SecOps-Pro Hard Questions — 25 Difficult Questions

Question 1

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Directory services logs ingested through a log collection integration, which provides authentication events from the identity provider.. To correlate endpoint process execution, network connections, and directory authentication events in one XQL query, the administrator needs the data that actually generates those events. Cortex XDR agent telemetry supplies endpoint process and network events, while directory services logs ingested through a log collection integration supply authentication events. WildFire verdicts, Cortex Data Lake storage, and threat intel feeds add enrichment or storage but do not produce the required event types.

Answer

Threat intelligence feeds from third-party providers, which supply indicators of compromise for matching.

Answer

WildFire sandbox verdicts, which provide file reputation and behavioral reports for submitted samples.

Answer

Cortex Data Lake raw log storage, which retains all ingested logs for long-term query and compliance.

Question 2

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Accepted Answer

Line Chart. A Line Chart is the correct widget type for visualizing how a metric (count of indicator types) changes over time, since it plots data points across a time axis. In Cortex XSOAR dashboards, line charts are used for trend analysis over time, which matches tracking threat intelligence trends.

Answer

Counter Widget

Answer

Pie Chart

Answer

Table Widget

Question 3

Which THREE actions are available when configuring a 'Condition' task?

Accepted Answer

Compare a context value to a static value. Condition tasks allow for testing context values, checking for existence, and branching based on comparison results.

Answer

Delete an incident

Answer

Change the task owner

Question 4

A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?

Accepted Answer

join. The join operator is specifically designed to combine records from two datasets based on a matching field. By joining failed and successful login events on the 'user' field, the administrator can identify users who experienced a failed login followed by a successful one, which is a common indicator of brute-force or credential-stuffing attacks. This correlation is essential for accurate detection.

Answer

filter

Answer

union

Answer

sort

Question 5

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Accepted Answer

Executing system commands. Live Terminal in Cortex XDR provides a remote shell on the endpoint, so option A (Executing system commands) is correct because it lets analysts run OS-level commands directly on the host for investigation or remediation. Option C (Deleting files on the endpoint) is correct because the terminal can issue file-deletion commands to remove malicious artifacts from the endpoint. Option E (Listing running processes) is correct because analysts can run process-listing commands (e.g., tasklist on Windows or ps on Linux/macOS) to enumerate active processes during triage. Option B (Automating incident closure in XSOAR) is not a Live Terminal capability, as that is handled by XSOAR playbooks and incident management workflows, not a remote endpoint shell. Option D (Modifying firewall policy rules) is not performed through Live Terminal, since firewall policy changes are made in the firewall management console or policy configuration, not via endpoint command execution.

Answer

Automating incident closure in XSOAR

Answer

Modifying firewall policy rules

Question 6

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Accepted Answer

Use the data source onboarding wizard to preview parsed fields from a sample of the log data.. Validating ingestion and mapping requires observing the parsed output, which the onboarding wizard's preview provides, and then confirming the mapped fields in ingested data with XQL. Disabling rules, waiting for incidents, or editing mappings without previewing the data do not provide reliable validation and can harm production detection quality.

Answer

Edit the XDM mapping directly in the dataset schema without previewing the source data.

Answer

Disable all correlation rules that reference firewall data until the new source is confirmed working.

Answer

Add the source to a production dataset and wait for an incident to be generated before checking field values.

Question 7

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Script complexity (A) is correct because the amount and intricacy of the automation logic — number of tasks, conditional branches, loops, and API calls — directly determines how long a playbook takes to execute. The number of active workers (C) is correct because workers are the execution engines that run playbook tasks; more available workers allow tasks to be processed in parallel rather than queued, improving throughput. The number of concurrent tasks (D) is correct because running many tasks simultaneously increases resource contention (CPU, memory, API rate limits), which can either speed up or degrade overall playbook performance depending on capacity. Incident display layout (B) is incorrect because it is purely a UI presentation concern and has no effect on backend playbook execution. User password length (E) is incorrect because it only affects authentication strength and has no bearing on how fast or efficiently a playbook runs.

Answer

Incident display layout

Answer

User password length

Question 8

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Accepted Answer

xdr_memory. To detect credential dumping via LSASS memory access, the analyst needs to correlate process execution with memory access events. The xdr_process dataset provides process context, while xdr_memory captures the actual memory access. Together, they enable detection of suspicious processes reading LSASS memory.

