SecOps-Pro Multiple Select — 40 Questions

Question 1

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Directory services logs ingested through a log collection integration, which provides authentication events from the identity provider.. To correlate endpoint process execution, network connections, and directory authentication events in one XQL query, the administrator needs the data that actually generates those events. Cortex XDR agent telemetry supplies endpoint process and network events, while directory services logs ingested through a log collection integration supply authentication events. WildFire verdicts, Cortex Data Lake storage, and threat intel feeds add enrichment or storage but do not produce the required event types.

Answer

Threat intelligence feeds from third-party providers, which supply indicators of compromise for matching.

Answer

WildFire sandbox verdicts, which provide file reputation and behavioral reports for submitted samples.

Answer

Cortex Data Lake raw log storage, which retains all ingested logs for long-term query and compliance.

Question 2

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Accepted Answer

Executing system commands. Live Terminal in Cortex XDR provides a remote shell on the endpoint, so option A (Executing system commands) is correct because it lets analysts run OS-level commands directly on the host for investigation or remediation. Option C (Deleting files on the endpoint) is correct because the terminal can issue file-deletion commands to remove malicious artifacts from the endpoint. Option E (Listing running processes) is correct because analysts can run process-listing commands (e.g., tasklist on Windows or ps on Linux/macOS) to enumerate active processes during triage. Option B (Automating incident closure in XSOAR) is not a Live Terminal capability, as that is handled by XSOAR playbooks and incident management workflows, not a remote endpoint shell. Option D (Modifying firewall policy rules) is not performed through Live Terminal, since firewall policy changes are made in the firewall management console or policy configuration, not via endpoint command execution.

Answer

Automating incident closure in XSOAR

Answer

Modifying firewall policy rules

Question 3

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Accepted Answer

Use the data source onboarding wizard to preview parsed fields from a sample of the log data.. Validating ingestion and mapping requires observing the parsed output, which the onboarding wizard's preview provides, and then confirming the mapped fields in ingested data with XQL. Disabling rules, waiting for incidents, or editing mappings without previewing the data do not provide reliable validation and can harm production detection quality.

Answer

Edit the XDM mapping directly in the dataset schema without previewing the source data.

Answer

Disable all correlation rules that reference firewall data until the new source is confirmed working.

Answer

Add the source to a production dataset and wait for an incident to be generated before checking field values.

Question 4

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Accepted Answer

Use the Cortex XDR - Get Endpoint Forensic Data command to collect volatile evidence from the endpoint. The playbook must isolate the endpoint and collect forensic evidence. The Cortex XDR - Isolate Endpoint command quarantines the endpoint from the network, achieving containment. The Cortex XDR - Get Endpoint Forensic Data command retrieves volatile evidence for analysis. The other commands perform remediation or scanning, which are out of sequence and do not meet the stated goals.

Answer

Use the Cortex XDR - Scan Endpoint command to run a full antivirus scan on the endpoint

Answer

Use the Cortex XDR - Block File command to delete the malicious executable from the endpoint

Answer

Use the Cortex XDR - Quarantine File command to move the malicious file to a quarantine folder

Question 5

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Script complexity (A) is correct because the amount and intricacy of the automation logic — number of tasks, conditional branches, loops, and API calls — directly determines how long a playbook takes to execute. The number of active workers (C) is correct because workers are the execution engines that run playbook tasks; more available workers allow tasks to be processed in parallel rather than queued, improving throughput. The number of concurrent tasks (D) is correct because running many tasks simultaneously increases resource contention (CPU, memory, API rate limits), which can either speed up or degrade overall playbook performance depending on capacity. Incident display layout (B) is incorrect because it is purely a UI presentation concern and has no effect on backend playbook execution. User password length (E) is incorrect because it only affects authentication strength and has no bearing on how fast or efficiently a playbook runs.

Answer

Incident display layout

Answer

User password length

Question 6

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Accepted Answer

xdr_memory. To detect credential dumping via LSASS memory access, the analyst needs to correlate process execution with memory access events. The xdr_process dataset provides process context, while xdr_memory captures the actual memory access. Together, they enable detection of suspicious processes reading LSASS memory.

