SecOps-Pro Practice Test 22 — 15 Questions

Question 1

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

Accepted Answer

Threat Log. Threat logs specifically capture information about security events identified by the NGFW security profiles.

Answer

Config Log

Answer

Traffic Log

Answer

System Log

Question 2

A SecOps analyst receives an alert indicating a possible credential dumping attempt on a Windows server. The analyst wants to quickly determine which user account initiated the suspicious process and what other commands were run in the same session. Which Cortex XDR data source should the analyst query?

Accepted Answer

The endpoint process execution telemetry, which includes user context and command-line arguments. Endpoint process execution telemetry in Cortex XDR includes user context, command-line arguments, and session identifiers. This directly answers which user initiated the suspicious process and what other commands were run. Network, authentication, and DNS logs lack the process-level detail needed for this attribution.

Answer

The network traffic logs, which show outbound connections from the server

Answer

The DNS query logs, which show domain resolutions from the server

Answer

The authentication logs, which record successful and failed logon attempts

Question 3

A Cortex XSIAM administrator needs to ensure that a specific XQL query used in a correlation rule runs efficiently and does not scan unnecessary data. The query currently filters on `event_type = PROCESS` and `actor_process_image_name = "powershell.exe"`. The dataset contains billions of events. Which optimization technique should the administrator apply to reduce query execution time?

Accepted Answer

Use the `filter` stage as early as possible in the query to reduce the dataset before subsequent stages.. For large datasets in Cortex XSIAM, query performance is heavily influenced by how early filters are applied. Placing `filter` stages at the beginning of the query pipeline ensures that only relevant events proceed to subsequent stages, reducing the overall data processed. This is a best practice for optimizing XQL queries and is especially important when dealing with billions of events.

Answer

Add a `limit` stage to restrict the number of events returned to 1000.

Answer

Use the `comp` stage to calculate a hash of `actor_process_image_name` and filter on the hash.

Answer

Add an index on `actor_process_image_name` to speed up the filter.

Question 4

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Accepted Answer

Custom URL Category. In PAN-DB (Palo Alto Networks URL database), custom URL categories are the object used to define lists of URLs/domains that can be referenced in security policies. To block a C2 domain globally across all Panorama-managed firewalls, you create or update a custom URL category containing the domain, then reference it in a security policy rule pushed from Panorama to all managed devices.

Answer

Application Override

Answer

Security Policy Action

Answer

Threat ID

Question 5

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were accessed and transferred to an external IP address. Which Cortex XDR data source should the analyst query to obtain this information?

Accepted Answer

Endpoint Data. Endpoint Data in Cortex XDR captures granular file and process activity, including file access and network connections. By querying this data, the analyst can link file reads to outbound connections to external IPs, providing the necessary evidence of data exfiltration.

Answer

Network Traffic Logs

Answer

Authentication Logs

Answer

DNS Logs

Question 6

A Cortex XDR analyst notices that a single endpoint generated over 200 alerts in the last hour, all tied to the same parent process tree and the same remote IP. The analyst wants to reduce analyst fatigue while preserving the full investigation timeline. Which Cortex XDR capability should the analyst use to consolidate these related alerts?

Accepted Answer

Incident grouping that correlates alerts sharing a common causality chain and host into one incident. Cortex XDR correlates alerts that share a causality chain and endpoint into a single incident entity. This preserves the full investigation timeline while collapsing duplicate noise, directly reducing analyst fatigue. The other options either analyze files, manually close alerts, or attempt suppression, none of which consolidate related alerts into one investigation entity.

Answer

Configuring a BIOC rule to suppress all alerts from the affected endpoint for one hour

Answer

Creating an XQL query that counts alerts per endpoint and manually closing duplicates

Answer

Enabling WildFire forwarding so the parent process is submitted for sandbox analysis

Question 7

In the context of the SOC maturity model, which phase focuses primarily on the formalization of playbooks and the integration of automated threat intelligence?

Accepted Answer

Defined. In the SOC maturity model (often aligned with CMMI-style stages: Ad-hoc, Managed, Defined, Optimized), the Defined phase is where processes become documented, standardized, and repeatable across the organization. This is the phase where formal playbooks are written and automated threat intelligence feeds are integrated into workflows, moving the SOC from reactive to process-driven operations.

Answer

Optimized

Answer

Managed

Answer

Ad-hoc

Question 8

A security analyst is investigating an alert in Cortex XDR and wants to see the raw endpoint data that contributed to the alert, including registry modifications and network connections. Which console section should the analyst use to query this data directly?

Accepted Answer

Endpoint Investigation. Endpoint Investigation is the Cortex XDR module that enables querying of endpoint telemetry using XQL. It gives analysts access to raw events such as registry modifications and network connections, which are essential for understanding the context of an alert. Other sections like Incident Response or Alerts do not provide this query capability, making Endpoint Investigation the correct choice.

