SecOps-Pro Practice Test 5 — 10 Questions

Question 1

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 2

What is the function of a 'Transformer' in a mapper?

Accepted Answer

To modify or format data between source and target fields. Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.

Answer

To run a secondary playbook

Answer

To change the incident type

Answer

To assign the incident to an analyst

Question 3

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Accepted Answer

Incident Context. Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.

Answer

Hard-coding the context path

Answer

Database injection

Answer

Global variables

Question 4

Which dashboard component provides an overview of the current security posture and active threats in the XSIAM environment?

Accepted Answer

SOC Overview Dashboard. The SOC Overview dashboard is designed to provide high-level visibility into security status.

Answer

Configuration Audit Logs

Answer

Raw Data Explorer

Answer

Agent Status Report

Question 5

What is the purpose of the 'XSIAM Agent' exclusion list?

Accepted Answer

To exclude safe files from agent inspection. Exclusions prevent the agent from inspecting or blocking known-safe files or processes.

Answer

To hide files from the administrator

Answer

To disable the agent entirely

Answer

To remove logs from storage

Question 6

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. Incident records provide a comprehensive view of the threat, including timeline, entities, and logs.

Answer

Employee performance reviews

Answer

Platform billing history

Question 7

Where do you view the status of endpoints currently connected to the Cortex XSIAM platform?

Accepted Answer

Asset Management. The Asset/Endpoint management page displays the health and status of all agents.

Answer

Data Ingestion menu

Answer

Incident Response console

Answer

System Logs

Question 8

A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?

Accepted Answer

Use a conditional task to check if the field contains data before executing subsequent steps. Using the 'Continue on error' or 'On failure' path, or using a condition task with 'is empty' logic, allows for robust error handling.

Answer

Hard-code the value in the integration parameters

Answer

Delete the task from the playbook

Answer

Change the integration instance timeout settings

Question 9

Which THREE of the following represent common data sources for Cortex XSIAM?

Accepted Answer

Cloud infrastructure logs (e.g., AWS CloudTrail). XSIAM aggregates data from network, endpoint, and cloud sources.

Answer

Employee payroll database

Answer

Coffee machine diagnostic logs

Question 10

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings