SecOps-Pro Practice Test 9 — 10 Questions

Question 1

Which SOC operational document defines the service level objectives (SLOs) for incident response times?

Accepted Answer

SLA. An SLA (Service Level Agreement) is the primary document defining response time requirements.

Answer

Runbook

Answer

Security Policy

Answer

Playbook

Question 2

Which THREE roles are commonly involved in the SOC operational structure?

Accepted Answer

SOC Manager. Tier 1, Tier 2, and SOC Managers are standard components of a functional SOC team.

Answer

IT Helpdesk Lead

Answer

Sales Engineer

Question 3

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

Accepted Answer

Integration Instance Settings. The XDR-XSOAR integration instance configuration defines the flow of alerts into XSOAR.

Answer

Incident Mapping

Answer

User Permissions

Answer

Playbook Workflow

Question 4

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Accepted Answer

War Room. The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.

Answer

Summary Tab

Answer

Evidence Board

Answer

Playbook Tab

Question 5

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

Accepted Answer

Behavioral Threat Protection. The Cortex XDR agent uses Behavioral Threat Protection to stop malicious processes in real-time.

Answer

Exploit Prevention

Answer

Network Isolation

Answer

Host Insight

Question 6

In XSOAR, an analyst wants to share a finding with another team member. Which feature allows for real-time collaboration within the incident workspace?

Accepted Answer

War Room. The War Room allows multiple analysts to comment, run commands, and share findings in a single collaborative interface.

Answer

Work Plan

Answer

Indicator Tab

Answer

Incident Summary

Question 7

You are troubleshooting a connectivity issue between an internal log forwarder and Cortex Data Lake. Which command should you run on the log forwarder to verify the ingestion status?

Accepted Answer

show log-collector statistics. The 'show log-collector statistics' command is used on the log forwarder to check status and ingestion health.

Answer

show system status

Answer

test log-collector connectivity

Answer

debug log-forwarding status

Question 8

Which THREE methods can be used in Cortex XSOAR to ingest indicators?

Accepted Answer

Manual entry via the UI. Cortex XSOAR supports automated ingestion through threat feeds, manual entry, and incident extraction.

Answer

Direct database SQL injection

Answer

Hardware port mirroring

Question 9

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Accepted Answer

Incident Stitching. Cortex XDR uses Incident Stitching to group related alerts based on causality and common indicators.

Answer

Alert Correlation Policy

Answer

Query Aggregation

Answer

BIOC Rule Grouping

Question 10

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Accepted Answer

Set Incident. The 'Set Incident' task in XSOAR allows for the modification of incident attributes, including status.

Answer

Incident Mapping

Answer

Close Incident

Answer

Task Assignment