SecOps-Pro Practice Test 4 — 25 Questions

Question 1

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 2

A security analyst is troubleshooting an integration that is failing to pull data from a threat feed. What is the first place they should check for errors?

Accepted Answer

The War Room or the Integration Instance logs. The War Room or the integration instance logs provide specific error codes.

Answer

The User Management settings

Answer

The Incident Dashboard

Answer

The Threat Intel page

Question 3

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

Accepted Answer

Reporting. The Reporting section allows for the generation and scheduling of custom and predefined reports based on alert data.

Answer

Settings

Answer

Incident View

Answer

Query Center

Question 4

A security operations center (SOC) manager wants to ensure that all analysts can quickly see which incidents are assigned to them and their current status. Which Cortex XSIAM dashboard component should the manager use to display a personalized list of incidents for each analyst?

Accepted Answer

Incident widget. The Incident widget is designed to display incident data on dashboards. By configuring it with a filter based on the assignee field, the manager can create a dashboard where each analyst sees only the incidents assigned to them, along with status, severity, and other relevant details. This supports workload management and ensures analysts focus on their own tasks.

Answer

Endpoint health widget

Answer

Data ingestion widget

Answer

Threat intelligence widget

Question 5

A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Create a Device Control profile and set the action to Block for all USB device types.. To allow only specific USB devices, the administrator must first create a Device Control profile that blocks all USB device types by default. Then, exceptions must be added for the approved devices, specifying their identifiers. This two-step approach ensures that unauthorized devices are blocked while allowing the necessary ones. Other features like Malware Profiles or Behavioral Threat Protection do not provide the granular control needed for this requirement.

Answer

Configure a Behavioral Threat Protection rule to block USB device installation.

Answer

Set the Device Control profile action to 'Report' for all USB devices.

Answer

Enable the 'Block USB Mass Storage' option in the Malware Profile.

Question 6

When configuring threat intelligence feeds in Cortex XSOAR, which TWO of the following are key settings that must be configured for the feed to function correctly?

Accepted Answer

Feed URL. Option C (Feed URL) is correct because every Cortex XSOAR threat intelligence feed integration must be pointed at the external source's endpoint (the API or HTTP/HTTPS URL) from which indicators are retrieved, and without a valid URL the fetch mechanism has nothing to query. Option E (Polling Interval) is correct because feeds run on a scheduled fetch cycle, and the polling interval parameter defines how often XSOAR pulls new indicators (for example, every 5 minutes or hourly) so the indicator repository stays current. Option A (Operating System Version) is not a feed setting; it is irrelevant to indicator ingestion and belongs to endpoint or agent configuration. Option B (Incident Assignee) is not required for a feed to function, since feed fetching is an automated integration task rather than an incident workflow assignment. Option D (Database Password) is not a feed parameter; XSOAR manages its own datastore credentials internally, and feeds authenticate to the external source via API keys or tokens, not a database password.

Answer

Operating System Version

Answer

Incident Assignee

Answer

Database Password

Question 7

If you want to modify the data model mapping for an incoming log source, which menu path is most appropriate?

Accepted Answer

Settings -> Data Ingestion -> Parsing. In Cortex XSIAM, data model mapping for incoming log sources is configured under Settings -> Data Ingestion -> Parsing, where you can define or modify how raw logs are parsed and mapped to the Cortex Data Model (XDM) fields. This is the correct menu path for adjusting parsing and mapping rules for a log source.

Answer

Intelligence -> Feeds -> Parsing

Answer

Settings -> Assets -> Mapping

Answer

Incidents -> Rules -> Parsing

Question 8

Which THREE components are part of the standard XSOAR incident layout customization?

Accepted Answer

Tabs. In Cortex XSOAR, incident layout customization is performed through the incident type's layout editor, where Tabs (A) define the top-level sections of the incident view (such as Summary, War Room, and custom tabs) and control which information appears in each area. Custom Fields (B) are user-defined incident fields that can be added to the layout and displayed within those tabs, making them a core element of layout customization. Custom Buttons (E) are also configured as part of the layout, allowing analysts to trigger scripts, playbooks, or commands directly from the incident view. System BIOS settings (C) and CPU core count (D) are hardware/firmware attributes of the underlying host machine and have no role in XSOAR incident layout configuration.

Answer

System BIOS settings

Answer

CPU core count

Question 9

When investigating a file, you see a 'WildFire' verdict. What does this indicate?

Accepted Answer

The file was analyzed in a cloud sandbox and determined to be malicious.. A WildFire verdict means the file was submitted to Palo Alto Networks' WildFire cloud sandbox, executed in a controlled environment, and analyzed for malicious behavior. The verdict reflects the sandbox's determination — benign, grayware, phishing, or malicious — based on observed activity such as registry modification, network callbacks, or process injection. In Cortex XDR, this verdict is surfaced as part of the file's threat intelligence enrichment to help analysts decide on response actions.

Answer

The file was marked as safe by the user.

Answer

The file matches a local hash blocklist.

