SecOps-Pro Practice Test 7 — 10 Questions

Question 1

A security operations center (SOC) uses Cortex XSOAR to manage incidents. An analyst notices that a particular threat intelligence feed is generating a high number of false positive indicators, causing unnecessary incident creation. The analyst wants to reduce noise without losing valuable intelligence from that feed. What is the most appropriate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the feed's reputation and confidence thresholds. Adjusting reputation and confidence thresholds allows the SOC to filter out low-confidence indicators that are likely false positives while still ingesting higher-confidence indicators. This maintains the value of the feed and reduces unnecessary incident creation, achieving the desired balance.

Answer

Remove the feed and replace it with a different source

Answer

Disable the feed entirely

Answer

Create a playbook to automatically close incidents from that feed

Question 2

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a critical server. To determine if the activity is malicious, the analyst needs to examine the full process lineage and associated network connections. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize the relationships between processes, files, and network connections, enabling analysts to trace the root cause of an alert. It provides the necessary context to determine if a process execution is part of a malicious chain, making it the correct tool for this scenario.

Answer

Policy Audit

Answer

Incident Timeline

Answer

Threat Intelligence

Question 3

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host

Question 4

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Accepted Answer

join. The 'join' operator in XQL is used to correlate distinct event types by matching on a common field (e.g., username or host) across two datasets, which is exactly what is needed to link successful logins with subsequent suspicious process starts. It combines records from separate queries based on a join condition, enabling cross-event correlation. This makes 'join' the correct operator for correlating logins and process events.

Answer

summarize

Answer

filter

Answer

dedup

Question 5

A playbook task is configured to run on a 'Worker' group. If you see the task stuck in 'Pending' state, what is the most likely cause?

Accepted Answer

No workers are assigned to the specified group. In SOAR platforms like Palo Alto Cortex XSOAR, a playbook task assigned to a specific Worker group (e.g., 'Worker') will remain in 'Pending' state if no active worker is registered to that group. Workers poll the task queue for their assigned group; without a worker, the task cannot be picked up and executed. The 'Pending' state specifically indicates the task is waiting for an available worker in the designated group, not that the task itself is malformed or the system is overloaded.

Answer

The playbook is too large

Answer

The task is not marked as 'Automated'

Answer

The database is locked

Question 6

You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?

Accepted Answer

Detection Rule Testing Environment. The rule testing environment allows you to run detection rules against historical data to validate logic.

Answer

Live Dashboard Preview

Answer

Playbook Debugger

Answer

XQL Query Builder

Question 7

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Accepted Answer

Incident Stitching. Cortex XDR uses Incident Stitching to group related alerts based on causality and common indicators.

Answer

Alert Correlation Policy

Answer

Query Aggregation

Answer

BIOC Rule Grouping

Question 8

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 9

A security analyst notices that a new threat intelligence feed is sending indicators with a 'confidence' field set to 'Low' for most entries. The team wants to ensure that only high-confidence indicators trigger automated blocking actions on the firewall. Which of the following is the most appropriate action to achieve this?

Accepted Answer

Create a playbook that filters indicators based on the confidence field before sending them to the firewall integration.. The correct answer is to create a playbook that filters indicators based on the confidence field before sending them to the firewall integration. This ensures that only high-confidence indicators trigger automated blocking, while low-confidence indicators are still stored and available for analysis. Playbooks in Cortex XSOAR provide the necessary conditional logic and are the standard method for implementing such business rules without losing data.

Answer

Manually review each indicator and tag high-confidence ones, then create a playbook that only blocks tagged indicators.

Answer

Set the firewall integration to only accept indicators with a 'High' confidence by configuring the integration instance settings.

Answer

Modify the feed integration to exclude any indicator with a confidence field lower than 'High' during ingestion.

Question 10

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

Accepted Answer

A standard task that runs an integration command, because integration commands can return JSON that is parsed into context and used by later tasks.. Automated enrichment that calls an external API, parses the JSON response, and exposes values to later tasks is accomplished with a Cortex XSOAR task that runs an integration command. The command output is written into the incident context, where a conditional task can evaluate the reputation score against the threshold and branch accordingly. Manual, conditional, and data collection tasks do not perform the outbound HTTP request or JSON parsing required here.

Answer

A manual task that prompts the analyst to look up the IP reputation in a browser and enter the score by hand.

Answer

A data collection task that presents a form to the analyst to select the threat intel source before the playbook continues.

Answer

A conditional task that evaluates the IP against a static list of known-bad addresses stored in the playbook.