SecOps-Pro Threat Detection And Incident Response — All Questions With Answers

Question 1mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?

Question 2mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When investigating a compromise, you find an artifact in XSOAR. To gather more context about this file without leaving the platform, which integration should be utilized?

Question 3hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

Question 4hardmultiple choice

Read the full Ansible explanation →

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Question 5mediummulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is building an XQL query in Cortex XDR to hunt for lateral movement via remote service creation. The analyst needs to correlate process execution on a source host with the corresponding logon activity on a destination host. (Choose two.)

Question 6mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating an alert where a user's endpoint executed a renamed version of psexec.exe (now called svc_host.exe) that spawned a cmd.exe child process and wrote a service binary to C:\Windows\Temp. The analyst wants to enrich the investigation by automatically identifying other endpoints in the environment that exhibited the same sequence of behaviors, not just the same file hash. Which Cortex XDR capability should the analyst use to pivot from this alert to related activity across all endpoints?

Question 7hardmulti select

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator is configuring a BIOC (Behavioral Indicator of Compromise) rule to detect credential dumping activity on endpoints. The administrator wants to ensure the rule triggers only when specific conditions are met. Which two of the following are valid components that can be used in a BIOC rule definition? (Choose two.)

Question 8mediummulti select

Read the full Ansible explanation →

An analyst is configuring a Cortex XSOAR playbook to automate the response to a phishing incident. The playbook needs to extract indicators from the reported email, enrich them, and then take appropriate actions. Which two steps should the analyst include to ensure that malicious indicators are blocked across integrated security tools? (Choose two.)

Question 9hardmultiple choice

Read the full DNS explanation →

During an incident investigation, an analyst observes that a compromised endpoint is communicating with a command-and-control (C2) server using DNS tunneling. The analyst wants to block this communication and prevent further data exfiltration. Which Cortex XDR action should the analyst take to immediately stop the C2 traffic while allowing the endpoint to continue other business-critical communications?

Question 10hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR playbook is configured to automatically enrich incidents with threat intelligence from multiple sources. During an investigation, an analyst notices that the playbook fails to execute the enrichment tasks for a specific incident. Which of the following is the most likely cause?

Question 11mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Question 12easymultiple choice

Read the full Threat Detection And Incident Response explanation →

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Question 13hardmultiple choice

Read the full Ansible explanation →

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Question 14easymultiple choice

Read the full Ansible explanation →

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Question 15mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Question 16hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Question 17hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Question 18mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Question 19easymultiple choice

Read the full Threat Detection And Incident Response explanation →

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Question 20easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Question 21hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

Question 22mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Question 23easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Question 24easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

Question 25hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Question 26mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Question 27mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Question 28easymultiple choice

Read the full Threat Detection And Incident Response explanation →

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Question 29mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Question 30mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

Question 31hardmultiple choice

Read the full Ansible explanation →

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Question 32mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Question 33mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Question 34hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Question 35mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Question 36hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

Question 37mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

Question 38hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Question 39hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Question 40hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

Question 41hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator needs to ensure that a newly created custom BIOC rule is evaluated against endpoint activity in real time without waiting for the next scheduled rule refresh. The rule must also be able to reference the parent process of the triggering event. Which combination of rule configuration choices should the administrator make?

Question 42mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst notices that a single endpoint generated over 200 alerts in the last hour, all tied to the same parent process tree and the same remote IP. The analyst wants to reduce analyst fatigue while preserving the full investigation timeline. Which Cortex XDR capability should the analyst use to consolidate these related alerts?

Question 43mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

Question 44hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

During an investigation, a Cortex XDR analyst needs to determine whether a suspicious PowerShell process was spawned by a known-good parent such as explorer.exe or by a malicious macro-enabled document. The analyst wants to visualize the full chain of process creation events leading to the alert. Which Cortex XDR feature should the analyst use?

Question 45hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious process on an endpoint that is communicating with an external IP address. To determine the full scope of the incident, the analyst needs to retrieve all network connections initiated by that process and any child processes. Which Cortex XDR action should the analyst take to efficiently gather this information?

Question 46easymultiple choice

Read the full Threat Detection And Incident Response explanation →

During an active incident, a Cortex XDR analyst wants to stop a compromised endpoint from communicating with a known command-and-control server while still allowing the rest of the SOC to collect forensic evidence from the host. Which Cortex XDR response action should the analyst use?

Question 47mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Question 48mediummulti select

Read the full Ansible explanation →

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Question 49hardmulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Question 50easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SecOps analyst receives an alert indicating a possible credential dumping attempt on a Windows server. The analyst wants to quickly determine which user account initiated the suspicious process and what other commands were run in the same session. Which Cortex XDR data source should the analyst query?

Question 51mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Question 52hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating a series of alerts across multiple endpoints that appear to be part of a coordinated attack. The analyst wants to identify the common root cause and see how the attack spread from the initial endpoint to others. Which Cortex XDR capability provides this cross-endpoint correlation?

