SecOps-Pro Practice Test 3 — 10 Questions

Question 1

A tier-one analyst receives a Cortex XSIAM incident about a suspicious PowerShell execution on a finance workstation. The analyst wants to immediately determine what the process did on the endpoint, including its parent process, command-line arguments, and any child processes it spawned, without leaving the incident view. Which XSIAM capability should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Causality view for the process, which shows the process tree with parent and child relationships and the associated event details.. The Causality view is designed for exactly this triage need: it renders the process tree around an event so analysts can see the parent, the full command line, and any child processes spawned on the endpoint. It lives inside the investigation experience, so no tool switching is required. Reputation panels, policy pages, and interactive shells either describe something other than runtime behavior or are heavier response actions unsuited to quick context gathering.

Answer

The threat intelligence enrichment panel, which correlates the process hash against known malware families.

Answer

The Cortex XSIAM agent console on the endpoint, where the analyst can run a live terminal session against the host.

Answer

The attack surface rule management page, which lists which endpoint protections were enforced at the time of the event.

Question 2

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

Accepted Answer

Value. The Value field is the actual indicator data (for example, an IP address, domain, file hash, or URL) that Cortex XSOAR uses to perform lookups and reputation scoring. If the Value is not correctly mapped from the external feed, the indicator cannot be matched against existing data or enriched by integrations, breaking the entire feed ingestion pipeline. Indicator Type, Expiration, and Source are metadata that describe the indicator but do not drive lookup or scoring.

Answer

Indicator Type

Answer

Expiration

Answer

Indicator Source

Question 3

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

Accepted Answer

join. The 'join' keyword is essential in XQL for correlating disparate datasets.

Answer

connect

Answer

union

Answer

merge

Question 4

In the SOC structure, which role is typically responsible for the initial triage and validation of security alerts?

Accepted Answer

Tier 1 Analyst. The Tier 1 Analyst is the first line of defense in a SOC, responsible for monitoring alerts, performing initial triage, validating whether an alert is a true positive, and escalating confirmed incidents to Tier 2 or Tier 3. This role is explicitly defined for initial alert validation and triage.

Answer

Threat Researcher

Answer

Tier 3 Analyst

Answer

SOC Manager

Question 5

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 6

Which THREE of the following are critical elements of the Indicator Lifecycle in Cortex XSOAR?

Accepted Answer

Indicator Ingestion. The Indicator Lifecycle in Cortex XSOAR describes how indicators (such as IPs, domains, and file hashes) are brought into the system, enriched, and eventually aged out. Indicator Ingestion (B) is correct because it is the entry point of the lifecycle, where indicators are pulled in from feeds, integrations, or incidents and stored in the indicators database. Indicator Expiration (C) is correct because indicators have a time-to-live (TTL) and must be automatically expired or removed when they are no longer relevant, which is a defined stage of the lifecycle. Reputation Scoring (D) is correct because assigning and updating reputation (e.g., malicious, suspicious, benign, or unknown) based on enrichment and threat intel is a core part of how indicators are evaluated and maintained throughout their lifecycle. Changing the server IP address (A) is a network/infrastructure administration task unrelated to indicator handling, and physical security of the data center (E) is a facilities/security concern, neither of which is a stage or element of the Indicator Lifecycle in Cortex XSOAR.

Answer

Changing the server IP address

Answer

Physical security of the data center

Question 7

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Accepted Answer

Real-time incident queue tracking. Option A is correct because the Cortex XSIAM Unified SOC dashboard is designed to give analysts a live, prioritized view of incidents, so real-time incident queue tracking is a core capability that lets teams monitor open cases, severity, and status as events stream in. Option E is correct because the dashboard is built on customizable widgets, allowing SOC teams to create and arrange widgets that surface the specific metrics, threat feeds, or case data relevant to their environment. The remaining options do not belong: Cortex agent update scheduling (B) is an endpoint management function handled through Cortex XDR policies rather than the Unified SOC dashboard, physical security badge tracking (C) is a facility-access concern outside XSIAM's SOC analytics, and automated code deployment (D) is a CI/CD pipeline activity unrelated to SOC monitoring and incident response.

Answer

Cortex agent update scheduling

Answer

Physical security badge tracking

Answer

Automated code deployment

Question 8

A Cortex XDR administrator needs to ensure that all endpoint agents can communicate with the Cortex XDR management console even when endpoints are behind a proxy. Which configuration should the administrator verify?

Accepted Answer

Agent proxy settings in the Cortex XDR agent configuration. In proxy environments, Cortex XDR agents must be configured with the appropriate proxy settings to reach the management console. This is done through the agent configuration in the Cortex XDR console or via endpoint policy. Without these settings, agents cannot register or send data. Other network configurations like DNS or firewall rules are important but do not replace the need for explicit proxy configuration.

Answer

Firewall rules allowing inbound traffic to the endpoint

Answer

DNS resolution for the Cortex XDR console

Answer

SSL inspection exemptions for the Cortex XDR console

Question 9

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 10

If an endpoint is marked as 'Out of Date', what does this mean?

Accepted Answer

The agent version is older than the latest available version.. An 'Out of Date' status means the agent software version is behind the current version available in the console, indicating it needs an upgrade.

Answer

The agent has failed a security scan.

Answer

The agent has not communicated for a long time.

Answer

The license has expired.