SecOps-Pro Practice Test 23 — 15 Questions

Question 1

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 2

A playbook task that runs a reputation command on an IP address is taking a long time to complete. The analyst wants to limit the task's execution time to 5 minutes and automatically mark it as failed if it exceeds that limit. Which configuration should be applied to the task?

Accepted Answer

Enable 'task timeout' and set it to 5 minutes; this will cause the task to fail if not completed within the time limit.. To limit a single task's execution time and automatically fail it upon timeout, the task's own timeout setting must be used. Enabling the task timeout and setting it to 5 minutes ensures that if the reputation command does not complete in that window, the task fails, allowing error handling. Other options either affect the entire playbook, rely on integration settings, or do not enforce a timeout.

Answer

Add a 'Delay' task before the reputation command with a duration of 5 minutes; this will ensure the command does not run longer than 5 minutes.

Answer

Configure the integration instance's 'timeout' parameter to 300 seconds; this will cause the command to fail after 5 minutes.

Answer

Set the 'execution timeout' in the playbook settings to 5 minutes; this applies to all tasks in the playbook.

Question 3

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Accepted Answer

Detection and Analysis. The Detection and Analysis stage focuses on confirming that an incident occurred.

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 4

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

Accepted Answer

Information on mitigation strategies. Option A is correct because Threat Vault provides actionable mitigation strategies and guidance for detected threats, helping security teams respond effectively. Option D is correct because Threat Vault gives access to detailed vulnerability and threat signature information, including signature IDs and coverage details used by Palo Alto Networks firewalls and security services. The other options do not belong: real-time endpoint isolation (B) is a function of endpoint protection platforms such as Cortex XDR, automated playbook execution (C) is handled by SOAR tools like Cortex XSOAR, and firewall image deployment (E) is a management task performed through Panorama or the firewall's software update mechanism, not a Threat Vault feature.

Answer

Real-time endpoint isolation

Answer

Automated playbook execution

Answer

Firewall image deployment

Question 5

A security analyst at a retail company is investigating a Cortex XSIAM incident that shows an unusual outbound connection from a point-of-sale terminal to a known command-and-control IP. The analyst wants to gather additional context about the process that initiated the connection without leaving the incident view. Which XSIAM feature should the analyst use to retrieve process details, parent-child relationships, and command-line arguments?

Accepted Answer

Causality view. The Causality view is purpose-built for incident investigation in Cortex XSIAM. It aggregates endpoint telemetry into an interactive graph that shows process execution chains, command-line arguments, and network connections. This lets an analyst quickly determine how a suspicious outbound connection originated, which parent process spawned it, and what other actions occurred, all without switching tools or writing queries.

Answer

Threat intelligence management

Answer

Playbook automation

Answer

XQL query builder

Question 6

Which THREE of the following represent core components of a Cortex XSOAR incident?

Accepted Answer

Indicators. In Cortex XSOAR, an incident is a container that holds the data and context needed to investigate and respond to a security event, and three of its core components are Indicators, the War Room, and Incident Fields. Option A (Indicators) is correct because indicators such as IP addresses, domains, file hashes, and URLs are attached to an incident and drive enrichment, reputation lookups, and indicator-based playbook logic. Option B (War Room) is correct because it is the collaborative investigation workspace where analysts, playbook tasks, commands, entries, and automated actions are logged and discussed for that specific incident. Option D (Incident Fields) is correct because fields (both system and custom, e.g., severity, type, and custom fields) store the structured metadata and context that define and drive the incident's lifecycle and playbooks. Option C (Network Topology Map) is not a core incident component; topology visualization is a separate capability and not part of the incident object itself. Option E (System Update History) is not part of an incident either, as it relates to platform/server maintenance and versioning rather than incident data.

Answer

Network Topology Map

Answer

System Update History

Question 7

A Cortex XSIAM administrator needs to grant a new tier-1 analyst the ability to view and triage incidents but not to modify correlation rules or delete data. Which Cortex XSIAM access control mechanism should the administrator configure?

Accepted Answer

Assign the analyst to a role with read and triage permissions scoped to incidents only.. Role-based access control with scoped permissions is the correct way to give a tier-1 analyst incident view and triage rights while denying rule-editing and data-deletion privileges. Separate tenants, read-only API keys, and audit logging do not provide the required preventive, least-privilege access control within the existing environment.

Answer

Create a separate tenant for the analyst and migrate the incident data into it.

Answer

Provide the analyst with a read-only API key that can be used to query incidents.

Answer

Enable audit logging for the analyst account so that any rule changes are recorded.

Question 8

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Adding the malicious script's hash to the Blocklist in IOC management lets Cortex XDR block that exact file across all protected endpoints via the global IOC mechanism. Hash-based blocking is deterministic and applies enterprise-wide without needing per-endpoint exceptions or manual response actions. This is the most efficient way to prevent execution of a known malicious file at scale.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 9

You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?

