SecOps-Pro Multiple Select — 60 Questions

Question 1

Which THREE pieces of information are displayed in the Incident View?

Accepted Answer

Associated alerts.. The incident view provides an overview of the affected entities, the associated alerts, and the status of the investigation.

Answer

The names of all users in the organization.

Answer

The current CPU usage of the cloud console.

Question 2

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

Accepted Answer

Endpoint View.. Analysts can use the Endpoint View for historical data and the Live Terminal for real-time interaction.

Answer

Sending a network broadcast.

Answer

Running a full system re-image.

Answer

Deleting the endpoint from the console.

Question 3

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 4

Which THREE actions are available when responding to an incident via the Response feature?

Accepted Answer

Isolate host.. Common response actions include isolating a host, killing a process, and quarantining a file.

Answer

Change the user password.

Answer

Perform a remote OS reinstall.

Question 5

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Accepted Answer

Real-time incident queue tracking. The dashboard allows for both custom visualization and incident management.

Answer

Cortex agent update scheduling

Answer

Physical security badge tracking

Answer

Automated code deployment

Question 6

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. XDM enables cross-source correlation and simplified query writing.

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%

Question 7

Which THREE of the following are components of a standard XSIAM detection rule?

Accepted Answer

Incident Trigger Logic. Detection rules require a query, severity, and defined action/trigger.

Answer

Physical asset location

Answer

Database schema index

Question 8

Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?

Accepted Answer

Context is the primary way to pass data between playbook tasks. The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.

Answer

Context data is automatically cleared every 24 hours

Answer

Context only supports string data types

Answer

Context data is shared between different incidents

Question 9

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 10

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 11

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 12

Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?

Accepted Answer

Incident Context. Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.

Answer

Hard-coding the context path

Answer

Database injection

Answer

Global variables

Question 13

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. Incident records provide a comprehensive view of the threat, including timeline, entities, and logs.

Answer

Employee performance reviews

Answer

Platform billing history

Question 14

Which THREE of the following represent common data sources for Cortex XSIAM?

Accepted Answer

Cloud infrastructure logs (e.g., AWS CloudTrail). XSIAM aggregates data from network, endpoint, and cloud sources.

Answer

Employee payroll database

Answer

Coffee machine diagnostic logs

Question 15

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 16

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Configuration requires network reachability, authentication, and defined ingestion rules.

Answer

Employee department codes

Answer

Physical location of the server room

Question 17

Which TWO of these are valid methods to trigger an automated playbook?

Accepted Answer

Incident Type auto-trigger. Playbooks can be triggered by incident ingestion (via Classifier) or manually by an analyst.

Answer

System boot-up

Answer

Setting a cron schedule

Answer

Browser refresh

Question 18

Which THREE factors influence the performance of playbook execution?

Accepted Answer

Script complexity. Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.

Answer

Incident display layout

Answer

User password length

Question 19

Which TWO actions are commonly performed during the 'Pre-processing' phase of incident ingestion?

Accepted Answer

Assigning a specific playbook to the incident. Pre-processing rules allow for deduplication and incident enrichment/filtering before the incident is created or assigned.

Answer

Generating a final management report

Answer

Modifying the XSOAR server configuration

Answer

Executing a manual investigation

Question 20

Which THREE types of tasks can be added to a playbook workflow?

Accepted Answer

Condition task. Playbooks support various task types including manual, automated, and condition tasks.

Answer

Database cleanup task

Answer

Encryption task