SecOps-Pro Practice Questions 2 — 50 Questions

Question 1

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

Accepted Answer

Summary. The Summary tab in the Incident view is designed to provide a real-time, user-friendly overview of the investigation status. It aggregates key details such as incident severity, status, assignee, and a timeline of events, giving analysts an at-a-glance understanding without navigating multiple tabs. This aligns with the goal of a quick, high-level summary for efficient incident management.

Answer

Indicators

Answer

Work Plan

Answer

Evidence

Question 2

Why should you use an 'Indicator Reputation' threshold in your SecOps process?

Accepted Answer

To prevent low-confidence or unverified indicators from triggering automated blocks. It helps reduce false positives by ensuring only high-confidence indicators trigger automated blocks.

Answer

To automatically delete logs

Answer

To increase the number of alerts

Answer

To speed up data ingestion

Question 3

Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?

Accepted Answer

Mean Time to Remediate (MTTR). Mean Time to Remediate (MTTR) measures the average time from incident detection to full remediation, directly reflecting the operational efficiency of the Incident Response team. Over a fiscal quarter, tracking MTTR shows whether the team is improving its response speed and effectiveness, making it the most relevant efficiency metric.

Answer

Total number of alerts generated

Answer

Number of active playbooks

Answer

Number of users trained on phishing

Question 4

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

Accepted Answer

The endpoint has not received the updated policy containing the BIOC.. If the agent has not yet received the latest policy update containing the new BIOC, it will not enforce the rule.

Answer

The agent is not configured to send BIOC logs.

Answer

The BIOC rule is disabled by default.

Answer

The BIOC rule requires a full agent reboot.

Question 5

A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?

Accepted Answer

Query Builder with network events. Query Builder with network events is the correct tool because it allows the analyst to run XQL queries against historical network data, filtering by endpoint and time range. This returns a list of all external IP addresses the endpoint communicated with, which is essential for identifying potential exfiltration destinations. Other views are more focused on alerts or current state and lack the comprehensive historical network data required.

Answer

Threat Intelligence module

Answer

Endpoint Investigation view

Answer

Incident Response view

Question 6

What is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?

Accepted Answer

To parse and identify IOCs from incident descriptions or email bodies. Indicator extraction automatically identifies and parses artifacts from unstructured text.

Answer

To manually block IPs on the firewall

Answer

To update the threat intelligence database

Answer

To generate reports on threat actors

Question 7

A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?

Accepted Answer

Replace the `match` stage with a `comp` stage that uses `count()` grouped by `action_local_ip` and then apply a `filter` on the count.. Correlation rules that require counting events within a timeframe need an aggregation stage such as `comp count()` grouped by the relevant field. A `match` stage alone groups events but does not count them; it simply aligns events by a common field. To enforce a threshold, the rule must aggregate counts and then filter on the aggregated value, ensuring it fires only when the count exceeds the defined limit.

Answer

Increase the `timeframe` to 10 minutes and add a `dedup` stage on `action_local_ip` to remove duplicate events.

Answer

Add a `filter` stage after the `match` stage to count the number of events per `action_local_ip` and compare against a threshold.

Answer

Add a `sort` stage on `action_local_ip` and a `limit` stage to return only the top 10 events.

Question 8

A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?

Accepted Answer

Create an exclusion rule in the 'Alert Exclusions' section, specifying the endpoint group 'Finance' and the alert category 'Credential Dumping'.. Alert Exclusions are designed to suppress specific alerts based on criteria such as endpoint group and alert category. By creating an exclusion for the 'Finance' group and 'Credential Dumping' category, the administrator can reduce noise while maintaining detection for other groups and alert types. Other mechanisms like Prevention profiles or BIOC rules serve different purposes.

Answer

Create a BIOC rule with a filter for the 'Finance' group and a condition to exclude 'Credential Dumping' alerts.

Answer

Create a policy rule in 'Prevention' profiles, setting the action to 'Ignore' for the 'Credential Dumping' category and applying it to the 'Finance' group.

Answer

Create an exception in the 'Malware' profile for the 'Finance' group, specifying the 'Credential Dumping' category.

Question 9

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Accepted Answer

Causality Analysis. Causality Analysis is the correct feature because it reconstructs the sequence of events and process relationships that led to an alert. It shows the parent-child chain, enabling the analyst to determine if the PowerShell script was spawned by a legitimate application or a malicious one. Other options either focus on live inspection, automation, or external threat data, none of which provide the required lineage view.

Answer

Process Explorer

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Question 10

What is the function of the 'Cortex XDR Broker Service'?

Accepted Answer

To act as a proxy/relay for agents in restricted environments.. The Cortex XDR Broker Service acts as a proxy/relay for agents in restricted environments, such as those without direct internet access. It enables agents to communicate with the Cortex XDR cloud by forwarding traffic through the broker. It does not manage user identities, store endpoint logs, or provide automatic remediation.

