SecOps-Pro Practice Exam 3 — 20 Questions

Question 1

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 2

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 3

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Accepted Answer

Incident Context. Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.

Answer

Hard-coding the context path

Answer

Database injection

Answer

Global variables

Question 4

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

Accepted Answer

SOC Overview Dashboard. The SOC Overview dashboard is designed to provide high-level visibility into security status.

Answer

Configuration Audit Logs

Answer

Raw Data Explorer

Answer

Agent Status Report

Question 5

What is the purpose of the 'XSIAM Agent' exclusion list?

Accepted Answer

To exclude safe files from agent inspection. Exclusions prevent the agent from inspecting or blocking known-safe files or processes.

Answer

To hide files from the administrator

Answer

To disable the agent entirely

Answer

To remove logs from storage

Question 6

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. Incident records provide a comprehensive view of the threat, including timeline, entities, and logs.

Answer

Employee performance reviews

Answer

Platform billing history

Question 7

Where do you view the status of endpoints currently connected to the Cortex XSIAM platform?

Accepted Answer

Asset Management. The Asset/Endpoint management page displays the health and status of all agents.

Answer

Data Ingestion menu

Answer

Incident Response console

Answer

System Logs

Question 8

A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?

Accepted Answer

Use a conditional task to check if the field contains data before executing subsequent steps. Using the 'Continue on error' or 'On failure' path, or using a condition task with 'is empty' logic, allows for robust error handling.

Answer

Hard-code the value in the integration parameters

Answer

Delete the task from the playbook

Answer

Change the integration instance timeout settings

Question 9

Which THREE of the following represent common data sources for Cortex XSIAM?

Accepted Answer

Cloud infrastructure logs (e.g., AWS CloudTrail). XSIAM aggregates data from network, endpoint, and cloud sources.

Answer

Employee payroll database

Answer

Coffee machine diagnostic logs

Question 10

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 11

You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?

Accepted Answer

Create an Incident Classifier rule to assign the playbook based on incident attributes. The 'Incident Auto-Classifier' or 'Automated Assignment' rules based on incident type or severity are the most efficient methods.

Answer

Manually open each incident and assign the playbook

Answer

Restart the server

Answer

Wait for the user to trigger it

Answer

Rename the incidents

Question 12

A new SOC analyst wants to see all traffic blocked by the firewall in the last hour. Where should they navigate in the Panorama monitor tab?

Accepted Answer

Monitor > Logs > Traffic. The Monitor tab in Panorama provides access to log views, including filtered traffic logs.

Answer

Network > Interfaces

Answer

Policies > Security

Answer

Objects > Services

Question 13

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 14

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 15

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Configuration requires network reachability, authentication, and defined ingestion rules.

Answer

Employee department codes

Answer

Physical location of the server room

Question 16

You want to trigger a playbook automatically whenever a new indicator is created of a specific type. Where is this configuration set?

Accepted Answer

Indicator Type Settings. The 'Indicator Auto-Extraction' or 'Indicator Triggered Playbook' settings allow you to map indicator types to specific playbooks.

Answer

Incident Type Settings

Answer

Playbook Inputs

Answer

Global Search

Question 17

You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?

Accepted Answer

Work Plan tab in the Incident view. The Work Plan tab within the incident view allows you to drill down into task results and inspect raw inputs/outputs.

Answer

System Logs

Answer

Indicator dashboard

Answer

Integration Instance Logs

Question 18

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 19

Which TWO of these are valid methods to trigger an automated playbook?

Accepted Answer

Incident Type auto-trigger. Playbooks can be triggered by incident ingestion (via Classifier) or manually by an analyst.

Answer

System boot-up

Answer

Setting a cron schedule

Answer

Browser refresh

Question 20

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.

Answer

Incident display layout

Answer

User password length