SecOps-Pro Practice Test 21 — 15 Questions

Question 1

A SOC analyst is reviewing a SIEM alert for a possible data exfiltration. The alert shows a large outbound transfer to an unknown external IP. The analyst needs to determine if this is malicious. Which action should the analyst take NEXT to gather the most relevant context?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify the user and process associated with the outbound transfer. To assess whether a large outbound transfer is malicious, the analyst must first understand the context: which user and process initiated it. If it is a known backup application or an authorized user action, it may be benign. If it is an unexpected process like PowerShell or a rare executable, it warrants further investigation. Identifying the user and process provides immediate insight and guides subsequent steps, such as checking reputation or isolating the host.

Answer

Query the SIEM for all traffic from the internal host to the external IP over the past 24 hours

Answer

Isolate the internal host immediately to prevent potential data loss

Answer

Check the reputation of the external IP in threat intelligence platforms

Question 2

A SOC manager wants to ensure that during a major incident, all analysts see the same set of indicators, tasks, and investigation findings without duplicating effort across shifts. Which Cortex XSOAR feature should the manager rely on to provide this shared investigation workspace?

Accepted Answer

The incident War Room, which centralizes tasks, entries, and artifacts for the investigation. The War Room is the collaborative workspace where all incident-related tasks, chat entries, files, and indicators are visible to every analyst. Using it ensures shift handoffs and parallel work stay synchronized, since everyone operates from the same incident context instead of duplicating discovery in separate tools.

Answer

The dashboard builder, which creates custom widgets summarizing incident metrics

Answer

The playbook editor, which allows analysts to modify automation logic during the incident

Answer

The indicator repository, which stores and scores IOCs across incidents

Question 3

A security operations center (SOC) manager wants to reduce the number of false positive alerts generated by Cortex XDR. Which two features can be used to tune alert generation and reduce noise? (Choose two.)

Accepted Answer

Alert Whitelisting. Alert Exclusion Rules and Alert Whitelisting are both designed to suppress or prevent alerts that are known to be benign. Exclusion rules apply broad criteria to filter out noise, while whitelisting specifically marks certain alerts as non-threatening. Together, they allow SOC teams to focus on genuine threats, significantly reducing false positives.

Answer

Endpoint Isolation

Answer

Biometric Authentication

Answer

Behavioral Threat Protection (BTP) Profiles

Question 4

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Accepted Answer

NGFW threat logs. Cortex Data Lake ingests security telemetry from Palo Alto Networks products and integrated sources, and NGFW threat logs (option A) are a core supported log type generated by next-generation firewalls and forwarded to the data lake for analytics and Cortex XDR/Cortex Data Lake correlation. XDR agent endpoint logs (option C) are also ingested, since Cortex XDR agents on endpoints send process, network, and security event telemetry into Cortex Data Lake for detection and investigation. Options B and D describe physical hardware metrics (server temperature and power supply voltage) that are not log types ingested by Cortex Data Lake, and option E (physical badge access logs) is physical security data that is not a native Cortex Data Lake ingestion type.

Answer

Active Directory physical server temperature

Answer

Firewall power supply voltage

Answer

User physical badge access logs

Question 5

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Option A is correct because the Log Forwarder must have outbound network connectivity to the Cortex XSIAM cloud endpoints (e.g., over TCP 443) so it can reliably forward collected logs to the tenant. Option D is correct because the forwarder must authenticate to XSIAM using the proper credentials, such as an authentication key or certificate, before it is trusted to transmit data. Option E is correct because logs must be parsed and mapped into XSIAM's schema (for example, via Broker VM parsing rules or data model mappings) so events are normalized and usable in detection and analytics. Options B and C are not required configuration elements: employee department codes are business metadata irrelevant to forwarding, and the physical location of the server room does not affect how the Log Forwarder is configured or authenticated.

Answer

Employee department codes

Answer

Physical location of the server room

Question 6

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) for phishing incidents has increased over the past quarter. To improve MTTD, which operational change should the manager prioritize?

Accepted Answer

Implement automated phishing email triage and enrichment playbooks.. Automated phishing triage and enrichment playbooks streamline the detection process by automatically parsing emails, extracting indicators, and querying threat intelligence. This reduces the manual effort and time required for analysts to identify malicious emails, directly lowering MTTD. Other options either do not impact detection speed or could introduce delays if not carefully managed.

Answer

Increase the retention period for email logs in the SIEM.

Answer

Increase the number of threat intelligence feeds integrated into the SIEM.

Answer

Conduct more frequent phishing simulation exercises for employees.

Question 7

An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?

Accepted Answer

XQL. XQL (XDR Query Language) is the primary query language for searching and analyzing data in XSIAM.

