SecOps-Pro SOC Fundamentals And Operations Practice Test 2 — 15 Questions

Question 1

Which type of alert in Cortex XDR represents a high-confidence threat that has been automatically grouped with related events?

Accepted Answer

Incident. An Incident in Cortex XDR is a collection of related alerts that represent a single threat narrative.

Answer

Log

Answer

Indicator

Answer

Exclusion

Answer

Exception

Question 2

In Cortex XSOAR, which feature allows you to automatically create an incident when a specific email is received in a monitored inbox?

Accepted Answer

Mail Listener. The Mail Listener in Cortex XSOAR is a built-in integration that monitors a dedicated mailbox (e.g., via IMAP or Exchange Web Services) and automatically creates incidents from incoming emails. It is designed specifically for email-driven incident creation, allowing security teams to ingest alerts, phishing reports, or other email-based notifications without manual intervention. The Mail Listener continuously polls the inbox and applies parsing rules to extract relevant fields, then generates a new incident in XSOAR. This makes it the correct feature for automatically creating incidents from received emails.

Answer

Incident Classifier

Answer

Data collection rule

Answer

Automation script

Question 3

During a threat hunting mission in XDR Query Builder, you need to find all processes running from the 'temp' directory. Which XDR language is utilized?

Accepted Answer

XQL. XDR Query Language (XQL) is used for advanced hunting and data exploration in Cortex XDR.

Answer

Python

Answer

Regex

Answer

SQL

Question 4

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

Accepted Answer

Behavioral Threat Protection. The Cortex XDR agent uses Behavioral Threat Protection to stop malicious processes in real-time.

Answer

Exploit Prevention

Answer

Network Isolation

Answer

Host Insight

Question 5

What is the primary purpose of a SOC 'Daily Standup' meeting?

Accepted Answer

Operational alignment and incident status sync. The daily standup is for operational alignment, shift handovers, and discussing urgent high-priority incidents.

Answer

Technical training

Answer

Vendor management

Answer

Long-term strategy planning

Question 6

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?

Accepted Answer

User Risk. The User Investigation dashboard or User Risk view in Cortex XDR provides a consolidated view of user-linked alerts and behavioral history.

Answer

Threat Intelligence

Answer

Endpoint Status

Answer

Network Activity

Question 7

An analyst is reviewing a firewall policy. Which feature allows them to view the traffic logs that specifically match that rule?

Accepted Answer

Log Viewer. The 'Log' icon or 'View Logs' option in the policy window allows jumping directly to the logs associated with that specific rule.

Answer

Security Profile

Answer

Rule Base View

Answer

Policy Optimizer

Question 8

In XSOAR, an analyst wants to share a finding with another team member. Which feature allows for real-time collaboration within the incident workspace?

Accepted Answer

War Room. The War Room allows multiple analysts to comment, run commands, and share findings in a single collaborative interface.

Answer

Work Plan

Answer

Indicator Tab

Answer

Incident Summary

Question 9

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

Accepted Answer

Value. The Value field is the actual indicator data (for example, an IP address, domain, file hash, or URL) that Cortex XSOAR uses to perform lookups and reputation scoring. If the Value is not correctly mapped from the external feed, the indicator cannot be matched against existing data or enriched by integrations, breaking the entire feed ingestion pipeline. Indicator Type, Expiration, and Source are metadata that describe the indicator but do not drive lookup or scoring.

Answer

Indicator Type

Answer

Expiration

Answer

Indicator Source

Question 10

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Accepted Answer

Alert Exclusion. Alert Exclusion in Cortex XDR allows analysts to create exclusion rules that suppress future alerts matching specific criteria (e.g., hash, path, process, user). This is the correct mechanism to prevent a known false positive from re-triggering. It preserves detection logic while reducing noise.

Answer

Agent Uninstallation

Answer

Policy Deletion

Answer

Threat Intel Ingestion

Question 11

Which TWO of the following are key components of a mature SOC incident response plan?

Accepted Answer

Defined communication and escalation procedures. Option C is correct because a mature SOC incident response plan must specify defined communication and escalation procedures, including who is notified, through which channels, and at what severity thresholds, so incidents are escalated promptly to the right stakeholders. Option E is correct because clearly defining roles and responsibilities (for example, incident commander, SOC analysts, forensics, and legal liaisons) ensures accountability and prevents gaps or duplication during response. Automated hardware repair (A) is a maintenance or IT operations function, not an incident response planning component. A public relations policy (B) may support crisis communications but is not a core component of the SOC incident response plan itself. Budget approval workflows (D) are financial governance processes and are not part of incident response planning.

Answer

Automated hardware repair

Answer

Public relations policy

Answer

Budget approval workflows

Question 12

Which THREE roles are commonly involved in the SOC operational structure?

Accepted Answer

SOC Manager. Tier 1, Tier 2, and SOC Managers are standard components of a functional SOC team.

Answer

IT Helpdesk Lead

Answer

Sales Engineer

Question 13

Which TWO metrics are essential when evaluating the effectiveness of a SOC operational process?

Accepted Answer

Mean Time to Respond (MTTR). MTTR and MTTA are the standard industry KPIs for measuring SOC operational efficiency and success.

Answer

Total number of employees

Answer

Annual hardware expenditure

Answer

Total number of emails sent

Question 14

Which THREE methods can be used in Cortex XSOAR to ingest indicators?

Accepted Answer

Manual entry via the UI. Option B (Manual entry via the UI) is correct because Cortex XSOAR allows analysts to create indicators directly through the Indicators page or the indicator creation form, populating fields such as indicator type, value, and reputation. Option C (Auto-extraction from incidents) is correct because XSOAR can automatically extract indicators from incident artifacts, evidence, and task outputs using indicator extraction rules and the built-in extractIndicators command, then push them into the indicators database. Option D (Integrated threat intelligence feeds) is correct because XSOAR supports ingesting indicators from external TI sources via integrations and feed configurations (e.g., TIM feeds, threat intel management), which fetch and store indicators on a schedule. Option A (Direct database SQL injection) is not a supported ingestion method and is a security attack, not a feature. Option E (Hardware port mirroring) is a network capture technique and is unrelated to how XSOAR ingests indicators.

Answer

Direct database SQL injection

Answer

Hardware port mirroring

Question 15

Which THREE actions can be performed directly from the Cortex XDR incident details page?

Accepted Answer

Isolate the endpoint. Cortex XDR allows analysts to isolate hosts, retrieve files, and initiate remote scans directly from the incident view.

Answer

Reset the user's password

Answer

Update firewall OS