Answer

xdr_registry

Answer

xdr_network

Answer

xdr_file

Question 7

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. Option D is correct because the XDM (Extended Data Model) schema in Cortex XSIAM maps ingested data from many sources into a consistent set of fields, so analysts can write XQL queries against stable, predictable field names instead of vendor-specific ones, greatly simplifying query authoring. Option E is correct because XDM normalizes data across different products and telemetry types (endpoint, network, cloud, identity, etc.) into a common taxonomy, enabling cross-source correlation and detection without per-vendor parsing logic. The unmarked options do not belong: XDM is a data-modeling/normalization layer and does not perform automated hardware replacement (A), does not directly increase endpoint processing speed (B), and while normalization can improve storage efficiency, it does not guarantee a specific 90% storage-cost reduction (C).

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%

Question 8

Which THREE of the following are critical elements of the Indicator Lifecycle in Cortex XSOAR?

Accepted Answer

Indicator Ingestion. The Indicator Lifecycle in Cortex XSOAR describes how indicators (such as IPs, domains, and file hashes) are brought into the system, enriched, and eventually aged out. Indicator Ingestion (B) is correct because it is the entry point of the lifecycle, where indicators are pulled in from feeds, integrations, or incidents and stored in the indicators database. Indicator Expiration (C) is correct because indicators have a time-to-live (TTL) and must be automatically expired or removed when they are no longer relevant, which is a defined stage of the lifecycle. Reputation Scoring (D) is correct because assigning and updating reputation (e.g., malicious, suspicious, benign, or unknown) based on enrichment and threat intel is a core part of how indicators are evaluated and maintained throughout their lifecycle. Changing the server IP address (A) is a network/infrastructure administration task unrelated to indicator handling, and physical security of the data center (E) is a facilities/security concern, neither of which is a stage or element of the Indicator Lifecycle in Cortex XSOAR.

Answer

Changing the server IP address

Answer

Physical security of the data center

Question 9

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Accepted Answer

Real-time incident queue tracking. Option A is correct because the Cortex XSIAM Unified SOC dashboard is designed to give analysts a live, prioritized view of incidents, so real-time incident queue tracking is a core capability that lets teams monitor open cases, severity, and status as events stream in. Option E is correct because the dashboard is built on customizable widgets, allowing SOC teams to create and arrange widgets that surface the specific metrics, threat feeds, or case data relevant to their environment. The remaining options do not belong: Cortex agent update scheduling (B) is an endpoint management function handled through Cortex XDR policies rather than the Unified SOC dashboard, physical security badge tracking (C) is a facility-access concern outside XSIAM's SOC analytics, and automated code deployment (D) is a CI/CD pipeline activity unrelated to SOC monitoring and incident response.

Answer

Cortex agent update scheduling

Answer

Physical security badge tracking

Answer

Automated code deployment

Question 10

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. In the Cortex XSIAM Incident record, option A (Associated logs and alerts) is correct because an incident aggregates the underlying alerts and their raw log evidence that triggered or contributed to the case, giving analysts the source telemetry. Option C (Timeline of events) is correct because XSIAM builds a chronological timeline that correlates alerts, activity, and analyst actions to show how the incident unfolded. Option D (Impacted entities) is correct because the incident record identifies the affected entities such as hosts, users, IP addresses, and accounts, which is essential for scoping and response. Option B (Employee performance reviews) is not part of incident data, as that is HR information unrelated to security telemetry. Option E (Platform billing history) is also not included, since licensing and billing records are administrative data, not incident evidence.

