SecOps-Pro Practice Exam 3 — 20 Questions

Question 1

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Accepted Answer

Work Plan. The Work Plan tab in an incident displays the current status and execution path of the playbook.

Answer

War Room

Answer

Evidence Board

Answer

Indicator Tab

Question 2

Which THREE items should be included in a standard SOC shift-handover report?

Accepted Answer

Status of high-priority incidents. High-priority incidents, pending action items, and known issues are essential for a smooth shift transition.

Answer

Entire network configuration file

Answer

Personal employee performance reviews

Question 3

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 4

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 5

Which feature in Cortex XSIAM is specifically designed for long-term storage of logs to meet compliance requirements?

Accepted Answer

Data Retention Policies. Data Retention Policies in Cortex XSIAM define how long different log and data types are stored, allowing organizations to keep logs for the period required by regulations such as PCI-DSS, HIPAA, or GDPR. This is the feature explicitly built to govern long-term storage duration and meet compliance mandates. Other options address filtering, backup of incidents, or compression, none of which define retention duration for compliance.

Answer

Log Filtering

Answer

Incident Backup

Answer

Archive Compression

Question 6

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Option C is correct because a mature SOC incident response plan must specify defined communication and escalation procedures, including who is notified, through which channels, and at what severity thresholds, so incidents are escalated promptly to the right stakeholders. Option E is correct because clearly defining roles and responsibilities (for example, incident commander, SOC analysts, forensics, and legal liaisons) ensures accountability and prevents gaps or duplication during response. Automated hardware repair (A) is a maintenance or IT operations function, not an incident response planning component. A public relations policy (B) may support crisis communications but is not a core component of the SOC incident response plan itself. Budget approval workflows (D) are financial governance processes and are not part of incident response planning.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 7

A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?

Accepted Answer

Use the 'Enrich Indicators' task with the indicator type set to 'IP'.. The 'Enrich Indicators' task in Cortex XSOAR is built to handle enrichment of multiple indicators of a given type. It automatically invokes the configured reputation commands for each indicator, aggregating the results. This is the most efficient and standardized way to perform reputation checks on a list of IPs.

Answer

Use a 'Run Command' task to execute the 'ip' command on each IP individually.

Answer

Use a 'Conditional' task to check each IP's reputation and then run a command.

Answer

Use a 'Data Collection' task to manually input the IPs and then run a command.

Question 8

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Accepted Answer

Endpoint Isolation. Endpoint Isolation is the correct response action because it severs all network connections except the management channel, effectively containing the threat while enabling remote forensic analysis. Other actions are more granular and do not provide the same level of network containment.

Answer

Terminate Process

Answer

Quarantine File

Answer

Block List

Question 9

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 10

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Accepted Answer

Third-party network device logs (e.g., Syslog).. Option C is correct because a Cortex XDR Collector can ingest third-party network device logs such as Syslog, which is a standard protocol for forwarding event data from routers, switches, and other network appliances into Cortex XDR for correlation and analysis. Option E is correct because the Cortex XDR Collector natively supports ingesting Palo Alto Networks Next-Generation Firewall logs, including traffic, threat, and URL filtering logs, which are parsed and normalized for Cortex XDR detection and investigation. The unmarked options do not belong: local user email drafts (A) are personal application data not collected by the Cortex XDR Collector, internal coffee machine status (B) is an IoT/facilities telemetry source outside the supported log ingestion scope, and physical hardware inventory logs (D) are asset-management data rather than the security event logs the Collector is designed to receive.

Answer

Local user email drafts.

Answer

Internal coffee machine status.

Answer

Physical hardware inventory logs.

Question 11

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

Accepted Answer

Summary. The Summary tab in the Incident view is designed to provide a real-time, user-friendly overview of the investigation status. It aggregates key details such as incident severity, status, assignee, and a timeline of events, giving analysts an at-a-glance understanding without navigating multiple tabs. This aligns with the goal of a quick, high-level summary for efficient incident management.

Answer

Indicators

Answer

Work Plan

Answer

Evidence

Question 12

Why should you use an 'Indicator Reputation' threshold in your SecOps process?

Accepted Answer

To prevent low-confidence or unverified indicators from triggering automated blocks. It helps reduce false positives by ensuring only high-confidence indicators trigger automated blocks.

