SecOps-Pro Practice Test 2 — 30 Questions

Question 1

In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?

Accepted Answer

Cortex Playbooks. Playbooks are the engine for automated orchestration and response in XSIAM.

Answer

Detection Rules

Answer

XQL Search Filters

Answer

Data Ingestion Pipeline

Question 2

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 3

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

Accepted Answer

SOC Overview Dashboard. The SOC Overview dashboard is designed to provide high-level visibility into security status.

Answer

Configuration Audit Logs

Answer

Raw Data Explorer

Answer

Agent Status Report

Question 4

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. In the Cortex XSIAM Incident record, option A (Associated logs and alerts) is correct because an incident aggregates the underlying alerts and their raw log evidence that triggered or contributed to the case, giving analysts the source telemetry. Option C (Timeline of events) is correct because XSIAM builds a chronological timeline that correlates alerts, activity, and analyst actions to show how the incident unfolded. Option D (Impacted entities) is correct because the incident record identifies the affected entities such as hosts, users, IP addresses, and accounts, which is essential for scoping and response. Option B (Employee performance reviews) is not part of incident data, as that is HR information unrelated to security telemetry. Option E (Platform billing history) is also not included, since licensing and billing records are administrative data, not incident evidence.

Answer

Employee performance reviews

Answer

Platform billing history

Question 5

What is the purpose of the 'XSIAM Agent' exclusion list?

Accepted Answer

To exclude safe files from agent inspection. Exclusions prevent the agent from inspecting or blocking known-safe files or processes.

Answer

To hide files from the administrator

Answer

To disable the agent entirely

Answer

To remove logs from storage

Question 6

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Accepted Answer

Assign a Tag. Option A (Assign a Tag) is correct because XSOAR indicators support tags that analysts apply to categorize, group, and track threat data through its lifecycle, enabling filtering, searching, and automated playbook logic based on tag values. Option B (Update Reputation) is correct because each indicator in XSOAR carries a reputation score (e.g., None, Benign, Suspicious, Malicious) that can be manually or automatically updated, which is central to lifecycle management since it drives incident severity and playbook branching. The remaining options do not apply to indicator objects: installing a new plugin (C) is a system/marketplace administration task, renaming the source feed (D) modifies a feed integration rather than an indicator, and changing the server OS (E) is an infrastructure operation unrelated to indicator lifecycle management.

Answer

Install a new plugin

Answer

Rename the source feed

Answer

Change the server OS

Question 7

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS

Question 8

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Accepted Answer

BIOC Rules. BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.

Answer

IOC Search

Answer

Vulnerability Protection

Answer

Anti-Malware Policy

Question 9

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

Accepted Answer

Cortex XSOAR. Cortex provides XDR for detection, XSOAR for automation, and Data Lake for log aggregation.

Answer

GlobalProtect Enterprise

Answer

Panorama Policy Creator

Question 10

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

Accepted Answer

Behavioral Threat Protection. The Cortex XDR agent uses Behavioral Threat Protection to stop malicious processes in real-time.

Answer

Exploit Prevention

Answer

Network Isolation

Answer

Host Insight

Question 11

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Accepted Answer

Work Plan. The Work Plan tab in an incident displays the current status and execution path of the playbook.

Answer

War Room

Answer

Evidence Board

Answer

Indicator Tab

Question 12

Which THREE items should be included in a standard SOC shift-handover report?

Accepted Answer

Status of high-priority incidents. High-priority incidents, pending action items, and known issues are essential for a smooth shift transition.

Answer

Entire network configuration file

Answer

Personal employee performance reviews

Question 13

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 14

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 15

Which feature in Cortex XSIAM is specifically designed for long-term storage of logs to meet compliance requirements?

Accepted Answer

Data Retention Policies. Data Retention Policies in Cortex XSIAM define how long different log and data types are stored, allowing organizations to keep logs for the period required by regulations such as PCI-DSS, HIPAA, or GDPR. This is the feature explicitly built to govern long-term storage duration and meet compliance mandates. Other options address filtering, backup of incidents, or compression, none of which define retention duration for compliance.

Answer

Log Filtering

Answer

Incident Backup

Answer

Archive Compression

Question 16

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Option C is correct because a mature SOC incident response plan must specify defined communication and escalation procedures, including who is notified, through which channels, and at what severity thresholds, so incidents are escalated promptly to the right stakeholders. Option E is correct because clearly defining roles and responsibilities (for example, incident commander, SOC analysts, forensics, and legal liaisons) ensures accountability and prevents gaps or duplication during response. Automated hardware repair (A) is a maintenance or IT operations function, not an incident response planning component. A public relations policy (B) may support crisis communications but is not a core component of the SOC incident response plan itself. Budget approval workflows (D) are financial governance processes and are not part of incident response planning.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 17

A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?

Accepted Answer

Use the 'Enrich Indicators' task with the indicator type set to 'IP'.. The 'Enrich Indicators' task in Cortex XSOAR is built to handle enrichment of multiple indicators of a given type. It automatically invokes the configured reputation commands for each indicator, aggregating the results. This is the most efficient and standardized way to perform reputation checks on a list of IPs.

Answer

Use a 'Run Command' task to execute the 'ip' command on each IP individually.

Answer

Use a 'Conditional' task to check each IP's reputation and then run a command.

Answer

Use a 'Data Collection' task to manually input the IPs and then run a command.

Question 18

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Accepted Answer

Endpoint Isolation. Endpoint Isolation is the correct response action because it severs all network connections except the management channel, effectively containing the threat while enabling remote forensic analysis. Other actions are more granular and do not provide the same level of network containment.

Answer

Terminate Process

Answer

Quarantine File

Answer

Block List

Question 19

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 20

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Accepted Answer

Third-party network device logs (e.g., Syslog).. Option C is correct because a Cortex XDR Collector can ingest third-party network device logs such as Syslog, which is a standard protocol for forwarding event data from routers, switches, and other network appliances into Cortex XDR for correlation and analysis. Option E is correct because the Cortex XDR Collector natively supports ingesting Palo Alto Networks Next-Generation Firewall logs, including traffic, threat, and URL filtering logs, which are parsed and normalized for Cortex XDR detection and investigation. The unmarked options do not belong: local user email drafts (A) are personal application data not collected by the Cortex XDR Collector, internal coffee machine status (B) is an IoT/facilities telemetry source outside the supported log ingestion scope, and physical hardware inventory logs (D) are asset-management data rather than the security event logs the Collector is designed to receive.

Answer

Local user email drafts.

Answer

Internal coffee machine status.

Answer

Physical hardware inventory logs.