SecOps-Pro SOC Fundamentals And Operations Practice Test 3 — 15 Questions

Question 1

Which TWO actions are considered 'Best Practices' for maintaining SOC operational documentation?

Accepted Answer

Maintain clear version control. Option D (Maintain clear version control) is correct because SOC runbooks, playbooks, and escalation procedures change as tools, threats, and personnel evolve, so version control ensures responders always work from the current approved revision and can trace what changed and why. Option E (Regular review and update cycles) is correct because scheduled reviews keep documentation aligned with current detection rules, contact lists, tooling, and compliance requirements, preventing stale procedures from degrading incident response. Options A, B, and C are not best practices: printed-only binders are hard to update and search, restricting access to the manager only creates a bottleneck and single point of failure during incidents, and creating documentation only once guarantees it becomes outdated as the environment changes.

Answer

Store only in printed binders

Answer

Limit access to the manager only

Answer

Create documentation only once

Question 2

Which TWO data sources should a SOC analyst correlate to identify a compromised user account?

Accepted Answer

Authentication logs. Correlating authentication logs and endpoint process logs provides a holistic view of user identity compromise.

Answer

Printer hardware logs

Answer

Physical building access logs

Answer

Cafeteria transaction logs

Question 3

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

Accepted Answer

Cortex XSOAR. Cortex provides XDR for detection, XSOAR for automation, and Data Lake for log aggregation.

Answer

GlobalProtect Enterprise

Answer

Panorama Policy Creator

Question 4

Which TWO types of logs are critical for investigating a potential data exfiltration event?

Accepted Answer

Traffic logs. Traffic logs and file access/system logs are necessary to reconstruct data exfiltration movements.

Answer

Printer configuration logs

Answer

Power management logs

Answer

Room temperature logs

Question 5

Which THREE items should be included in a standard SOC shift-handover report?

Accepted Answer

Status of high-priority incidents. High-priority incidents, pending action items, and known issues are essential for a smooth shift transition.

Answer

Entire network configuration file

Answer

Personal employee performance reviews

Question 6

A Cortex XDR incident is auto-closed by the SOC's 'Malware Containment' playbook after the endpoint agent quarantines a suspicious executable. Three days later, threat intel confirms the file hash is a known ransomware dropper that had already established persistence via a scheduled task. Which SOC operational gap does this scenario most directly expose?

Accepted Answer

The playbook lacks a post-containment verification step to confirm no persistence mechanisms survived remediation.. The incident was closed because the malware was quarantined, but the adversary's scheduled-task persistence was never checked or removed. Effective SOC operations require playbooks to verify full eradication of persistence before closure, not just the success of a single containment action. The gap is a missing post-containment verification step, which allowed a known ransomware dropper to remain active on the endpoint.

Answer

Threat intel feeds were not integrated with the case management system, so the hash was unknown at triage time.

Answer

The SOC's shift-handover process did not escalate the incident to a senior analyst within the required SLA window.

Answer

The endpoint agent failed to report the quarantine action to Cortex XDR, so the incident record is incomplete.

Question 7

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a critical server. To determine if the activity is malicious, the analyst needs to examine the full process lineage and associated network connections. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize the relationships between processes, files, and network connections, enabling analysts to trace the root cause of an alert. It provides the necessary context to determine if a process execution is part of a malicious chain, making it the correct tool for this scenario.

Answer

Policy Audit

Answer

Incident Timeline

Answer

Threat Intelligence

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which files were accessed and transferred to an external IP address. Which Cortex XDR data source should the analyst query to obtain this information?

Accepted Answer

Endpoint Data. Endpoint Data in Cortex XDR captures granular file and process activity, including file access and network connections. By querying this data, the analyst can link file reads to outbound connections to external IPs, providing the necessary evidence of data exfiltration.

Answer

Network Traffic Logs

Answer

Authentication Logs

Answer

DNS Logs

Question 9

A SOC analyst receives an alert from Cortex XDR indicating that a process on a finance workstation attempted to write to a suspicious registry key commonly associated with persistence. The analyst needs to quickly determine if this activity is part of a known benign software update or a true threat. Which Cortex XDR feature should the analyst use to gain immediate context about the process and its behavior?

Accepted Answer

Causality Chain. The Causality Chain is a core Cortex XDR investigation feature that reconstructs the sequence of events leading to an alert. By viewing the parent-child process relationships and command lines, the analyst can quickly assess whether the registry write is from a trusted updater or an attacker. This directly addresses the need for immediate context about the process and its behavior.

