agent update scheduling (B) is an endpoint management function handled through Cortex XDR policies rather than the Unified SOC dashboard, physical security badge tracking (C) is a facility-access concern outside XSIAM's SOC analytics, and automated code deployment (D) is a CI/CD pipeline activity unrelated to SOC monitoring and incident response.

Answer

Cortex agent update scheduling

Answer

Physical security badge tracking

Answer

Automated code deployment

Question 8

A Cortex XDR administrator needs to ensure that all endpoint agents can communicate with the Cortex XDR management console even when endpoints are behind a proxy. Which configuration should the administrator verify?

Accepted Answer

Agent proxy settings in the Cortex XDR agent configuration. In proxy environments, Cortex XDR agents must be configured with the appropriate proxy settings to reach the management console. This is done through the agent configuration in the Cortex XDR console or via endpoint policy. Without these settings, agents cannot register or send data. Other network configurations like DNS or firewall rules are important but do not replace the need for explicit proxy configuration.

Answer

Firewall rules allowing inbound traffic to the endpoint

Answer

DNS resolution for the Cortex XDR console

Answer

SSL inspection exemptions for the Cortex XDR console

Question 9

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 10

If an endpoint is marked as 'Out of Date', what does this mean?

Accepted Answer

The agent version is older than the latest available version.. An 'Out of Date' status means the agent software version is behind the current version available in the console, indicating it needs an upgrade.

Answer

The agent has failed a security scan.

Answer

The agent has not communicated for a long time.

Answer

The license has expired.

Question 11

In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?

Accepted Answer

Cortex Playbooks. Playbooks are the engine for automated orchestration and response in XSIAM.

Answer

Detection Rules

Answer

XQL Search Filters

Answer

Data Ingestion Pipeline

Question 12

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 13

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

Accepted Answer

SOC Overview Dashboard. The SOC Overview dashboard is designed to provide high-level visibility into security status.

Answer

Configuration Audit Logs

Answer

Raw Data Explorer

Answer

Agent Status Report

Question 14

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. In the Cortex XSIAM Incident record, option A (Associated logs and alerts) is correct because an incident aggregates the underlying alerts and their raw log evidence that triggered or contributed to the case, giving analysts the source telemetry. Option C (Timeline of events) is correct because XSIAM builds a chronological timeline that correlates alerts, activity, and analyst actions to show how the incident unfolded. Option D (Impacted entities) is correct because the incident record identifies the affected entities such as hosts, users, IP addresses, and accounts, which is essential for scoping and response. Option B (Employee performance reviews) is not part of incident data, as that is HR information unrelated to security telemetry. Option E (Platform billing history) is also not included, since licensing and billing records are administrative data, not incident evidence.

Answer

Employee performance reviews

Answer

Platform billing history

Question 15

What is the purpose of the 'XSIAM Agent' exclusion list?

Accepted Answer

To exclude safe files from agent inspection. Exclusions prevent the agent from inspecting or blocking known-safe files or processes.

Answer

To hide files from the administrator

Answer

To disable the agent entirely

Answer

To remove logs from storage

Question 16

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Accepted Answer

Assign a Tag. Option A (Assign a Tag) is correct because XSOAR indicators support tags that analysts apply to categorize, group, and track threat data through its lifecycle, enabling filtering, searching, and automated playbook logic based on tag values. Option B (Update Reputation) is correct because each indicator in XSOAR carries a reputation score (e.g., None, Benign, Suspicious, Malicious) that can be manually or automatically updated, which is central to lifecycle management since it drives incident severity and playbook branching. The remaining options do not apply to indicator objects: installing a new plugin (C) is a system/marketplace administration task, renaming the source feed (D) modifies a feed integration rather than an indicator, and changing the server OS (E) is an infrastructure operation unrelated to indicator lifecycle management.

Answer

Install a new plugin

Answer

Rename the source feed

Answer

Change the server OS

Question 17

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS

Question 18

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Accepted Answer

BIOC Rules. BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.

Answer

IOC Search

Answer

Vulnerability Protection

Answer

Anti-Malware Policy

Question 19

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

Accepted Answer

Cortex XSOAR. Cortex provides XDR for detection, XSOAR for automation, and Data Lake for log aggregation.

Answer

GlobalProtect Enterprise

Answer

Panorama Policy Creator

Question 20

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

Accepted Answer

Behavioral Threat Protection. The Cortex XDR agent uses Behavioral Threat Protection to stop malicious processes in real-time.

Answer

Exploit Prevention

Answer

Network Isolation

Answer

Host Insight