Answer

xdr_registry

Answer

xdr_network

Answer

xdr_file

Question 9

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

Accepted Answer

Value. The Value field is the actual indicator data (for example, an IP address, domain, file hash, or URL) that Cortex XSOAR uses to perform lookups and reputation scoring. If the Value is not correctly mapped from the external feed, the indicator cannot be matched against existing data or enriched by integrations, breaking the entire feed ingestion pipeline. Indicator Type, Expiration, and Source are metadata that describe the indicator but do not drive lookup or scoring.

Answer

Indicator Type

Answer

Expiration

Answer

Indicator Source

Question 10

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

Accepted Answer

join. The 'join' keyword is essential in XQL for correlating disparate datasets.

Answer

connect

Answer

union

Answer

merge

Question 11

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 12

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. In the Cortex XSIAM Incident record, option A (Associated logs and alerts) is correct because an incident aggregates the underlying alerts and their raw log evidence that triggered or contributed to the case, giving analysts the source telemetry. Option C (Timeline of events) is correct because XSIAM builds a chronological timeline that correlates alerts, activity, and analyst actions to show how the incident unfolded. Option D (Impacted entities) is correct because the incident record identifies the affected entities such as hosts, users, IP addresses, and accounts, which is essential for scoping and response. Option B (Employee performance reviews) is not part of incident data, as that is HR information unrelated to security telemetry. Option E (Platform billing history) is also not included, since licensing and billing records are administrative data, not incident evidence.

Answer

Employee performance reviews

Answer

Platform billing history

Question 13

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Accepted Answer

Assign a Tag. Option A (Assign a Tag) is correct because XSOAR indicators support tags that analysts apply to categorize, group, and track threat data through its lifecycle, enabling filtering, searching, and automated playbook logic based on tag values. Option B (Update Reputation) is correct because each indicator in XSOAR carries a reputation score (e.g., None, Benign, Suspicious, Malicious) that can be manually or automatically updated, which is central to lifecycle management since it drives incident severity and playbook branching. The remaining options do not apply to indicator objects: installing a new plugin (C) is a system/marketplace administration task, renaming the source feed (D) modifies a feed integration rather than an indicator, and changing the server OS (E) is an infrastructure operation unrelated to indicator lifecycle management.

Answer

Install a new plugin

Answer

Rename the source feed

Answer

Change the server OS

Question 14

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

Accepted Answer

Integration Instance Settings. The XDR-XSOAR integration instance configuration defines the flow of alerts into XSOAR.

Answer

Incident Mapping

Answer

User Permissions

Answer

Playbook Workflow

Question 15

You are troubleshooting a connectivity issue between an internal log forwarder and Cortex Data Lake. Which command should you run on the log forwarder to verify the ingestion status?

Accepted Answer

show log-collector statistics. The 'show log-collector statistics' command is used on the log forwarder to check status and ingestion health.

Answer

show system status

Answer

test log-collector connectivity

Answer

debug log-forwarding status

Question 16

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Accepted Answer

Set Incident. The 'Set Incident' task in XSOAR allows for the modification of incident attributes, including status.

Answer

Incident Mapping

Answer

Close Incident

Answer

Task Assignment

Question 17

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 18

When integrating Palo Alto Networks AutoFocus into XSOAR, which specific field allows you to map AutoFocus 'Tags' to XSOAR 'Labels'?

Accepted Answer

Mapping Fields. The mapping configuration in the integration instance settings allows for custom field and label mapping.

Answer

Feed Fetch Settings

Answer

Advanced Options

Answer

Indicator Thresholds

Question 19

When designing a custom layout, how do you make a field read-only for specific roles?

Accepted Answer

Use the Field Permissions setting in the Layout editor. In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.

Answer

Write a script to hide the field

Answer

Use the incident lifecycle stage

Answer

Disable the field in System Settings

Question 20

You have a custom threat intelligence source that provides data in CSV format. How can you ingest this into XSOAR?

Accepted Answer

Use the Generic Feed integration. XSOAR supports CSV ingestion through the generic Feed integration.

Answer

Write a Python script to copy the file

Answer

Use the API to upload to the database

Answer

Create an incident manually