SecOps-Pro Practice Questions 2 — 50 Questions

Question 1

You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?

Accepted Answer

Create an Incident Classifier rule to assign the playbook based on incident attributes. The 'Incident Auto-Classifier' or 'Automated Assignment' rules based on incident type or severity are the most efficient methods.

Answer

Manually open each incident and assign the playbook

Answer

Restart the server

Answer

Wait for the user to trigger it

Answer

Rename the incidents

Question 2

A new SOC analyst wants to see all traffic blocked by the firewall in the last hour. Where should they navigate in the Panorama monitor tab?

Accepted Answer

Monitor > Logs > Traffic. The Monitor tab in Panorama provides access to log views, including filtered traffic logs.

Answer

Network > Interfaces

Answer

Policies > Security

Answer

Objects > Services

Question 3

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 4

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 5

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Configuration requires network reachability, authentication, and defined ingestion rules.

Answer

Employee department codes

Answer

Physical location of the server room

Question 6

You want to trigger a playbook automatically whenever a new indicator is created of a specific type. Where is this configuration set?

Accepted Answer

Indicator Type Settings. The 'Indicator Auto-Extraction' or 'Indicator Triggered Playbook' settings allow you to map indicator types to specific playbooks.

Answer

Incident Type Settings

Answer

Playbook Inputs

Answer

Global Search

Question 7

You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?

Accepted Answer

Work Plan tab in the Incident view. The Work Plan tab within the incident view allows you to drill down into task results and inspect raw inputs/outputs.

Answer

System Logs

Answer

Indicator dashboard

Answer

Integration Instance Logs

Question 8

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 9

Which TWO of these are valid methods to trigger an automated playbook?

Accepted Answer

Incident Type auto-trigger. Playbooks can be triggered by incident ingestion (via Classifier) or manually by an analyst.

Answer

System boot-up

Answer

Setting a cron schedule

Answer

Browser refresh

Question 10

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.

Answer

Incident display layout

Answer

User password length

Question 11

Which TWO actions are commonly performed during the 'Pre-processing' phase of incident ingestion?

Accepted Answer

Assigning a specific playbook to the incident. Pre-processing rules allow for deduplication and incident enrichment/filtering before the incident is created or assigned.

Answer

Generating a final management report

Answer

Modifying the XSOAR server configuration

Answer

Executing a manual investigation

Question 12

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. Playbooks support various task types including manual, automated, and condition tasks.

Answer

Database cleanup task

Answer

Encryption task

Question 13

Which THREE of the following are valid components of a standard Content Pack?

Accepted Answer

Scripts. Content Packs contain various XSOAR objects like integrations, playbooks, and dashboards.

Answer

System Logs

Answer

Integration instances

Question 14

Which THREE actions are available when configuring a 'Condition' task?

Accepted Answer

Compare a context value to a static value. Condition tasks allow for testing context values, checking for existence, and branching based on comparison results.

Answer

Delete an incident

Answer

Change the task owner

Question 15

Which THREE actions can be performed from the Incident 'Work Plan' tab?

Accepted Answer

Skip a task. The Work Plan tab allows users to view progress, manually trigger tasks, and re-run failed tasks.

Answer

Change the server OS

Answer

Add a new incident type

Question 16

While analyzing a breach, an analyst identifies an IOC that is not yet flagged by automated systems. Which tool is used to manually update the global blacklist to prevent further spread across the organization?

Accepted Answer

Custom Threat Intelligence. Cortex XDR Custom Threat Intelligence allows analysts to manually push indicators to block across the enterprise.

Answer

Dynamic Address Groups

Answer

Security Profiles

Answer

Service Objects

Question 17

When configuring a new integration, you need to restrict the integration's access to only a subset of incident types. Which feature should be used?

Accepted Answer

Incident Type assignment in the Integration Instance configuration. Role-based access control and specific integration scope settings allow restricting which incidents an integration can interact with.

Answer

Global Incident field permissions

Answer

User Roles

Answer

Playbook permissions

Question 18

Which type of alert in Cortex XDR represents a high-confidence threat that has been automatically grouped with related events?

Accepted Answer

Incident. An Incident in Cortex XDR is a collection of related alerts that represent a single threat narrative.

Answer

Log

Answer

Indicator

Answer

Exclusion

Answer

Exception

Question 19

Which THREE of the following are valid methods for triggering a playbook in Cortex XSOAR?

Accepted Answer

Manual execution from the Incident War Room. Playbooks can be triggered automatically via classification, manually by an analyst, or through API requests.

Answer

Database trigger in PostgreSQL

Answer

Indicator reputation change

Question 20

A security analyst is investigating a phishing alert in Cortex XSOAR. Which workflow component is best utilized to standardize the response process for repetitive phishing email triage?

Accepted Answer

Playbook. Playbooks are the standard method in Cortex XSOAR for automating and standardizing incident response workflows.

Answer

Integration instance

Answer

Indicator auto-extraction

Answer

Dashboard widget