SecOps-Pro SOC Fundamentals And Operations Practice Test 2 — 15 Questions

Question 1

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

Accepted Answer

Behavioral Threat Protection. The Cortex XDR agent uses Behavioral Threat Protection to stop malicious processes in real-time.

Answer

Exploit Prevention

Answer

Network Isolation

Answer

Host Insight

Question 2

What is the primary purpose of a SOC 'Daily Standup' meeting?

Accepted Answer

Operational alignment and incident status sync. The daily standup is for operational alignment, shift handovers, and discussing urgent high-priority incidents.

Answer

Technical training

Answer

Vendor management

Answer

Long-term strategy planning

Question 3

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?

Accepted Answer

User Risk. The User Investigation dashboard or User Risk view in Cortex XDR provides a consolidated view of user-linked alerts and behavioral history.

Answer

Threat Intelligence

Answer

Endpoint Status

Answer

Network Activity

Question 4

An analyst is reviewing a firewall policy. Which feature allows them to view the traffic logs that specifically match that rule?

Accepted Answer

Log Viewer. The 'Log' icon or 'View Logs' option in the policy window allows jumping directly to the logs associated with that specific rule.

Answer

Security Profile

Answer

Rule Base View

Answer

Policy Optimizer

Question 5

In XSOAR, an analyst wants to share a finding with another team member. Which feature allows for real-time collaboration within the incident workspace?

Accepted Answer

War Room. The War Room allows multiple analysts to comment, run commands, and share findings in a single collaborative interface.

Answer

Work Plan

Answer

Indicator Tab

Answer

Incident Summary

Question 6

Which SOC operational document defines the service level objectives (SLOs) for incident response times?

Accepted Answer

SLA. An SLA (Service Level Agreement) is the primary document defining response time requirements.

Answer

Runbook

Answer

Security Policy

Answer

Playbook

Question 7

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

Accepted Answer

Value. The 'Value' field is the primary indicator identifier that must be mapped for reputation and lookup services to function.

Answer

Indicator Type

Answer

Expiration

Answer

Indicator Source

Question 8

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Accepted Answer

Alert Exclusion. Alert Exclusions allow you to define criteria to suppress specific alerts based on process, user, or hash.

Answer

Agent Uninstallation

Answer

Policy Deletion

Answer

Threat Intel Ingestion

Question 9

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Roles and responsibilities and communication plans are fundamental to structured incident response.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 10

Which THREE roles are commonly involved in the SOC operational structure?

Accepted Answer

SOC Manager. Tier 1, Tier 2, and SOC Managers are standard components of a functional SOC team.

Answer

IT Helpdesk Lead

Answer

Sales Engineer

Question 11

Which TWO metrics are essential when evaluating the effectiveness of a SOC operational process?

Accepted Answer

Mean Time to Respond (MTTR). MTTR and MTTA are the standard industry KPIs for measuring SOC operational efficiency and success.

Answer

Total number of employees

Answer

Annual hardware expenditure

Answer

Total number of emails sent

Question 12

Which THREE methods can be used in Cortex XSOAR to ingest indicators?

Accepted Answer

Manual entry via the UI. Cortex XSOAR supports automated ingestion through threat feeds, manual entry, and incident extraction.

Answer

Direct database SQL injection

Answer

Hardware port mirroring

Question 13

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS

Question 14

Which TWO actions are considered 'Best Practices' for maintaining SOC operational documentation?

Accepted Answer

Maintain clear version control. Keeping documentation updated and version-controlled is critical to ensure it remains relevant.

Answer

Store only in printed binders

Answer

Limit access to the manager only

Answer

Create documentation only once

Question 15

Which TWO data sources should a SOC analyst correlate to identify a compromised user account?

Accepted Answer

Authentication logs. Correlating authentication logs and endpoint process logs provides a holistic view of user identity compromise.

Answer

Printer hardware logs

Answer

Physical building access logs

Answer

Cafeteria transaction logs