SecOps-Pro Practice Test 2 — 25 Questions

Question 1

What is the purpose of the 'XDM' (XSIAM Data Model) in Cortex XSIAM?

Accepted Answer

To provide a unified schema for diverse data. XDM provides a common schema that allows disparate data sources to be analyzed uniformly.

Answer

To encrypt data at rest

Answer

To provide a backup of log files

Answer

To manage user credentials

Question 2

What is the primary benefit of using Cortex XSIAM's 'Unified SOC' capability?

Accepted Answer

It consolidates EDR, SIEM, and SOAR into one interface. Consolidation of functions eliminates the need to jump between separate tools for EDR, SIEM, and SOAR.

Answer

It limits the amount of raw data stored

Answer

It allows users to switch between different browser tabs for tools

Answer

It increases the number of licenses required

Question 3

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. XDM enables cross-source correlation and simplified query writing.

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%

Question 4

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

Accepted Answer

join. The 'join' keyword is essential in XQL for correlating disparate datasets.

Answer

connect

Answer

union

Answer

merge

Question 5

Which THREE of the following are components of a standard XSIAM detection rule?

Accepted Answer

Incident Trigger Logic. Detection rules require a query, severity, and defined action/trigger.

Answer

Physical asset location

Answer

Database schema index

Question 6

Which object type should you use to store configuration data that needs to be accessed globally across multiple playbooks?

Accepted Answer

Lists. Lists are the standard objects for storing static key-value pairs or reference data across the system.

Answer

Incident fields

Answer

Workplan

Answer

Indicators

Question 7

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Accepted Answer

Playbook Debugger. The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.

Answer

System Health Monitor

Answer

Audit Logs

Answer

Integration Debugger

Question 8

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

Accepted Answer

Context is the primary way to pass data between playbook tasks. The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.

Answer

Context data is automatically cleared every 24 hours

Answer

Context only supports string data types

Answer

Context data is shared between different incidents

Question 9

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 10

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 11

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 12

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host

Question 13

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 14

An administrator needs to restrict access to specific sensitive incident logs. Which XSIAM feature should be used to enforce this access control?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) allows administrators to define granular permissions for users and groups.

Answer

Data Retention Policies

Answer

IP Whitelisting

Answer

Detection Rule Exceptions

Question 15

You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?

Accepted Answer

Threat Intelligence Management. Threat feeds are configured in the Threat Intelligence management area of XSIAM.

Answer

XQL Global Variables

Answer

Data Ingestion Mapping

Answer

Detection Rule Editor

Question 16

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 17

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 18

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Accepted Answer

Incident Context. Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.

Answer

Hard-coding the context path

Answer

Database injection

Answer

Global variables

Question 19

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

Accepted Answer

SOC Overview Dashboard. The SOC Overview dashboard is designed to provide high-level visibility into security status.

Answer

Configuration Audit Logs

Answer

Raw Data Explorer

Answer

Agent Status Report

Question 20

What is the purpose of the 'XSIAM Agent' exclusion list?

Accepted Answer

To exclude safe files from agent inspection. Exclusions prevent the agent from inspecting or blocking known-safe files or processes.

Answer

To hide files from the administrator

Answer

To disable the agent entirely

Answer

To remove logs from storage