SecOps-Pro Practice Test 5 — 10 Questions

Question 1

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Accepted Answer

Work Plan. The Work Plan tab in an incident displays the current status and execution path of the playbook.

Answer

War Room

Answer

Evidence Board

Answer

Indicator Tab

Question 2

Which THREE items should be included in a standard SOC shift-handover report?

Accepted Answer

Status of high-priority incidents. High-priority incidents, pending action items, and known issues are essential for a smooth shift transition.

Answer

Entire network configuration file

Answer

Personal employee performance reviews

Question 3

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 4

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 5

Which feature in Cortex XSIAM is specifically designed for long-term storage of logs to meet compliance requirements?

Accepted Answer

Data Retention Policies. Data Retention Policies in Cortex XSIAM define how long different log and data types are stored, allowing organizations to keep logs for the period required by regulations such as PCI-DSS, HIPAA, or GDPR. This is the feature explicitly built to govern long-term storage duration and meet compliance mandates. Other options address filtering, backup of incidents, or compression, none of which define retention duration for compliance.

Answer

Log Filtering

Answer

Incident Backup

Answer

Archive Compression

Question 6

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Option C is correct because a mature SOC incident response plan must specify defined communication and escalation procedures, including who is notified, through which channels, and at what severity thresholds, so incidents are escalated promptly to the right stakeholders. Option E is correct because clearly defining roles and responsibilities (for example, incident commander, SOC analysts, forensics, and legal liaisons) ensures accountability and prevents gaps or duplication during response. Automated hardware repair (A) is a maintenance or IT operations function, not an incident response planning component. A public relations policy (B) may support crisis communications but is not a core component of the SOC incident response plan itself. Budget approval workflows (D) are financial governance processes and are not part of incident response planning.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 7

A security analyst is using Cortex XSOAR to investigate a malware incident. They need to extract all IP addresses from the incident's indicators and then run a command to check their reputation. Which built-in playbook task should they use to perform the reputation check on multiple IPs simultaneously?

Accepted Answer

Use the 'Enrich Indicators' task with the indicator type set to 'IP'.. The 'Enrich Indicators' task in Cortex XSOAR is built to handle enrichment of multiple indicators of a given type. It automatically invokes the configured reputation commands for each indicator, aggregating the results. This is the most efficient and standardized way to perform reputation checks on a list of IPs.

Answer

Use a 'Run Command' task to execute the 'ip' command on each IP individually.

Answer

Use a 'Conditional' task to check each IP's reputation and then run a command.

Answer

Use a 'Data Collection' task to manually input the IPs and then run a command.

Question 8

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Accepted Answer

Endpoint Isolation. Endpoint Isolation is the correct response action because it severs all network connections except the management channel, effectively containing the threat while enabling remote forensic analysis. Other actions are more granular and do not provide the same level of network containment.

Answer

Terminate Process

Answer

Quarantine File

Answer

Block List

Question 9

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 10

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Accepted Answer

Third-party network device logs (e.g., Syslog).. Option C is correct because a Cortex XDR Collector can ingest third-party network device logs such as Syslog, which is a standard protocol for forwarding event data from routers, switches, and other network appliances into Cortex XDR for correlation and analysis. Option E is correct because the Cortex XDR Collector natively supports ingesting Palo Alto Networks Next-Generation Firewall logs, including traffic, threat, and URL filtering logs, which are parsed and normalized for Cortex XDR detection and investigation. The unmarked options do not belong: local user email drafts (A) are personal application data not collected by the Cortex XDR Collector, internal coffee machine status (B) is an IoT/facilities telemetry source outside the supported log ingestion scope, and physical hardware inventory logs (D) are asset-management data rather than the security event logs the Collector is designed to receive.

Answer

Local user email drafts.

Answer

Internal coffee machine status.

Answer

Physical hardware inventory logs.