SecOps-Pro Practice Questions 1 — 50 Questions

Question 1

Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?

Accepted Answer

Content Packs. Content Packs are the Cortex XSOAR mechanism for packaging playbooks, scripts, integrations, incident types, layouts, and classifiers into a single installable unit. They are versioned and can be installed across tenants or environments, which is exactly the 'bundle and deploy' behavior the question describes. This makes them the canonical answer for cross-environment deployment of content.

Answer

Export to PDF

Answer

Backup and Restore

Answer

Archive

Answer

Git Integration

Question 2

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize process relationships and event sequences in Cortex XDR. It allows analysts to quickly trace the origin of an alert by following the chain of process executions, which is essential for root cause analysis during incident response. Other options either detect but don't visualize, or require manual querying.

Answer

XQL Query Builder

Answer

IOC Rules

Answer

BIOC Rules

Question 3

A SecOps analyst is investigating a phishing incident in Cortex XSOAR. The incident includes an email with a malicious attachment. The analyst wants to automatically extract and enrich all indicators from the attachment and then block them on the firewall. Which Cortex XSOAR component should the analyst use to orchestrate this workflow?

Accepted Answer

Playbook. A playbook in Cortex XSOAR is the orchestration component that automates multi-step processes, including indicator extraction, enrichment, and response actions like blocking. It allows the analyst to define the sequence and conditions for each step, ensuring consistent and efficient incident handling.

Answer

Indicator Extraction Rule

Answer

Incident Type

Answer

Integration

Question 4

A SOC analyst is triaging a Cortex XDR alert for a suspicious PowerShell script execution on a server. The analyst wants to quickly determine the user account that initiated the process and the command line used. Which Cortex XDR alert detail field provides this information directly?

Accepted Answer

Process Execution Details. Process Execution Details is the Cortex XDR alert field that captures the command line, user account, parent process, and other metadata about the process that triggered the alert. This is exactly what the analyst needs to quickly identify who ran the script and what it did, enabling efficient triage.

Answer

Alert Name

Answer

Alert Severity

Answer

MITRE ATT&CK Technique

Question 5

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Accepted Answer

Directory services logs ingested through a log collection integration, which provides authentication events from the identity provider.. To correlate endpoint process execution, network connections, and directory authentication events in one XQL query, the administrator needs the data that actually generates those events. Cortex XDR agent telemetry supplies endpoint process and network events, while directory services logs ingested through a log collection integration supply authentication events. WildFire verdicts, Cortex Data Lake storage, and threat intel feeds add enrichment or storage but do not produce the required event types.

Answer

Threat intelligence feeds from third-party providers, which supply indicators of compromise for matching.

Answer

WildFire sandbox verdicts, which provide file reputation and behavioral reports for submitted samples.

Answer

Cortex Data Lake raw log storage, which retains all ingested logs for long-term query and compliance.

Question 6

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Accepted Answer

Line Chart. A Line Chart is the correct widget type for visualizing how a metric (count of indicator types) changes over time, since it plots data points across a time axis. In Cortex XSOAR dashboards, line charts are used for trend analysis over time, which matches tracking threat intelligence trends.

Answer

Counter Widget

Answer

Pie Chart

Answer

Table Widget

Question 7

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Accepted Answer

Isolate Endpoint. Isolating the endpoint in Cortex XDR immediately cuts off all network communication (except to the Cortex XDR management console) while preserving the endpoint's state for forensic investigation. This prevents lateral movement by the attacker while allowing analysts to investigate without the risk of the attacker pivoting to other systems.

Answer

Delete Process

Answer

Reboot Endpoint

Answer

Disable User Account

Question 8

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Accepted Answer

War Room. The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.

Answer

Summary Tab

Answer

Evidence Board

Answer

Playbook Tab

Question 9

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Accepted Answer

Alert Exclusion. Alert Exclusion in Cortex XDR allows analysts to create exclusion rules that suppress future alerts matching specific criteria (e.g., hash, path, process, user). This is the correct mechanism to prevent a known false positive from re-triggering. It preserves detection logic while reducing noise.

Answer

Agent Uninstallation

Answer

Policy Deletion

Answer

Threat Intel Ingestion

Question 10

A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?

Accepted Answer

join. The join operator is specifically designed to combine records from two datasets based on a matching field. By joining failed and successful login events on the 'user' field, the administrator can identify users who experienced a failed login followed by a successful one, which is a common indicator of brute-force or credential-stuffing attacks. This correlation is essential for accurate detection.

Answer

filter

Answer

union

Answer

sort

Question 11

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Accepted Answer

Executing system commands. Live Terminal in Cortex XDR provides a remote shell on the endpoint, so option A (Executing system commands) is correct because it lets analysts run OS-level commands directly on the host for investigation or remediation. Option C (Deleting files on the endpoint) is correct because the terminal can issue file-deletion commands to remove malicious artifacts from the endpoint. Option E (Listing running processes) is correct because analysts can run process-listing commands (e.g., tasklist on Windows or ps on Linux/macOS) to enumerate active processes during triage. Option B (Automating incident closure in XSOAR) is not a Live Terminal capability, as that is handled by XSOAR playbooks and incident management workflows, not a remote endpoint shell. Option D (Modifying firewall policy rules) is not performed through Live Terminal, since firewall policy changes are made in the firewall management console or policy configuration, not via endpoint command execution.

