SecOps-Pro SOC Fundamentals And Operations Practice Test 4 — 15 Questions

Question 1

A SOC analyst is triaging a Cortex XDR alert for a suspicious PowerShell script execution on a server. The analyst wants to quickly determine the user account that initiated the process and the command line used. Which Cortex XDR alert detail field provides this information directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Process Execution Details. Process Execution Details is the Cortex XDR alert field that captures the command line, user account, parent process, and other metadata about the process that triggered the alert. This is exactly what the analyst needs to quickly identify who ran the script and what it did, enabling efficient triage.

Answer

Alert Name

Answer

Alert Severity

Answer

MITRE ATT&CK Technique

Question 2

A SOC analyst is investigating a potential insider threat. The analyst needs to determine whether a user accessed a sensitive file share outside of normal working hours. The organization uses Cortex XDR and has enabled the 'File and Folder' data collection. Which Cortex XDR query should the analyst run to find file access events by that user during a specific time window?

Accepted Answer

Query the 'File and Folder' dataset filtered by username and timestamp.. The 'File and Folder' dataset in Cortex XDR records file access events, including reads, writes, and deletions. By filtering on username and timestamp, the analyst can identify all file operations by that user during the specified time window. This is the most direct way to determine if the user accessed the sensitive file share outside normal hours.

Answer

Query the 'File Creation' dataset filtered by username and timestamp.

Answer

Query the 'Network Connections' dataset filtered by username and timestamp.

Answer

Query the 'Process Execution' dataset filtered by username and timestamp.

Question 3

A SOC analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious external IP address that the compromised host communicated with. To determine if other hosts in the organization have communicated with the same IP, which Cortex XDR feature should the analyst use?

Accepted Answer

Cortex XDR Query Builder. Query Builder is the correct feature because it enables a search across all endpoint network connection events for the specific external IP address. This search will return every host that communicated with that IP, allowing the analyst to identify the full scope of the incident and take appropriate containment measures on all affected endpoints.

Answer

Cortex XDR Causality Chain

Answer

Cortex XDR Threat Intelligence Module

Answer

Cortex XDR Incident Response Playbook

Question 4

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) for phishing incidents has increased over the past quarter. To improve MTTD, which operational change should the manager prioritize?

Accepted Answer

Implement automated phishing email triage and enrichment playbooks.. Automated phishing triage and enrichment playbooks streamline the detection process by automatically parsing emails, extracting indicators, and querying threat intelligence. This reduces the manual effort and time required for analysts to identify malicious emails, directly lowering MTTD. Other options either do not impact detection speed or could introduce delays if not carefully managed.

Answer

Increase the retention period for email logs in the SIEM.

Answer

Increase the number of threat intelligence feeds integrated into the SIEM.

Answer

Conduct more frequent phishing simulation exercises for employees.

Question 5

A SOC team is implementing a new detection rule in Cortex XDR to identify lateral movement via Windows Admin Shares. The rule should trigger only when a remote process creates a file on an administrative share (e.g., ADMIN$) and the source process is not a known management tool. Which Cortex XDR rule configuration element is most critical to achieve this specificity?

Accepted Answer

BIOC (Behavioral Indicator of Compromise) with process and file operation conditions. BIOC rules enable the creation of behavioral detection logic that combines multiple event types and conditions. Specifying a file creation on an administrative share and excluding known management tools via process attributes directly meets the requirement for high specificity. This approach detects lateral movement techniques like PsExec or SMB file copies while reducing noise from legitimate admin activity.

Answer

Exception policy based on user account

Answer

Analytics alert with machine learning threshold

Answer

IOC (Indicator of Compromise) with a hash of the remote process

Question 6

A SOC analyst notices that a critical alert was not generated when a known malicious IP address was contacted by an internal host. The analyst confirms that the IP is present in the threat intelligence feed and that the firewall is configured to log all traffic. Which component of the SOC's detection pipeline should the analyst investigate FIRST?

Accepted Answer

The log ingestion and normalization process. The detection pipeline relies on logs being ingested, normalized, and then correlated against threat intelligence. Since the firewall logs the traffic and the IP is in the feed, the failure likely occurs during log ingestion or normalization. Without proper parsing, the SIEM cannot match the IP against the feed, resulting in a missed alert. Thus, the analyst should first investigate the log ingestion and normalization process.

Answer

The endpoint detection and response (EDR) agent on the internal host

Answer

The threat intelligence feed update frequency

Answer

The firewall's logging configuration

Question 7

A SOC analyst is triaging a Cortex XDR alert for a suspicious PowerShell script execution on a server. The analyst wants to quickly determine the user account that initiated the process and the command line used. Which Cortex XDR alert detail field provides this information directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Causality Chain to identify the root cause process.. To effectively triage a ransomware alert, the analyst must understand both the root cause and the scope. The Causality Chain reveals how the infection occurred, while querying the file hash across all endpoints identifies other potential victims. These actions provide the necessary context to assess severity and plan containment. Other options are either response actions or do not directly aid in scoping the incident.

Answer

Initiate a live terminal session to manually delete the ransomware executable.

Answer

Isolate the endpoint immediately without further investigation.

Answer

Check the Cortex XDR Threat Intelligence module for the ransomware's reputation.

Question 8

A SOC analyst is investigating a Cortex XDR incident involving multiple alerts across several endpoints. The analyst needs to determine the initial infection vector and the sequence of events that led to the compromise. Which Cortex XDR feature should the analyst use to visualize the chronological order of alerts and related activities?