Answer

Threat Intelligence Platform

Answer

Vulnerability Assessment Scan

Answer

Endpoint DLP Policy

Question 10

A Tier 1 analyst at a healthcare SOC receives a Cortex XDR alert for 'Behavioral Threat detected' on a nurse's workstation. The alert details show a process tree where winword.exe spawned powershell.exe with an encoded command. The analyst's playbook states that all 'Behavioral Threat' alerts must be triaged within 15 minutes. What is the FIRST action the analyst should take according to standard SOC triage procedures?

Accepted Answer

Review the alert details, including the process tree and command line, to validate the alert.. The correct first action is to validate the alert by reviewing the process tree and command line. This step confirms whether the activity is malicious, such as a malware download or execution, or benign. Only after validation should containment or escalation occur. This aligns with standard SOC triage procedures and avoids unnecessary disruption.

Answer

Escalate the alert to Tier 2 immediately without further investigation.

Answer

Immediately isolate the endpoint using the Cortex XDR isolate endpoint action.

Answer

Close the alert as a false positive because Word can legitimately spawn PowerShell.

Question 11

A SOC analyst is reviewing the daily dashboard in Cortex XDR and notices a high number of 'Benign' severity alerts. To reduce alert fatigue and focus on critical threats, which action should the analyst take?

Accepted Answer

Create a custom alert exclusion rule to filter out Benign alerts.. Creating a custom alert exclusion rule for Benign severity alerts is the most effective way to reduce noise without losing critical detection coverage. This targeted approach allows the SOC to suppress only the non-actionable alerts while continuing to monitor for higher-severity threats. It also aligns with operational efficiency and helps maintain analyst focus on incidents that truly require investigation.

Answer

Disable the specific detection rule that generates the Benign alerts.

Answer

Assign the Benign alerts to a junior analyst for manual review.

Answer

Increase the severity threshold for all alerts to 'Medium' or higher.

Question 12

A SOC manager is designing a new operational process for handling advanced persistent threats (APTs) that span multiple weeks. The process must ensure that analysts can track the full scope of the campaign and coordinate response efforts across shifts. Which TWO Cortex XDR features should be integrated into this process to meet these requirements? (Choose two.)

Accepted Answer

Incident notes and collaboration features within the incident view. Incident grouping consolidates related alerts into a single case, providing a holistic view of the APT campaign. Incident notes and collaboration features enable analysts to document and share findings across shifts, ensuring continuity. Together, these features support tracking the full scope and coordinating response efforts over extended periods.

Answer

Endpoint isolation policy applied to all affected endpoints

Answer

Custom dashboards with widgets for alert trends and analyst workload

Answer

Automated playbook execution for each alert without grouping

Question 13

A SOC analyst is investigating a suspected data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 30 days. The organization uses Cortex XDR with Cortex Data Lake for log retention. Which Cortex XDR query should the analyst use to search for network connections to that IP?

Accepted Answer

Use the Cortex XDR Query Builder and select the 'Network Connections' dataset, filtering by remote IP address.. The correct approach is to use the Cortex XDR Query Builder to search the Network Connections dataset for the malicious IP. This leverages Cortex Data Lake's retained logs to identify all internal hosts that communicated with the IP over the past 30 days. This method is efficient and provides historical context necessary for scoping the incident.

Answer

Use the Cortex XSOAR incident timeline to search for the IP address.

Answer

Run a Cortex XDR script on all endpoints to check active network connections.

Answer

Check the Cortex XDR alert table for any alerts mentioning the IP address.

Question 14

A SOC analyst is reviewing a Cortex XDR incident that involves a suspicious PowerShell script execution on multiple endpoints. The analyst wants to determine the scope of the compromise by identifying all endpoints where the same script was executed. Which Cortex XDR feature should the analyst use?

Accepted Answer

Query Builder with XQL. Query Builder with XQL is the correct tool because it enables the analyst to search across all endpoints for the specific PowerShell script execution, using fields like process name, command line, and file hash. This broad search reveals all affected endpoints, allowing the analyst to scope the incident accurately and take remediation actions on every compromised host.

Answer

Incident Widgets

Answer

Causality Chain

Answer

Threat Intelligence Module

Question 15

A SOC analyst at a financial institution receives an alert from Cortex XSIAM indicating a possible data exfiltration attempt. The analyst needs to quickly determine which internal host initiated the connection and which external IP it communicated with. Which Cortex XSIAM feature should the analyst use to visualize this relationship?

Accepted Answer

Cortex XSIAM Incident Graph. The Incident Graph in Cortex XSIAM is designed to provide a visual, interactive map of all entities and their relationships within an incident. For a data exfiltration alert, this allows the analyst to immediately see the internal host and the external IP it connected to, along with any other related artifacts. This accelerates triage and supports informed decision-making.

Answer

Cortex XSIAM Query Builder

Answer

Cortex XSIAM Automation Rules

Answer

Cortex XSIAM Threat Intelligence Management