Accepted Answer

${indicatorsList[0]}. In Google SecOps (Chronicle) playbooks, variables are referenced using the `${variableName}` syntax, and array elements are accessed with zero-based indexing using square brackets. Therefore, `${indicatorsList[0]}` correctly extracts the first item from the array. This is consistent with many programming languages and the specific syntax used in playbook task inputs.

Answer

$indicatorsList(0)

Answer

${indicatorsList.[0]}

Answer

indicatorsList{0}

Question 10

A SOC analyst receives an alert from Cortex XDR indicating that a known malicious hash was executed on an endpoint. The analyst wants to quickly determine if this hash has been seen on other endpoints in the organization and what processes were involved. Which Cortex XDR feature provides a centralized view of all endpoint events related to a specific indicator?

Accepted Answer

Threat Hunting. Threat Hunting is the correct feature because it enables analysts to search across all endpoint data using XQL or templates. By querying for the malicious hash, the analyst can identify all endpoints where it was executed, along with associated process and network activity. The other options are for incident response actions, endpoint configuration, or automation, none of which provide the required centralized search and correlation.

Answer

Endpoint Management

Answer

Incident Response Center

Answer

Playbook Automation

Question 11

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

Accepted Answer

WildFire Sandbox. WildFire Sandbox is the feature that performs automated sandboxing and analysis of suspicious executable files to derive new threat intelligence. It executes files in a virtual environment, observes behavior, and generates signatures and reports. This is specifically designed for analyzing custom encryption C2 and other evasive threats.

Answer

App-ID database

Answer

AutoFocus

Answer

Threat Vault

Question 12

A Cortex XSOAR engineer is building a playbook that must run a specific enrichment task only when a prior task completes with a status of 'Failed'. Where in the playbook task configuration should the engineer define this conditional behavior?

Accepted Answer

In the task's 'Conditions' tab, add a condition that references the prior task's status and select 'Failed'.. Cortex XSOAR uses task-level conditions to control execution flow. By adding a condition in the task's Conditions tab that checks the prior task's status against 'Failed', the engineer ensures the task runs only in that scenario. This is the standard method for conditional branching within playbooks.

Answer

In the task's 'Inputs' tab, map the prior task's status to a required input field of the current task.

Answer

In the playbook settings, enable 'Run only on task failure' and select the prior task.

Answer

In the task's 'Advanced' tab, set the 'Run Condition' to 'Failed' and reference the prior task by name.

Question 13

A security analyst is creating a new Cortex XSOAR playbook and wants to add a task that sends an email notification to the incident owner. Which task type should the analyst select to achieve this?

Accepted Answer

An 'Automated' task that uses the 'send-mail' command or a mail integration.. To send an automated email notification, the analyst should use an Automated task configured with a mail-sending command or integration. Automated tasks execute commands directly, enabling actions like sending emails without manual intervention. This is the most efficient and correct task type for this requirement.

Answer

A 'Manual' task that prompts the analyst to send an email manually.

Answer

A 'Data Collection' task that gathers the owner's email address and then triggers a separate playbook.

Answer

A 'Conditional' task that checks if the owner exists, then uses a script to send the email.

Question 14

A SOC manager is designing a new threat intelligence process using Cortex XSOAR. The manager wants to ensure that threat intelligence is effectively operationalized within the SOC. Which two of the following are key benefits of integrating threat intelligence feeds with Cortex XSOAR? (Choose two.)

Accepted Answer

Automated enrichment of incidents with relevant indicators. Integrating threat intelligence feeds with Cortex XSOAR provides automated enrichment and reduces manual lookup, enabling analysts to quickly understand the context of indicators and focus on response. These benefits directly enhance the efficiency and effectiveness of SOC operations by streamlining the triage process and providing actionable intelligence.

Answer

Guaranteed compliance with all regulatory requirements

Answer

Elimination of false positives

Answer

Automatic remediation of all security incidents

Question 15

A SOC analyst in Cortex XSOAR is triaging a malware alert and wants to know whether the file hash has been seen in previous incidents within the organization. Which feature should the analyst use to quickly see the reputation, associated incidents, and related indicators for that hash?

Accepted Answer

Indicator enrichment via the Indicator page. The Indicator page is designed to provide a comprehensive view of an indicator, including its reputation, related incidents, and associated indicators. It pulls together data from threat intelligence sources and past incidents, enabling the analyst to quickly assess whether the file hash has been seen before and how it relates to other activity. This directly supports triage and decision-making.

Answer

Report template designer

Answer

Playbook task debugger

Answer

Incident War Room timeline