SecOps-Pro Practice Test 6 — 10 Questions

Question 1

You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?

Accepted Answer

Create an Incident Classifier rule to assign the playbook based on incident attributes. The 'Incident Auto-Classifier' or 'Automated Assignment' rules based on incident type or severity are the most efficient methods.

Answer

Manually open each incident and assign the playbook

Answer

Restart the server

Answer

Wait for the user to trigger it

Answer

Rename the incidents

Question 2

A new SOC analyst wants to see all traffic blocked by the firewall in the last hour. Where should they navigate in the Panorama monitor tab?

Accepted Answer

Monitor > Logs > Traffic. The Monitor tab in Panorama provides access to log views, including filtered traffic logs.

Answer

Network > Interfaces

Answer

Policies > Security

Answer

Objects > Services

Question 3

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 4

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 5

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Configuration requires network reachability, authentication, and defined ingestion rules.

Answer

Employee department codes

Answer

Physical location of the server room

Question 6

You want to trigger a playbook automatically whenever a new indicator is created of a specific type. Where is this configuration set?

Accepted Answer

Indicator Type Settings. The 'Indicator Auto-Extraction' or 'Indicator Triggered Playbook' settings allow you to map indicator types to specific playbooks.

Answer

Incident Type Settings

Answer

Playbook Inputs

Answer

Global Search

Question 7

You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?

Accepted Answer

Work Plan tab in the Incident view. The Work Plan tab within the incident view allows you to drill down into task results and inspect raw inputs/outputs.

Answer

System Logs

Answer

Indicator dashboard

Answer

Integration Instance Logs

Question 8

Where can you view the 'Context Data' for a specific incident?

Accepted Answer

Context Data tab. The context data is visible in the 'Context Data' tab within the Incident view.

Answer

Playbook Editor

Answer

Integration Log

Answer

System Configuration

Question 9

Which TWO of these are valid methods to trigger an automated playbook?

Accepted Answer

Incident Type auto-trigger. Playbooks can be triggered by incident ingestion (via Classifier) or manually by an analyst.

Answer

System boot-up

Answer

Setting a cron schedule

Answer

Browser refresh

Question 10

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.

Answer

Incident display layout

Answer

User password length