Answer

SQL

Answer

SPL

Answer

KQL

Question 8

A Cortex XSOAR playbook is triggered by a phishing incident. The playbook automatically extracts indicators from the email and enriches them using threat intelligence integrations. The analyst wants to ensure that any malicious URLs found are blocked on the next-generation firewall (NGFW) and that the incident is documented. Which XSOAR feature should the analyst use to automatically push the malicious URLs to the NGFW block list?

Accepted Answer

Integration Command. Integration Commands are the specific XSOAR actions that enable communication with external tools like an NGFW. They allow the playbook to automatically add malicious URLs to a block list, ensuring rapid response. Other options are either part of the playbook logic or data storage, not the execution mechanism.

Answer

Incident Field

Answer

Indicator Extraction

Answer

Playbook Task

Question 9

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

Accepted Answer

Context is the primary way to pass data between playbook tasks. The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.

Answer

Context data is automatically cleared every 24 hours

Answer

Context only supports string data types

Answer

Context data is shared between different incidents

Question 10

A Cortex XSIAM analyst is investigating an incident and wants to see the sequence of causally related events that led to a suspicious process execution, including parent-child relationships across endpoints. Which Cortex XSIAM feature should the analyst use?

Accepted Answer

The Causality view in the incident's investigation timeline.. The Causality view is purpose-built in Cortex XSIAM to visualize the chain of events behind an alert, connecting parent processes to child processes and showing the order in which actions occurred. It gives analysts a fast way to understand how a suspicious execution originated. The Issues table, asset inventory, and a basic XQL select do not present causal relationships between process events.

Answer

The Issues table filtered by the incident's severity.

Answer

The XQL query builder with a simple select statement.

Answer

The asset inventory page for the affected endpoint.

Question 11

A Cortex XDR administrator needs to ensure that all endpoint agents are reporting to the correct tenant and that the agent version is up to date. Which section of the Cortex XDR console provides a centralized view of endpoint agent status, including version, last seen time, and operational status?

Accepted Answer

Endpoints. The Endpoints section provides a centralized inventory of all managed endpoints, including agent version, last seen time, and operational status. This allows administrators to quickly identify agents that are outdated or not reporting, ensuring the security posture of the environment. Other sections focus on incidents, data ingestion, or policy configuration.

Answer

Data Sources

Answer

Incidents

Answer

Policy Management

Question 12

A security analyst is investigating a possible insider threat. They need to see all normal activity for a specific user over the past 90 days to establish a baseline before reviewing anomalous events. Which Cortex XSIAM capability should they use to efficiently visualize this historical, entity-centric data?

Accepted Answer

Entity Timeline. Establishing a behavioral baseline requires viewing an entity's complete activity history across all relevant data sources in a consolidated, chronological format. The Entity Timeline is specifically designed for this entity-centric analysis, allowing an analyst to quickly review normal patterns before focusing on anomalies. Other tools are either too query-focused or incident-specific to provide this broad historical context efficiently.

Answer

Query Center

Answer

Threat Intelligence module

Answer

Incident Investigation view

Question 13

A SOC analyst is investigating a Cortex XDR incident involving multiple alerts across several endpoints. The analyst needs to determine the initial infection vector and the sequence of events that led to the compromise. Which Cortex XDR feature should the analyst use to visualize the chronological order of alerts and related activities?

Accepted Answer

Incident Timeline. The Incident Timeline aggregates all alerts and related activities within an incident and displays them in chronological order. This allows the analyst to trace the attack from the initial infection vector through subsequent actions, such as lateral movement and data exfiltration. It is the primary tool for reconstructing multi-endpoint incidents and understanding the sequence of events.

Answer

Endpoint DLP Policy

Answer

Alert Triage View

Answer

Threat Intelligence Platform

Question 14

A security analyst is investigating a potential data exfiltration incident. They have identified a suspicious process on an endpoint that is making outbound connections to an unknown IP address. The analyst wants to determine the parent process that spawned this suspicious process and the command line arguments used. Which Cortex XDR data source should the analyst query to obtain this information?

Accepted Answer

XDR process execution logs. Process execution logs in Cortex XDR are the correct source because they record the full context of process creation, including the parent process, command line, and user. This allows the analyst to trace how the suspicious process was launched and with what arguments, which is critical for understanding the scope and nature of the exfiltration attempt.

Answer

Network flow logs

Answer

Endpoint registry changes

Answer

Authentication logs

Question 15

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile on the NGFW defines which logs (traffic, threat, URL, etc.) are sent to which external destination, including Cortex XSOAR. To trigger an XSOAR playbook when a threat signature fires, the firewall must forward the threat log via a Log Forwarding Profile attached to the relevant security policy rule. Without this, XSOAR never receives the event to initiate automation.

Answer

App-ID configuration

Answer

Security Policy Rule

Answer

GlobalProtect Gateway