Answer

Employee performance reviews

Answer

Platform billing history

Question 11

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Accepted Answer

Assign a Tag. Option A (Assign a Tag) is correct because XSOAR indicators support tags that analysts apply to categorize, group, and track threat data through its lifecycle, enabling filtering, searching, and automated playbook logic based on tag values. Option B (Update Reputation) is correct because each indicator in XSOAR carries a reputation score (e.g., None, Benign, Suspicious, Malicious) that can be manually or automatically updated, which is central to lifecycle management since it drives incident severity and playbook branching. The remaining options do not apply to indicator objects: installing a new plugin (C) is a system/marketplace administration task, renaming the source feed (D) modifies a feed integration rather than an indicator, and changing the server OS (E) is an infrastructure operation unrelated to indicator lifecycle management.

Answer

Install a new plugin

Answer

Rename the source feed

Answer

Change the server OS

Question 12

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS

Question 13

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

Accepted Answer

Cortex XSOAR. Cortex provides XDR for detection, XSOAR for automation, and Data Lake for log aggregation.

Answer

GlobalProtect Enterprise

Answer

Panorama Policy Creator

Question 14

Which THREE items should be included in a standard SOC shift-handover report?

Accepted Answer

Status of high-priority incidents. High-priority incidents, pending action items, and known issues are essential for a smooth shift transition.

Answer

Entire network configuration file

Answer

Personal employee performance reviews

Question 15

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Option C is correct because a mature SOC incident response plan must specify defined communication and escalation procedures, including who is notified, through which channels, and at what severity thresholds, so incidents are escalated promptly to the right stakeholders. Option E is correct because clearly defining roles and responsibilities (for example, incident commander, SOC analysts, forensics, and legal liaisons) ensures accountability and prevents gaps or duplication during response. Automated hardware repair (A) is a maintenance or IT operations function, not an incident response planning component. A public relations policy (B) may support crisis communications but is not a core component of the SOC incident response plan itself. Budget approval workflows (D) are financial governance processes and are not part of incident response planning.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 16

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 17

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Accepted Answer

Third-party network device logs (e.g., Syslog).. Option C is correct because a Cortex XDR Collector can ingest third-party network device logs such as Syslog, which is a standard protocol for forwarding event data from routers, switches, and other network appliances into Cortex XDR for correlation and analysis. Option E is correct because the Cortex XDR Collector natively supports ingesting Palo Alto Networks Next-Generation Firewall logs, including traffic, threat, and URL filtering logs, which are parsed and normalized for Cortex XDR detection and investigation. The unmarked options do not belong: local user email drafts (A) are personal application data not collected by the Cortex XDR Collector, internal coffee machine status (B) is an IoT/facilities telemetry source outside the supported log ingestion scope, and physical hardware inventory logs (D) are asset-management data rather than the security event logs the Collector is designed to receive.

Answer

Local user email drafts.

Answer

Internal coffee machine status.

Answer

Physical hardware inventory logs.

Question 18

Which THREE actions can be performed from the Incident 'Work Plan' tab?

Accepted Answer

Skip a task. The Incident 'Work Plan' tab is designed to manage the individual tasks that make up an incident's remediation workflow, so option A (Skip a task) is correct because operators can bypass a pending task that is no longer needed or applicable. Option C (Re-run a failed task) is correct because the Work Plan allows retrying a task that did not complete successfully, which is a core remediation action. Option E (View task execution logs) is correct because each task exposes its execution output and logs directly from the Work Plan for troubleshooting. Options B (Change the server OS) and D (Add a new incident type) are not Work Plan actions: changing an OS is an infrastructure/provisioning operation, and adding an incident type is a configuration/administration function, neither of which is performed from the incident's task list.

Answer

Change the server OS

Answer

Add a new incident type

Question 19

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 20

A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Create a Device Control profile and set the action to Block for all USB device types.. To allow only specific USB devices, the administrator must first create a Device Control profile that blocks all USB device types by default. Then, exceptions must be added for the approved devices, specifying their identifiers. This two-step approach ensures that unauthorized devices are blocked while allowing the necessary ones. Other features like Malware Profiles or Behavioral Threat Protection do not provide the granular control needed for this requirement.

Answer

Configure a Behavioral Threat Protection rule to block USB device installation.

Answer

Set the Device Control profile action to 'Report' for all USB devices.

Answer

Enable the 'Block USB Mass Storage' option in the Malware Profile.