SecOps-Pro Practice Test 6 — 10 Questions

Question 1

Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?

Accepted Answer

Summary. The Summary tab in the Incident view is designed to provide a real-time, user-friendly overview of the investigation status. It aggregates key details such as incident severity, status, assignee, and a timeline of events, giving analysts an at-a-glance understanding without navigating multiple tabs. This aligns with the goal of a quick, high-level summary for efficient incident management.

Answer

Indicators

Answer

Work Plan

Answer

Evidence

Question 2

Why should you use an 'Indicator Reputation' threshold in your SecOps process?

Accepted Answer

To prevent low-confidence or unverified indicators from triggering automated blocks. It helps reduce false positives by ensuring only high-confidence indicators trigger automated blocks.

Answer

To automatically delete logs

Answer

To increase the number of alerts

Answer

To speed up data ingestion

Question 3

Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?

Accepted Answer

Mean Time to Remediate (MTTR). Mean Time to Remediate (MTTR) measures the average time from incident detection to full remediation, directly reflecting the operational efficiency of the Incident Response team. Over a fiscal quarter, tracking MTTR shows whether the team is improving its response speed and effectiveness, making it the most relevant efficiency metric.

Answer

Total number of alerts generated

Answer

Number of active playbooks

Answer

Number of users trained on phishing

Question 4

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

Accepted Answer

The endpoint has not received the updated policy containing the BIOC.. If the agent has not yet received the latest policy update containing the new BIOC, it will not enforce the rule.

Answer

The agent is not configured to send BIOC logs.

Answer

The BIOC rule is disabled by default.

Answer

The BIOC rule requires a full agent reboot.

Question 5

A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?

Accepted Answer

Query Builder with network events. Query Builder with network events is the correct tool because it allows the analyst to run XQL queries against historical network data, filtering by endpoint and time range. This returns a list of all external IP addresses the endpoint communicated with, which is essential for identifying potential exfiltration destinations. Other views are more focused on alerts or current state and lack the comprehensive historical network data required.

Answer

Threat Intelligence module

Answer

Endpoint Investigation view

Answer

Incident Response view

Question 6

What is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?

Accepted Answer

To parse and identify IOCs from incident descriptions or email bodies. Indicator extraction automatically identifies and parses artifacts from unstructured text.

Answer

To manually block IPs on the firewall

Answer

To update the threat intelligence database

Answer

To generate reports on threat actors

Question 7

A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?

Accepted Answer

Replace the `match` stage with a `comp` stage that uses `count()` grouped by `action_local_ip` and then apply a `filter` on the count.. Correlation rules that require counting events within a timeframe need an aggregation stage such as `comp count()` grouped by the relevant field. A `match` stage alone groups events but does not count them; it simply aligns events by a common field. To enforce a threshold, the rule must aggregate counts and then filter on the aggregated value, ensuring it fires only when the count exceeds the defined limit.

Answer

Increase the `timeframe` to 10 minutes and add a `dedup` stage on `action_local_ip` to remove duplicate events.

Answer

Add a `filter` stage after the `match` stage to count the number of events per `action_local_ip` and compare against a threshold.

Answer

Add a `sort` stage on `action_local_ip` and a `limit` stage to return only the top 10 events.

Question 8

A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?

Accepted Answer

Create an exclusion rule in the 'Alert Exclusions' section, specifying the endpoint group 'Finance' and the alert category 'Credential Dumping'.. Alert Exclusions are designed to suppress specific alerts based on criteria such as endpoint group and alert category. By creating an exclusion for the 'Finance' group and 'Credential Dumping' category, the administrator can reduce noise while maintaining detection for other groups and alert types. Other mechanisms like Prevention profiles or BIOC rules serve different purposes.

Answer

Create a BIOC rule with a filter for the 'Finance' group and a condition to exclude 'Credential Dumping' alerts.

Answer

Create a policy rule in 'Prevention' profiles, setting the action to 'Ignore' for the 'Credential Dumping' category and applying it to the 'Finance' group.

Answer

Create an exception in the 'Malware' profile for the 'Finance' group, specifying the 'Credential Dumping' category.

Question 9

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Accepted Answer

Causality Analysis. Causality Analysis is the correct feature because it reconstructs the sequence of events and process relationships that led to an alert. It shows the parent-child chain, enabling the analyst to determine if the PowerShell script was spawned by a legitimate application or a malicious one. Other options either focus on live inspection, automation, or external threat data, none of which provide the required lineage view.

Answer

Process Explorer

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Question 10

What is the function of the 'Cortex XDR Broker Service'?

Accepted Answer

To act as a proxy/relay for agents in restricted environments.. The Cortex XDR Broker Service acts as a proxy/relay for agents in restricted environments, such as those without direct internet access. It enables agents to communicate with the Cortex XDR cloud by forwarding traffic through the broker. It does not manage user identities, store endpoint logs, or provide automatic remediation.

Answer

To manage user identities.

Answer

To store endpoint logs.

Answer

To provide automatic remediation.