Question 53hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious outbound connection from a server to an unknown external IP. To determine if this connection is part of a larger attack, the analyst wants to see all other endpoints that communicated with the same external IP within the last 24 hours. Which Cortex XDR query should the analyst run?

Question 54mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR playbook is triggered by a phishing incident. The playbook automatically extracts indicators from the email and enriches them using threat intelligence integrations. The analyst wants to ensure that any malicious URLs found are blocked on the next-generation firewall (NGFW) and that the incident is documented. Which XSOAR feature should the analyst use to automatically push the malicious URLs to the NGFW block list?

Question 55mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR analyst is building a playbook to automate the response to phishing incidents. The playbook must extract indicators from the reported email, check their reputation against integrated threat intelligence sources, and then decide whether to block the sender domain or close the incident as benign. Which type of XSOAR task should the analyst use to perform the reputation check?

Question 56mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR analyst is designing a playbook that must automatically enrich every new phishing alert by querying VirusTotal, then create a ticket in ServiceNow only when the verdict is malicious. Which playbook construct should the analyst use to branch execution based on the enrichment verdict?

Question 57hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst notices an endpoint generating a high volume of process creation events that match a known attack pattern, but the pattern is not tied to any file hash or network indicator. The analyst wants Cortex XDR to alert on this behaviour automatically in the future without creating a signature-based rule. Which Cortex XDR capability should the analyst use?

Question 58hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

Question 59mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC manager wants to ensure that during a major incident, all analysts see the same set of indicators, tasks, and investigation findings without duplicating effort across shifts. Which Cortex XSOAR feature should the manager rely on to provide this shared investigation workspace?

Question 60easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC analyst receives a Cortex XDR alert indicating that a workstation attempted to contact a domain associated with a known malware family. The analyst confirms the domain is malicious and wants to prevent any further communication from the endpoint to that domain while keeping the endpoint online for continued investigation. Which Cortex XDR response action should the analyst take?

Question 61hardmulti select

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Question 62easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC analyst receives an alert from Cortex XDR indicating that a known malicious hash was executed on an endpoint. The analyst wants to quickly determine if this hash has been seen on other endpoints in the organization and what processes were involved. Which Cortex XDR feature provides a centralized view of all endpoint events related to a specific indicator?

Question 63mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

During a Cortex XDR investigation, an analyst notices that a single suspicious process spawned multiple child processes, created several files, and made outbound network connections over a short period. The analyst wants to preserve the entire set of related events and artifacts as a single unit so that other team members can review the full context rather than individual alerts. Which Cortex XDR feature should the analyst use to group these related events into one reviewable entity?

Question 64mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is reviewing a Cortex XDR alert where a user's credentials were used to authenticate from an IP address in a foreign country, but the user is known to be on a business trip in that country. The analyst wants to determine whether this is a true positive or a false positive. Which Cortex XDR feature should the analyst use to correlate this authentication event with other activity from the same user and endpoint over time?

Question 65hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security analyst is investigating a potential data exfiltration incident. They have identified a suspicious process on an endpoint that is making outbound connections to an unknown IP address. The analyst wants to determine the parent process that spawned this suspicious process and the command line arguments used. Which Cortex XDR data source should the analyst query to obtain this information?

Question 66easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst receives an alert about a suspicious PowerShell script execution on a user's workstation. The analyst wants to quickly determine if this script has been seen in the environment before and if it is associated with any known threats. Which Cortex XDR feature should the analyst use to search for the script's hash across the environment and threat intelligence?

Question 67mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating a security incident where an attacker used RDP to move laterally from a compromised workstation to a server. The analyst wants to create a BIOC rule to detect future RDP lateral movement attempts. Which of the following XQL queries would best accomplish this?

Question 68mediummulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a Windows endpoint. The process is powershell.exe with a command line that includes 'Invoke-Expression' and a Base64-encoded string. The analyst wants to gather additional context to determine if this is malicious. Which two actions should the analyst take next? (Choose two.)

Question 69easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XSOAR analyst is creating a new incident type for phishing reports. The analyst wants to ensure that the incident includes predefined fields for the sender's email address, the subject line, and the list of recipients. Which feature in Cortex XSOAR should the analyst use to define these fields?

Question 1mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?

Question 2mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When investigating a compromise, you find an artifact in XSOAR. To gather more context about this file without leaving the platform, which integration should be utilized?

Question 3hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

Question 4hardmultiple choice

Read the full Ansible explanation →

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Question 5mediummulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is building an XQL query in Cortex XDR to hunt for lateral movement via remote service creation. The analyst needs to correlate process execution on a source host with the corresponding logon activity on a destination host. (Choose two.)