Accepted Answer

Incident Timeline. The Incident Timeline aggregates all alerts and related activities within an incident and displays them in chronological order. This allows the analyst to trace the attack from the initial infection vector through subsequent actions, such as lateral movement and data exfiltration. It is the primary tool for reconstructing multi-endpoint incidents and understanding the sequence of events.

Answer

Endpoint DLP Policy

Answer

Alert Triage View

Answer

Threat Intelligence Platform

Question 9

A SOC analyst is reviewing a SIEM alert for a possible data exfiltration. The alert shows a large outbound transfer to an unknown external IP. The analyst needs to determine if this is malicious. Which action should the analyst take NEXT to gather the most relevant context?

Accepted Answer

Identify the user and process associated with the outbound transfer. To assess whether a large outbound transfer is malicious, the analyst must first understand the context: which user and process initiated it. If it is a known backup application or an authorized user action, it may be benign. If it is an unexpected process like PowerShell or a rare executable, it warrants further investigation. Identifying the user and process provides immediate insight and guides subsequent steps, such as checking reputation or isolating the host.

Answer

Query the SIEM for all traffic from the internal host to the external IP over the past 24 hours

Answer

Isolate the internal host immediately to prevent potential data loss

Answer

Check the reputation of the external IP in threat intelligence platforms

Question 10

A SOC manager is evaluating the team's incident response process and wants to improve the efficiency of alert triage. Which TWO metrics should the manager track to identify bottlenecks in the triage phase? (Choose two.)

Accepted Answer

Mean time to acknowledge (MTTA). To identify bottlenecks in alert triage, the SOC manager should track metrics that directly reflect the triage process. Mean time to acknowledge (MTTA) measures how quickly analysts pick up alerts, highlighting delays in initial review. Alert volume per analyst shows the workload, which can indicate if analysts are overwhelmed. Together, these metrics help pinpoint whether delays are due to slow acknowledgment or excessive alert volume, enabling targeted improvements.

Answer

Percentage of false positives

Answer

Mean time to resolve (MTTR)

Answer

Mean time to detect (MTTD)

Question 11

A SOC analyst receives a phishing report from an end user. The analyst needs to quickly determine if the email is malicious. Which action should the analyst take FIRST?

Accepted Answer

Check the sender's email address and domain reputation. The first step in phishing triage is to quickly assess the sender's email address and domain reputation. This provides immediate insight into whether the email is likely malicious. If the sender is known to be malicious, the analyst can quickly escalate and take containment actions. If not, further analysis of URLs and attachments can be performed. This approach balances speed and accuracy, avoiding premature actions that could disrupt users or spread the threat.

Answer

Delete the email from the user's mailbox

Answer

Forward the email to all users as a warning

Answer

Analyze the email headers and attachments in a sandbox

Question 12

A SOC analyst is investigating a series of alerts related to unauthorized access attempts on multiple servers. The analyst suspects a coordinated attack and wants to correlate events across different log sources to identify the common attacker IP. Which Cortex XSIAM capability should the analyst use?

Accepted Answer

XQL (XSIAM Query Language) Search. XQL (XSIAM Query Language) is designed for advanced search and correlation across all data in Cortex XSIAM. By using XQL, the analyst can join and filter logs from multiple servers to pinpoint the shared attacker IP. This capability is essential for identifying coordinated attacks that span multiple systems, as it provides a unified view of disparate log sources.

Answer

Cortex XSIAM Threat Intelligence

Answer

Cortex XSIAM Automation Rules

Answer

Cortex XSIAM Cases

Question 13

A SOC analyst is documenting a security incident that involved lateral movement within the network. Which piece of information is MOST critical to include in the incident report to help future threat hunting?

Accepted Answer

The specific tools and techniques used by the attacker for lateral movement. For future threat hunting, the most valuable information is the specific tools and techniques used by the attacker, especially for lateral movement. This allows the SOC to develop targeted hunts and detection rules. For instance, if the attacker used Windows Management Instrumentation (WMI) or Server Message Block (SMB) for lateral movement, analysts can hunt for anomalous use of these protocols. Documenting TTPs aligns with frameworks like MITRE ATT&CK and enhances proactive defense.

Answer

The exact time the incident was first reported by the end user

Answer

The number of failed login attempts during the incident

Answer

The list of all users who were logged into the network at the time of the incident

Question 14

A SOC manager wants to reduce alert fatigue by automatically grouping related Cortex XDR alerts into a single incident. Which feature should the manager enable?

Accepted Answer

Alert grouping rules. Alert grouping rules are designed to automatically correlate related alerts into a single incident, which directly reduces alert fatigue by minimizing the number of separate incidents analysts must handle. This feature enables SOC teams to focus on the full context of an attack rather than isolated alerts, improving efficiency and response times.

Answer

Incident response playbooks

Answer

Threat intelligence feeds

Answer

Custom detection rules

Question 15

A SOC analyst is investigating a security incident and needs to determine the scope of a compromised user account across multiple cloud services. Which Cortex XSOAR integration should the analyst use to query user activity and correlate events from various cloud providers?

Accepted Answer

Cortex XSOAR's cloud service provider integrations (e.g., AWS, Azure, GCP). Cortex XSOAR provides native integrations for major cloud service providers, enabling analysts to query user activity logs and correlate events across multiple clouds. This allows for a comprehensive investigation of a compromised user account, identifying lateral movement or unauthorized access. The other options are either endpoint-focused or not designed for cross-cloud user activity correlation.

Answer

Cortex XDR

Answer

Palo Alto Networks Prisma Cloud

Answer

Cortex Data Lake