SecOps-Pro Practice Test 9 — 10 Questions

Question 1

When configuring threat intelligence feeds in Cortex XSOAR, which TWO of the following are key settings that must be configured for the feed to function correctly?

Accepted Answer

Feed URL. Option C (Feed URL) is correct because every Cortex XSOAR threat intelligence feed integration must be pointed at the external source's endpoint (the API or HTTP/HTTPS URL) from which indicators are retrieved, and without a valid URL the fetch mechanism has nothing to query. Option E (Polling Interval) is correct because feeds run on a scheduled fetch cycle, and the polling interval parameter defines how often XSOAR pulls new indicators (for example, every 5 minutes or hourly) so the indicator repository stays current. Option A (Operating System Version) is not a feed setting; it is irrelevant to indicator ingestion and belongs to endpoint or agent configuration. Option B (Incident Assignee) is not required for a feed to function, since feed fetching is an automated integration task rather than an incident workflow assignment. Option D (Database Password) is not a feed parameter; XSOAR manages its own datastore credentials internally, and feeds authenticate to the external source via API keys or tokens, not a database password.

Answer

Operating System Version

Answer

Incident Assignee

Answer

Database Password

Question 2

If you want to modify the data model mapping for an incoming log source, which menu path is most appropriate?

Accepted Answer

Settings -> Data Ingestion -> Parsing. In Cortex XSIAM, data model mapping for incoming log sources is configured under Settings -> Data Ingestion -> Parsing, where you can define or modify how raw logs are parsed and mapped to the Cortex Data Model (XDM) fields. This is the correct menu path for adjusting parsing and mapping rules for a log source.

Answer

Intelligence -> Feeds -> Parsing

Answer

Settings -> Assets -> Mapping

Answer

Incidents -> Rules -> Parsing

Question 3

Which THREE components are part of the standard XSOAR incident layout customization?

Accepted Answer

Tabs. In Cortex XSOAR, incident layout customization is performed through the incident type's layout editor, where Tabs (A) define the top-level sections of the incident view (such as Summary, War Room, and custom tabs) and control which information appears in each area. Custom Fields (B) are user-defined incident fields that can be added to the layout and displayed within those tabs, making them a core element of layout customization. Custom Buttons (E) are also configured as part of the layout, allowing analysts to trigger scripts, playbooks, or commands directly from the incident view. System BIOS settings (C) and CPU core count (D) are hardware/firmware attributes of the underlying host machine and have no role in XSOAR incident layout configuration.

Answer

System BIOS settings

Answer

CPU core count

Question 4

When investigating a file, you see a 'WildFire' verdict. What does this indicate?

Accepted Answer

The file was analyzed in a cloud sandbox and determined to be malicious.. A WildFire verdict means the file was submitted to Palo Alto Networks' WildFire cloud sandbox, executed in a controlled environment, and analyzed for malicious behavior. The verdict reflects the sandbox's determination — benign, grayware, phishing, or malicious — based on observed activity such as registry modification, network callbacks, or process injection. In Cortex XDR, this verdict is surfaced as part of the file's threat intelligence enrichment to help analysts decide on response actions.

Answer

The file was marked as safe by the user.

Answer

The file matches a local hash blocklist.

Answer

The file was blocked by the local firewall.

Question 5

During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?

Accepted Answer

WildFire. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service that provides global prevalence data and verdicts (malicious, benign, grayware) for file hashes. Consulting WildFire lets you determine whether a hash has been seen before, how widely it has spread, and how it is classified. This is exactly the service designed for file reputation and prevalence lookups.

Answer

Cortex XDR

Answer

Threat Vault

Answer

GlobalProtect

Question 6

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 7

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Accepted Answer

Vulnerability Protection Profile. SMB is a file-sharing protocol that carries exploit attempts, malware payloads, and lateral movement tools like PsExec and EternalBlue. The Vulnerability Protection Profile in PAN-OS inspects traffic for known exploits, including SMB-based attacks (e.g., MS17-010), and can block or alert on them. Applying it to the security policy ensures SMB sessions are scanned for malicious patterns at the application layer.

Answer

DoS Protection Profile

Answer

URL Filtering Profile

Answer

File Blocking Profile

Question 8

Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?

Accepted Answer

Playbook Debugger. The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.

Answer

System Health Monitor

Answer

Audit Logs

Answer

Integration Debugger

Question 9

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 10

What is the purpose of the 'XDM' (XSIAM Data Model) in Cortex XSIAM?

Accepted Answer

To provide a unified schema for diverse data. XDM provides a common schema that allows disparate data sources to be analyzed uniformly.

Answer

To encrypt data at rest

Answer

To provide a backup of log files

Answer

To manage user credentials