SecOps-Pro Practice Exam 4 — 20 Questions

Question 1

Which TWO actions are commonly performed during the 'Pre-processing' phase of incident ingestion?

Accepted Answer

Assigning a specific playbook to the incident. Pre-processing rules allow for deduplication and incident enrichment/filtering before the incident is created or assigned.

Answer

Generating a final management report

Answer

Modifying the XSOAR server configuration

Answer

Executing a manual investigation

Question 2

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. Playbooks support various task types including manual, automated, and condition tasks.

Answer

Database cleanup task

Answer

Encryption task

Question 3

Which THREE of the following are valid components of a standard Content Pack?

Accepted Answer

Scripts. Content Packs contain various XSOAR objects like integrations, playbooks, and dashboards.

Answer

System Logs

Answer

Integration instances

Question 4

Which THREE actions are available when configuring a 'Condition' task?

Accepted Answer

Compare a context value to a static value. Condition tasks allow for testing context values, checking for existence, and branching based on comparison results.

Answer

Delete an incident

Answer

Change the task owner

Question 5

Which THREE actions can be performed from the Incident 'Work Plan' tab?

Accepted Answer

Skip a task. The Work Plan tab allows users to view progress, manually trigger tasks, and re-run failed tasks.

Answer

Change the server OS

Answer

Add a new incident type

Question 6

While analyzing a breach, an analyst identifies an IOC that is not yet flagged by automated systems. Which tool is used to manually update the global blacklist to prevent further spread across the organization?

Accepted Answer

Custom Threat Intelligence. Cortex XDR Custom Threat Intelligence allows analysts to manually push indicators to block across the enterprise.

Answer

Dynamic Address Groups

Answer

Security Profiles

Answer

Service Objects

Question 7

When configuring a new integration, you need to restrict the integration's access to only a subset of incident types. Which feature should be used?

Accepted Answer

Incident Type assignment in the Integration Instance configuration. Role-based access control and specific integration scope settings allow restricting which incidents an integration can interact with.

Answer

Global Incident field permissions

Answer

User Roles

Answer

Playbook permissions

Question 8

Which type of alert in Cortex XDR represents a high-confidence threat that has been automatically grouped with related events?

Accepted Answer

Incident. An Incident in Cortex XDR is a collection of related alerts that represent a single threat narrative.

Answer

Log

Answer

Indicator

Answer

Exclusion

Answer

Exception

Question 9

Which THREE of the following are valid methods for triggering a playbook in Cortex XSOAR?

Accepted Answer

Manual execution from the Incident War Room. Playbooks can be triggered automatically via classification, manually by an analyst, or through API requests.

Answer

Database trigger in PostgreSQL

Answer

Indicator reputation change

Question 10

A security analyst is investigating a phishing alert in Cortex XSOAR. Which workflow component is best utilized to standardize the response process for repetitive phishing email triage?

Accepted Answer

Playbook. Playbooks are the standard method in Cortex XSOAR for automating and standardizing incident response workflows.

Answer

Integration instance

Answer

Indicator auto-extraction

Answer

Dashboard widget

Question 11

Your organization has adopted a Zero Trust architecture. Which SOC operational process is most critical to validate that identity-based policies are effective?

Accepted Answer

User Behavior Analytics. User Behavior Analytics (UBA) and identity monitoring are central to verifying Zero Trust policies.

Answer

Hardware Lifecycle

Answer

Patch Management

Answer

Vulnerability Scanning

Question 12

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Roles and responsibilities and communication plans are fundamental to structured incident response.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 13

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS

Question 14

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Accepted Answer

BIOC Rules. BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.

Answer

IOC Search

Answer

Vulnerability Protection

Answer

Anti-Malware Policy

Question 15

During a threat hunting mission in XDR Query Builder, you need to find all processes running from the 'temp' directory. Which XDR language is utilized?

Accepted Answer

XQL. XDR Query Language (XQL) is used for advanced hunting and data exploration in Cortex XDR.

Answer

Python

Answer

Regex

Answer

SQL

Question 16

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?

Accepted Answer

User Risk. The User Investigation dashboard or User Risk view in Cortex XDR provides a consolidated view of user-linked alerts and behavioral history.

Answer

Threat Intelligence

Answer

Endpoint Status

Answer

Network Activity

Question 17

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Accepted Answer

Causality View. The Causality View in Cortex XDR allows analysts to visualize the process tree and the chain of events that led to the security alert.

Answer

Forensics Tab

Answer

Network Activity

Answer

Alert Details

Question 18

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Accepted Answer

XQL Search. XQL (XDR Query Language) allows for cross-source searching and correlation.

Answer

Incident Forensics

Answer

SQL Query Builder

Answer

Log Parser

Question 19

An analyst is reviewing a firewall policy. Which feature allows them to view the traffic logs that specifically match that rule?

Accepted Answer

Log Viewer. The 'Log' icon or 'View Logs' option in the policy window allows jumping directly to the logs associated with that specific rule.

Answer

Security Profile

Answer

Rule Base View

Answer

Policy Optimizer

Question 20

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

Accepted Answer

Cortex XSOAR. Cortex provides XDR for detection, XSOAR for automation, and Data Lake for log aggregation.

Answer

GlobalProtect Enterprise

Answer

Panorama Policy Creator