Answer

The file was blocked by the local firewall.

Question 10

During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?

Accepted Answer

WildFire. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service that provides global prevalence data and verdicts (malicious, benign, grayware) for file hashes. Consulting WildFire lets you determine whether a hash has been seen before, how widely it has spread, and how it is classified. This is exactly the service designed for file reputation and prevalence lookups.

Answer

Cortex XDR

Answer

Threat Vault

Answer

GlobalProtect

Question 11

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 12

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Accepted Answer

Vulnerability Protection Profile. SMB is a file-sharing protocol that carries exploit attempts, malware payloads, and lateral movement tools like PsExec and EternalBlue. The Vulnerability Protection Profile in PAN-OS inspects traffic for known exploits, including SMB-based attacks (e.g., MS17-010), and can block or alert on them. Applying it to the security policy ensures SMB sessions are scanned for malicious patterns at the application layer.

Answer

DoS Protection Profile

Answer

URL Filtering Profile

Answer

File Blocking Profile

Question 13

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Accepted Answer

Playbook Debugger. The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.

Answer

System Health Monitor

Answer

Audit Logs

Answer

Integration Debugger

Question 14

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 15

What is the purpose of the 'XDM' (XSIAM Data Model) in Cortex XSIAM?

Accepted Answer

To provide a unified schema for diverse data. XDM provides a common schema that allows disparate data sources to be analyzed uniformly.

Answer

To encrypt data at rest

Answer

To provide a backup of log files

Answer

To manage user credentials

Question 16

A security analyst needs to ensure that a playbook only proceeds to the containment phase if the severity of the incident is 'High' or 'Critical'. The severity is stored in the incident field 'severity'. Which task type should be used to implement this branching logic?

Accepted Answer

Conditional task. The need is to automatically branch the playbook based on the incident's severity. A Conditional task is designed for this purpose: it evaluates a condition (e.g., severity equals 'High' or 'Critical') and directs the playbook flow accordingly. Other task types either require manual input or do not provide branching.

Answer

Manual task

Answer

Data Collection task

Answer

Script task

Question 17

A Cortex XSIAM administrator needs to ensure that a newly onboarded cloud log source is parsed correctly so that its events map to the XDM fields used by correlation rules. The raw logs arrive in JSON format with vendor-specific field names. Which Cortex XSIAM capability should the administrator use to normalize these fields?

Accepted Answer

A parsing rule attached to the data source.. Normalization of vendor-specific log fields into the XDM schema is the responsibility of parsing rules. These rules run during ingestion, extracting values from raw JSON and mapping them to standard XDM fields so that correlation rules, XQL queries, and dashboards can operate consistently. Correlation rules, dashboards, and playbooks all consume already-normalized data and cannot perform the required mapping.

Answer

A correlation rule that matches the vendor's field names directly.

Answer

A playbook that renames fields after the event is stored.

Answer

A dashboard widget configured with a custom filter.

Question 18

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. In a playbook workflow, the three supported task types are Condition, Manual, and Automated tasks. A Condition task (A) is correct because it evaluates a logical expression or check and branches the workflow based on whether the result is true or false, enabling decision logic. A Manual task (C) is correct because it pauses the workflow and requires a human user to perform an action or provide input before the playbook can continue. An Automated task (D) is correct because it executes a predefined script, command, or integration action without human intervention. The remaining options do not belong: a Database cleanup task (B) is not a distinct playbook task type but rather a specific action that could be implemented inside an Automated task, and an Encryption task (E) is likewise not a separate task category but a function that would be performed by an Automated task or script.

Answer

Database cleanup task

Answer

Encryption task

Question 19

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?

Accepted Answer

User Risk. The User Investigation dashboard or User Risk view in Cortex XDR provides a consolidated view of user-linked alerts and behavioral history.

Answer

Threat Intelligence

Answer

Endpoint Status

Answer

Network Activity

Question 20

Which THREE of the following represent common challenges in SecOps threat intelligence integration that XSOAR helps address?

Accepted Answer

Fragmented and manual workflows. Option B is correct because XSOAR addresses fragmented and manual workflows by orchestrating playbooks that automate repetitive SOC tasks and connect disparate tools through its integration framework, replacing swivel-chair operations with standardized, machine-driven processes. Option C is correct because XSOAR helps reduce the high rate of false positives by enriching indicators with threat intelligence, applying automated deduplication and scoring, and enabling consistent triage logic so analysts focus only on genuine incidents. Option D is correct because XSOAR handles the excessive volume of indicators through indicator extraction, deduplication, and reputation-based scoring, allowing the platform to ingest and process large feeds without overwhelming analysts. Option A is not a typical SecOps threat-intelligence integration challenge XSOAR is designed to solve, since XSOAR itself requires network access to reach external services and threat feeds. Option E is not relevant because XSOAR is a platform-agnostic automation and orchestration layer, and operating system compatibility is not a core challenge in threat-intelligence integration that it addresses.

Answer

Lack of internet connectivity

Answer

Operating system compatibility