Answer

To automatically delete logs

Answer

To increase the number of alerts

Answer

To speed up data ingestion

Question 13

Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?

Accepted Answer

Mean Time to Remediate (MTTR). Mean Time to Remediate (MTTR) measures the average time from incident detection to full remediation, directly reflecting the operational efficiency of the Incident Response team. Over a fiscal quarter, tracking MTTR shows whether the team is improving its response speed and effectiveness, making it the most relevant efficiency metric.

Answer

Total number of alerts generated

Answer

Number of active playbooks

Answer

Number of users trained on phishing

Question 14

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

Accepted Answer

The endpoint has not received the updated policy containing the BIOC.. If the agent has not yet received the latest policy update containing the new BIOC, it will not enforce the rule.

Answer

The agent is not configured to send BIOC logs.

Answer

The BIOC rule is disabled by default.

Answer

The BIOC rule requires a full agent reboot.

Question 15

A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?

Accepted Answer

Query Builder with network events. Query Builder with network events is the correct tool because it allows the analyst to run XQL queries against historical network data, filtering by endpoint and time range. This returns a list of all external IP addresses the endpoint communicated with, which is essential for identifying potential exfiltration destinations. Other views are more focused on alerts or current state and lack the comprehensive historical network data required.

Answer

Threat Intelligence module

Answer

Endpoint Investigation view

Answer

Incident Response view

Question 16

What is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?

Accepted Answer

To parse and identify IOCs from incident descriptions or email bodies. Indicator extraction automatically identifies and parses artifacts from unstructured text.

Answer

To manually block IPs on the firewall

Answer

To update the threat intelligence database

Answer

To generate reports on threat actors

Question 17

A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?

Accepted Answer

Replace the `match` stage with a `comp` stage that uses `count()` grouped by `action_local_ip` and then apply a `filter` on the count.. Correlation rules that require counting events within a timeframe need an aggregation stage such as `comp count()` grouped by the relevant field. A `match` stage alone groups events but does not count them; it simply aligns events by a common field. To enforce a threshold, the rule must aggregate counts and then filter on the aggregated value, ensuring it fires only when the count exceeds the defined limit.

Answer

Increase the `timeframe` to 10 minutes and add a `dedup` stage on `action_local_ip` to remove duplicate events.

Answer

Add a `filter` stage after the `match` stage to count the number of events per `action_local_ip` and compare against a threshold.

Answer

Add a `sort` stage on `action_local_ip` and a `limit` stage to return only the top 10 events.

Question 18

A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?

Accepted Answer

Create an exclusion rule in the 'Alert Exclusions' section, specifying the endpoint group 'Finance' and the alert category 'Credential Dumping'.. Alert Exclusions are designed to suppress specific alerts based on criteria such as endpoint group and alert category. By creating an exclusion for the 'Finance' group and 'Credential Dumping' category, the administrator can reduce noise while maintaining detection for other groups and alert types. Other mechanisms like Prevention profiles or BIOC rules serve different purposes.

Answer

Create a BIOC rule with a filter for the 'Finance' group and a condition to exclude 'Credential Dumping' alerts.

Answer

Create a policy rule in 'Prevention' profiles, setting the action to 'Ignore' for the 'Credential Dumping' category and applying it to the 'Finance' group.

Answer

Create an exception in the 'Malware' profile for the 'Finance' group, specifying the 'Credential Dumping' category.

Question 19

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Accepted Answer

Causality Analysis. Causality Analysis is the correct feature because it reconstructs the sequence of events and process relationships that led to an alert. It shows the parent-child chain, enabling the analyst to determine if the PowerShell script was spawned by a legitimate application or a malicious one. Other options either focus on live inspection, automation, or external threat data, none of which provide the required lineage view.

Answer

Process Explorer

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Question 20

What is the function of the 'Cortex XDR Broker Service'?

Accepted Answer

To act as a proxy/relay for agents in restricted environments.. The Cortex XDR Broker Service acts as a proxy/relay for agents in restricted environments, such as those without direct internet access. It enables agents to communicate with the Cortex XDR cloud by forwarding traffic through the broker. It does not manage user identities, store endpoint logs, or provide automatic remediation.

Answer

To manage user identities.

Answer

To store endpoint logs.

Answer

To provide automatic remediation.