SecOps-Pro Practice Test 8 — 10 Questions

Question 1

A security operations team wants to proactively search for threats using indicators of compromise (IOCs) that are not yet linked to any incident. They plan to use threat intelligence data to hunt for these IOCs across their environment. Which approach best describes this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat hunting. Threat hunting is the proactive search for threats using IOCs and other intelligence, exactly as described. The team is not responding to an incident, managing vulnerabilities, or training users; they are actively seeking undetected threats. This process helps identify compromised systems before they cause harm, reducing dwell time and improving overall security posture.

Answer

Security awareness training

Answer

Incident response

Answer

Vulnerability management

Question 2

A SOC analyst is documenting a security incident that involved lateral movement within the network. Which piece of information is MOST critical to include in the incident report to help future threat hunting?

Accepted Answer

The specific tools and techniques used by the attacker for lateral movement. For future threat hunting, the most valuable information is the specific tools and techniques used by the attacker, especially for lateral movement. This allows the SOC to develop targeted hunts and detection rules. For instance, if the attacker used Windows Management Instrumentation (WMI) or Server Message Block (SMB) for lateral movement, analysts can hunt for anomalous use of these protocols. Documenting TTPs aligns with frameworks like MITRE ATT&CK and enhances proactive defense.

Answer

The exact time the incident was first reported by the end user

Answer

The number of failed login attempts during the incident

Answer

The list of all users who were logged into the network at the time of the incident

Question 3

Which THREE actions can be performed from the Incident 'Work Plan' tab?

Accepted Answer

Skip a task. The Incident 'Work Plan' tab is designed to manage the individual tasks that make up an incident's remediation workflow, so option A (Skip a task) is correct because operators can bypass a pending task that is no longer needed or applicable. Option C (Re-run a failed task) is correct because the Work Plan allows retrying a task that did not complete successfully, which is a core remediation action. Option E (View task execution logs) is correct because each task exposes its execution output and logs directly from the Work Plan for troubleshooting. Options B (Change the server OS) and D (Add a new incident type) are not Work Plan actions: changing an OS is an infrastructure/provisioning operation, and adding an incident type is a configuration/administration function, neither of which is performed from the incident's task list.

Answer

Change the server OS

Answer

Add a new incident type

Question 4

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 5

A large volume of duplicate indicators is flooding your XSOAR instance from multiple sources. What is the most efficient way to manage this?

Accepted Answer

Configure global indicator deduplication settings. Cortex XSOAR provides global indicator deduplication settings that allow you to define how duplicate indicators from multiple sources are merged or deduplicated based on fields like value and type. Configuring these settings is the most efficient way to manage a high volume of duplicate indicators because it reduces noise at ingestion without losing data. This is a built-in feature designed specifically for this problem.

Answer

Change the integration poll time

Answer

Disable threat intelligence feeds

Answer

Manually delete duplicates daily

Question 6

When designing a layout, which widget is used to display the timeline of events that occurred within a case?

Accepted Answer

Timeline. The Timeline widget is specifically designed to show the chronological history of case events.

Answer

Incident List

Answer

Grid

Answer

Markdown

Question 7

A security analyst is troubleshooting an integration that is failing to pull data from a threat feed. What is the first place they should check for errors?

Accepted Answer

The War Room or the Integration Instance logs. The War Room or the integration instance logs provide specific error codes.

Answer

The User Management settings

Answer

The Incident Dashboard

Answer

The Threat Intel page

Question 8

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

Accepted Answer

Reporting. The Reporting section allows for the generation and scheduling of custom and predefined reports based on alert data.

Answer

Settings

Answer

Incident View

Answer

Query Center

Question 9

A security operations center (SOC) manager wants to ensure that all analysts can quickly see which incidents are assigned to them and their current status. Which Cortex XSIAM dashboard component should the manager use to display a personalized list of incidents for each analyst?

Accepted Answer

Incident widget. The Incident widget is designed to display incident data on dashboards. By configuring it with a filter based on the assignee field, the manager can create a dashboard where each analyst sees only the incidents assigned to them, along with status, severity, and other relevant details. This supports workload management and ensures analysts focus on their own tasks.

Answer

Endpoint health widget

Answer

Data ingestion widget

Answer

Threat intelligence widget

Question 10

A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Create a Device Control profile and set the action to Block for all USB device types.. To allow only specific USB devices, the administrator must first create a Device Control profile that blocks all USB device types by default. Then, exceptions must be added for the approved devices, specifying their identifiers. This two-step approach ensures that unauthorized devices are blocked while allowing the necessary ones. Other features like Malware Profiles or Behavioral Threat Protection do not provide the granular control needed for this requirement.

Answer

Configure a Behavioral Threat Protection rule to block USB device installation.

Answer

Set the Device Control profile action to 'Report' for all USB devices.

Answer

Enable the 'Block USB Mass Storage' option in the Malware Profile.