Answer

To manage user identities.

Answer

To store endpoint logs.

Answer

To provide automatic remediation.

Question 11

A security operations center (SOC) uses Cortex XSOAR to manage incidents. An analyst notices that a particular threat intelligence feed is generating a high number of false positive indicators, causing unnecessary incident creation. The analyst wants to reduce noise without losing valuable intelligence from that feed. What is the most appropriate action?

Accepted Answer

Adjust the feed's reputation and confidence thresholds. Adjusting reputation and confidence thresholds allows the SOC to filter out low-confidence indicators that are likely false positives while still ingesting higher-confidence indicators. This maintains the value of the feed and reduces unnecessary incident creation, achieving the desired balance.

Answer

Remove the feed and replace it with a different source

Answer

Disable the feed entirely

Answer

Create a playbook to automatically close incidents from that feed

Question 12

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a critical server. To determine if the activity is malicious, the analyst needs to examine the full process lineage and associated network connections. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize the relationships between processes, files, and network connections, enabling analysts to trace the root cause of an alert. It provides the necessary context to determine if a process execution is part of a malicious chain, making it the correct tool for this scenario.

Answer

Policy Audit

Answer

Incident Timeline

Answer

Threat Intelligence

Question 13

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host

Question 14

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Accepted Answer

join. The 'join' operator in XQL is used to correlate distinct event types by matching on a common field (e.g., username or host) across two datasets, which is exactly what is needed to link successful logins with subsequent suspicious process starts. It combines records from separate queries based on a join condition, enabling cross-event correlation. This makes 'join' the correct operator for correlating logins and process events.

Answer

summarize

Answer

filter

Answer

dedup

Question 15

A playbook task is configured to run on a 'Worker' group. If you see the task stuck in 'Pending' state, what is the most likely cause?

Accepted Answer

No workers are assigned to the specified group. In SOAR platforms like Palo Alto Cortex XSOAR, a playbook task assigned to a specific Worker group (e.g., 'Worker') will remain in 'Pending' state if no active worker is registered to that group. Workers poll the task queue for their assigned group; without a worker, the task cannot be picked up and executed. The 'Pending' state specifically indicates the task is waiting for an available worker in the designated group, not that the task itself is malformed or the system is overloaded.

Answer

The playbook is too large

Answer

The task is not marked as 'Automated'

Answer

The database is locked

Question 16

You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?

Accepted Answer

Detection Rule Testing Environment. The rule testing environment allows you to run detection rules against historical data to validate logic.

Answer

Live Dashboard Preview

Answer

Playbook Debugger

Answer

XQL Query Builder

Question 17

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Accepted Answer

Incident Stitching. Cortex XDR uses Incident Stitching to group related alerts based on causality and common indicators.

Answer

Alert Correlation Policy

Answer

Query Aggregation

Answer

BIOC Rule Grouping

Question 18

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 19

A security analyst notices that a new threat intelligence feed is sending indicators with a 'confidence' field set to 'Low' for most entries. The team wants to ensure that only high-confidence indicators trigger automated blocking actions on the firewall. Which of the following is the most appropriate action to achieve this?

Accepted Answer

Create a playbook that filters indicators based on the confidence field before sending them to the firewall integration.. The correct answer is to create a playbook that filters indicators based on the confidence field before sending them to the firewall integration. This ensures that only high-confidence indicators trigger automated blocking, while low-confidence indicators are still stored and available for analysis. Playbooks in Cortex XSOAR provide the necessary conditional logic and are the standard method for implementing such business rules without losing data.

Answer

Manually review each indicator and tag high-confidence ones, then create a playbook that only blocks tagged indicators.

Answer

Set the firewall integration to only accept indicators with a 'High' confidence by configuring the integration instance settings.

Answer

Modify the feed integration to exclude any indicator with a confidence field lower than 'High' during ingestion.

Question 20

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

Accepted Answer

A standard task that runs an integration command, because integration commands can return JSON that is parsed into context and used by later tasks.. Automated enrichment that calls an external API, parses the JSON response, and exposes values to later tasks is accomplished with a Cortex XSOAR task that runs an integration command. The command output is written into the incident context, where a conditional task can evaluate the reputation score against the threshold and branch accordingly. Manual, conditional, and data collection tasks do not perform the outbound HTTP request or JSON parsing required here.

Answer

A manual task that prompts the analyst to look up the IP reputation in a browser and enter the score by hand.

Answer

A data collection task that presents a form to the analyst to select the threat intel source before the playbook continues.

Answer

A conditional task that evaluates the IP against a static list of known-bad addresses stored in the playbook.