Answer

Automating incident closure in XSOAR

Answer

Modifying firewall policy rules

Question 12

A security analyst at a healthcare company notices that a Cortex XSIAM correlation rule is generating an incident every time a clinician accesses a patient record after hours, even though the access is expected during on-call shifts. The analyst wants to stop these recurring incidents without disabling the underlying rule entirely. Which action should the analyst take?

Accepted Answer

Add an exception to the correlation rule that excludes the on-call clinician accounts from triggering the incident.. Exceptions are the surgical control for recurring false positives because they scope the exclusion to the specific accounts, hosts, or indicators that are generating noise while leaving the rule active for everything else. Disabling, re-scoping, or suppressing incidents either removes detection coverage or only hides individual occurrences, so the exception is the only option that preserves both signal and coverage.

Answer

Disable the correlation rule and create a new rule that only fires for accounts outside the clinical department.

Answer

Increase the severity threshold of the correlation rule so that only high-severity events generate incidents.

Answer

Suppress the incident from the Incidents table and rely on the audit log to capture future occurrences.

Question 13

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Accepted Answer

Use the data source onboarding wizard to preview parsed fields from a sample of the log data.. Validating ingestion and mapping requires observing the parsed output, which the onboarding wizard's preview provides, and then confirming the mapped fields in ingested data with XQL. Disabling rules, waiting for incidents, or editing mappings without previewing the data do not provide reliable validation and can harm production detection quality.

Answer

Edit the XDM mapping directly in the dataset schema without previewing the source data.

Answer

Disable all correlation rules that reference firewall data until the new source is confirmed working.

Answer

Add the source to a production dataset and wait for an incident to be generated before checking field values.

Question 14

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Accepted Answer

Use the Cortex XDR - Get Endpoint Forensic Data command to collect volatile evidence from the endpoint. The playbook must isolate the endpoint and collect forensic evidence. The Cortex XDR - Isolate Endpoint command quarantines the endpoint from the network, achieving containment. The Cortex XDR - Get Endpoint Forensic Data command retrieves volatile evidence for analysis. The other commands perform remediation or scanning, which are out of sequence and do not meet the stated goals.

Answer

Use the Cortex XDR - Scan Endpoint command to run a full antivirus scan on the endpoint

Answer

Use the Cortex XDR - Block File command to delete the malicious executable from the endpoint

Answer

Use the Cortex XDR - Quarantine File command to move the malicious file to a quarantine folder

Question 15

What is the benefit of using 'Incident Tags' in the SecOps process?

Accepted Answer

To categorize incidents for reporting and filtering. Incident Tags in Cortex XSOAR/SecOps are labels applied to incidents to categorize them, enabling filtering, grouping, and reporting across large incident volumes. They provide a flexible taxonomy (e.g., 'phishing', 'malware', 'VIP') that supports dashboards, saved searches, and metrics. This is why the benefit is categorization for reporting and filtering.

Answer

To automate the deletion of data

Answer

To define the password for the incident

Answer

To change the incident priority

Question 16

A security analyst is investigating a phishing incident and wants to determine if the sender's IP address has been associated with any known malicious campaigns. Which threat intelligence platform feature should the analyst use to quickly obtain this context?

Accepted Answer

Indicator enrichment. Indicator enrichment is the correct feature because it automatically queries threat intelligence sources to add context to an indicator, such as an IP address. This allows the analyst to quickly determine if the sender's IP has been associated with malicious campaigns, providing actionable intelligence for the phishing investigation. Other features like playbook automation, classification, or dashboards serve different purposes and do not directly provide this context.

Answer

Incident classification

Answer

Dashboard reporting

Answer

Playbook automation

Question 17

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 18

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Script complexity (A) is correct because the amount and intricacy of the automation logic — number of tasks, conditional branches, loops, and API calls — directly determines how long a playbook takes to execute. The number of active workers (C) is correct because workers are the execution engines that run playbook tasks; more available workers allow tasks to be processed in parallel rather than queued, improving throughput. The number of concurrent tasks (D) is correct because running many tasks simultaneously increases resource contention (CPU, memory, API rate limits), which can either speed up or degrade overall playbook performance depending on capacity. Incident display layout (B) is incorrect because it is purely a UI presentation concern and has no effect on backend playbook execution. User password length (E) is incorrect because it only affects authentication strength and has no bearing on how fast or efficiently a playbook runs.

Answer

Incident display layout

Answer

User password length

Question 19

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Accepted Answer

xdr_memory. To detect credential dumping via LSASS memory access, the analyst needs to correlate process execution with memory access events. The xdr_process dataset provides process context, while xdr_memory captures the actual memory access. Together, they enable detection of suspicious processes reading LSASS memory.

Answer

xdr_registry

Answer

xdr_network

Answer

xdr_file

Question 20

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. Option D is correct because the XDM (Extended Data Model) schema in Cortex XSIAM maps ingested data from many sources into a consistent set of fields, so analysts can write XQL queries against stable, predictable field names instead of vendor-specific ones, greatly simplifying query authoring. Option E is correct because XDM normalizes data across different products and telemetry types (endpoint, network, cloud, identity, etc.) into a common taxonomy, enabling cross-source correlation and detection without per-vendor parsing logic. The unmarked options do not belong: XDM is a data-modeling/normalization layer and does not perform automated hardware replacement (A), does not directly increase endpoint processing speed (B), and while normalization can improve storage efficiency, it does not guarantee a specific 90% storage-cost reduction (C).

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%