Answer

Threat Intelligence

Answer

Alerts

Answer

Incident Response

Question 9

You are building a playbook that must handle incidents differently based on the severity of the alert. The severity is stored in the incident field 'severity' as an integer (0-4). You want to conditionally execute a task only when severity is 3 or higher. Which built-in playbook task type should you use to evaluate this condition and route the workflow accordingly?

Accepted Answer

Decision task. The correct answer is the task type that evaluates expressions and routes the playbook accordingly. In Cortex XSOAR, the Decision task is designed for conditional branching using incident fields and functions. It supports complex conditions like severity >= 3, enabling dynamic workflow paths. Other task types serve different purposes: manual tasks require human input, data collection tasks gather information, and conditional tasks branch on task outcomes, not field values.

Answer

Conditional task

Answer

Data collection task

Answer

Manual task

Question 10

A Cortex XSOAR engineer is designing a playbook to automate the response to a phishing incident. They need to ensure that the playbook can handle cases where the email contains attachments. Which two tasks should they include to extract and analyze attachments? (Choose two.)

Accepted Answer

A 'File Enrichment' task to analyze the extracted files.. To handle email attachments in a phishing playbook, the engineer should first extract the attachments using a File Extraction task, and then analyze them using a File Enrichment task. These two tasks automate the process of obtaining and assessing the attachments. Conditional, Manual, and Data Collection tasks do not perform the necessary extraction or analysis.

Answer

A 'Data Collection' task to collect attachment details from the analyst.

Answer

A 'Conditional' task to check if the email has attachments.

Answer

A 'Manual' task to review the attachments manually.

Question 11

A Cortex XSIAM administrator needs to ensure that all endpoint telemetry from a critical server group is collected and forwarded to the platform, even if the endpoint's network connection is intermittent. The solution must be resilient and not lose data during outages. Which component of the Cortex XSIAM agent architecture is responsible for this reliable data handling?

Accepted Answer

The agent's local event buffer. Reliable endpoint data collection during network disruptions requires a mechanism at the source. The Cortex XSIAM agent's local event buffer stores telemetry on the endpoint when it cannot communicate with the platform, and forwards it upon reconnection. This store-and-forward capability is critical for maintaining complete visibility from endpoints in unstable network environments, which is a core requirement for effective security operations.

Answer

The platform's ingestion pipeline

Answer

The XQL query engine

Answer

The Cortex XSIAM Broker VM

Question 12

A Cortex XDR analyst notices an endpoint generating a high volume of process creation events that match a known attack pattern, but the pattern is not tied to any file hash or network indicator. The analyst wants Cortex XDR to alert on this behaviour automatically in the future without creating a signature-based rule. Which Cortex XDR capability should the analyst use?

Accepted Answer

Create a BIOC rule that defines the behavioural sequence and triggers an alert when matched. BIOC rules are designed to detect behavioural sequences rather than static indicators, so they can alert on process creation patterns even when no hash or network artifact exists. This gives the SOC durable, signature-independent detection that fires automatically whenever the same behaviour recurs on any endpoint in the environment.

Answer

Submit the suspicious binary to WildFire for sandbox analysis

Answer

Add the file hash to an IOC rule with a block action

Answer

Enable a Cortex XDR exception policy for the affected process

Question 13

Which feature in XSOAR allows you to see the relationships between various indicators, incidents, and threat actors?

Accepted Answer

Graph. The Graph view is designed for visualizing relationships between entities.

Answer

Report

Answer

Dashboard

Answer

Settings

Answer

War Room

Question 14

An analyst needs to correlate logs from multiple Palo Alto Networks firewalls to identify lateral movement. Which tool provides the centralized log aggregation and analytics required for this operation?

Accepted Answer

Cortex Data Lake. Cortex Data Lake is Palo Alto Networks' cloud-based centralized log repository that aggregates logs from multiple firewalls, Prisma Access, and other sources, providing the analytics and correlation needed to spot lateral movement across the estate. Panorama manages firewalls but does not itself provide the centralized log analytics store at the scale described. AutoFocus is a threat intelligence service, and Prisma Access is an SASE offering, not a log aggregation platform.

Answer

AutoFocus

Answer

Panorama

Answer

Prisma Access

Question 15

A security operations center (SOC) wants to measure the effectiveness of their threat intelligence program. They need a metric that reflects how many of the indicators ingested from feeds were actually used in detecting or responding to incidents within Cortex XSOAR. Which Cortex XSOAR feature provides this information?

Accepted Answer

Indicator occurrences and related incidents. The correct answer is indicator occurrences and related incidents. This feature links indicators to the incidents in which they appear, allowing the SOC to see which threat intelligence was actionable. By analyzing these relationships, teams can assess whether their feeds are providing value and adjust their intelligence sources accordingly.

Answer

Incident dwell time

Answer

Number of enabled feed integrations

Answer

Feed integration health status