SecOps-Pro Practice Questions 1 — 50 Questions

Question 1

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Accepted Answer

Continues to function using locally stored policies.. The agent is designed to continue protecting the endpoint using its locally stored policies and protection engines even when offline.

Answer

Enters a default 'Allow All' state.

Answer

Stops all security monitoring.

Answer

Automatically uninstalls itself.

Question 2

Which THREE pieces of information are displayed in the Incident View?

Accepted Answer

Associated alerts.. The incident view provides an overview of the affected entities, the associated alerts, and the status of the investigation.

Answer

The names of all users in the organization.

Answer

The current CPU usage of the cloud console.

Question 3

A user is reporting that their XSIAM dashboard widgets are displaying 'No Data'. What is the most likely cause?

Accepted Answer

Incorrect time range filter in the dashboard. If widgets display no data, the time range or query filter is usually the culprit for the current environment.

Answer

Agent is disconnected

Answer

Insufficient disk space

Answer

Global XSIAM outage

Question 4

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 5

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

Accepted Answer

Reporting. The Reporting section allows for the generation and scheduling of custom and predefined reports based on alert data.

Answer

Settings

Answer

Incident View

Answer

Query Center

Question 6

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

Accepted Answer

Content Update Policy. Update policies control when and how agents receive software and content updates.

Answer

Global Settings

Answer

Incident Management Settings

Answer

Endpoint Policy

Question 7

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 8

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

Accepted Answer

Endpoint View.. Analysts can use the Endpoint View for historical data and the Live Terminal for real-time interaction.

Answer

Sending a network broadcast.

Answer

Running a full system re-image.

Answer

Deleting the endpoint from the console.

Question 9

An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?

Accepted Answer

XQL. XQL (XDR Query Language) is the primary query language for searching and analyzing data in XSIAM.

Answer

SQL

Answer

SPL

Answer

KQL

Question 10

When reviewing an incident in the Investigation area, what does the 'Graph' view display?

Accepted Answer

The relationships between entities and alerts. The Graph view provides a visual representation of the relationships between entities involved in an incident.

Answer

The raw log structure

Answer

The status of the agent

Answer

The timeline of events only

Question 11

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 12

You want to automate the response to a specific type of alert. Where should you configure this?

Accepted Answer

Automation/Playbooks. Automation rules (often part of the Cortex XDR Orchestration or Playbook features) allow for automated responses to alerts.

Answer

Data Lake settings

Answer

Endpoint Policy

Answer

BIOC rules

Question 13

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 14

You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?

Accepted Answer

Cortex XSIAM Forwarder. The Log Forwarder is the designated component for on-premise log ingestion.

Answer

Cortex Collector Pro

Answer

Cortex Agent Relay

Answer

XSIAM API Gateway

Question 15

You need to export data from Cortex XSIAM to a third-party SIEM. Which feature facilitates the automated forwarding of data?

Accepted Answer

Log Forwarding. Log Forwarding profiles or API-based integration tools are used to send data out of XSIAM.

Answer

Data Ingestion Pipeline

Answer

XQL Export Tool

Answer

Incident Export API

Question 16

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 17

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.

Question 18

Which THREE actions are available when responding to an incident via the Response feature?

Accepted Answer

Isolate host.. Common response actions include isolating a host, killing a process, and quarantining a file.

Answer

Change the user password.

Answer

Perform a remote OS reinstall.

Question 19

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 20

Which configuration setting in the Malware profile determines if the agent should move a file to a secure location upon detection?

Accepted Answer

File Action. The 'Quarantine' action in the Malware profile instructs the agent to move the malicious file to a hidden, encrypted folder on the endpoint.

Answer

Endpoint Protection Rule

Answer

Detection Mode

Answer

Scan Frequency

Answer

Remediation Policy