SecOps-Pro Practice Test 4 — 10 Questions

Question 1

Which object type should you use to store configuration data that needs to be accessed globally across multiple playbooks?

Accepted Answer

Lists. Lists are the standard objects for storing static key-value pairs or reference data across the system.

Answer

Incident fields

Answer

Workplan

Answer

Indicators

Question 2

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Accepted Answer

Playbook Debugger. The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.

Answer

System Health Monitor

Answer

Audit Logs

Answer

Integration Debugger

Question 3

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

Accepted Answer

Context is the primary way to pass data between playbook tasks. The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.

Answer

Context data is automatically cleared every 24 hours

Answer

Context only supports string data types

Answer

Context data is shared between different incidents

Question 4

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 5

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 6

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 7

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host

Question 8

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 9

An administrator needs to restrict access to specific sensitive incident logs. Which XSIAM feature should be used to enforce this access control?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) allows administrators to define granular permissions for users and groups.

Answer

Data Retention Policies

Answer

IP Whitelisting

Answer

Detection Rule Exceptions

Question 10

You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?

Accepted Answer

Threat Intelligence Management. Threat feeds are configured in the Threat Intelligence management area of XSIAM.

Answer

XQL Global Variables

Answer

Data Ingestion Mapping

Answer

Detection Rule Editor