Question 6mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating an alert where a user's endpoint executed a renamed version of psexec.exe (now called svc_host.exe) that spawned a cmd.exe child process and wrote a service binary to C:\Windows\Temp. The analyst wants to enrich the investigation by automatically identifying other endpoints in the environment that exhibited the same sequence of behaviors, not just the same file hash. Which Cortex XDR capability should the analyst use to pivot from this alert to related activity across all endpoints?

Question 7hardmulti select

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator is configuring a BIOC (Behavioral Indicator of Compromise) rule to detect credential dumping activity on endpoints. The administrator wants to ensure the rule triggers only when specific conditions are met. Which two of the following are valid components that can be used in a BIOC rule definition? (Choose two.)

Question 8mediummulti select

Read the full Ansible explanation →

An analyst is configuring a Cortex XSOAR playbook to automate the response to a phishing incident. The playbook needs to extract indicators from the reported email, enrich them, and then take appropriate actions. Which two steps should the analyst include to ensure that malicious indicators are blocked across integrated security tools? (Choose two.)

Question 9hardmultiple choice

Read the full DNS explanation →

During an incident investigation, an analyst observes that a compromised endpoint is communicating with a command-and-control (C2) server using DNS tunneling. The analyst wants to block this communication and prevent further data exfiltration. Which Cortex XDR action should the analyst take to immediately stop the C2 traffic while allowing the endpoint to continue other business-critical communications?

Question 10hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR playbook is configured to automatically enrich incidents with threat intelligence from multiple sources. During an investigation, an analyst notices that the playbook fails to execute the enrichment tasks for a specific incident. Which of the following is the most likely cause?

Question 11mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Question 12easymultiple choice

Read the full Threat Detection And Incident Response explanation →

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Question 13hardmultiple choice

Read the full Ansible explanation →

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Question 14easymultiple choice

Read the full Ansible explanation →

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Question 15mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Question 16hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Question 17hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Question 18mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Question 19easymultiple choice

Read the full Threat Detection And Incident Response explanation →

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Question 20easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Question 21hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

Question 22mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Question 23easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Question 24easymultiple choice

Read the full Threat Detection And Incident Response explanation →

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

Question 25hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Question 26mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Question 27mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Question 28easymultiple choice

Read the full Threat Detection And Incident Response explanation →

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Question 29mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Question 30mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

Question 31hardmultiple choice

Read the full Ansible explanation →

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Question 32mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Question 33mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Question 34hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Question 35mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Question 36hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

Question 37mediummulti select

Read the full Threat Detection And Incident Response explanation →

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

Question 38hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Question 39hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Question 40hardmulti select

Read the full Threat Detection And Incident Response explanation →

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

Question 41hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator needs to ensure that a newly created custom BIOC rule is evaluated against endpoint activity in real time without waiting for the next scheduled rule refresh. The rule must also be able to reference the parent process of the triggering event. Which combination of rule configuration choices should the administrator make?

Question 42mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst notices that a single endpoint generated over 200 alerts in the last hour, all tied to the same parent process tree and the same remote IP. The analyst wants to reduce analyst fatigue while preserving the full investigation timeline. Which Cortex XDR capability should the analyst use to consolidate these related alerts?

Question 43mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

Question 44hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

During an investigation, a Cortex XDR analyst needs to determine whether a suspicious PowerShell process was spawned by a known-good parent such as explorer.exe or by a malicious macro-enabled document. The analyst wants to visualize the full chain of process creation events leading to the alert. Which Cortex XDR feature should the analyst use?

Question 45hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious process on an endpoint that is communicating with an external IP address. To determine the full scope of the incident, the analyst needs to retrieve all network connections initiated by that process and any child processes. Which Cortex XDR action should the analyst take to efficiently gather this information?

Question 46easymultiple choice

Read the full Threat Detection And Incident Response explanation →

During an active incident, a Cortex XDR analyst wants to stop a compromised endpoint from communicating with a known command-and-control server while still allowing the rest of the SOC to collect forensic evidence from the host. Which Cortex XDR response action should the analyst use?

Question 47mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Question 48mediummulti select

Read the full Ansible explanation →

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Question 49hardmulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Question 50easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SecOps analyst receives an alert indicating a possible credential dumping attempt on a Windows server. The analyst wants to quickly determine which user account initiated the suspicious process and what other commands were run in the same session. Which Cortex XDR data source should the analyst query?

Question 51mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Question 52hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating a series of alerts across multiple endpoints that appear to be part of a coordinated attack. The analyst wants to identify the common root cause and see how the attack spread from the initial endpoint to others. Which Cortex XDR capability provides this cross-endpoint correlation?

Question 53hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious outbound connection from a server to an unknown external IP. To determine if this connection is part of a larger attack, the analyst wants to see all other endpoints that communicated with the same external IP within the last 24 hours. Which Cortex XDR query should the analyst run?

Question 54mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR playbook is triggered by a phishing incident. The playbook automatically extracts indicators from the email and enriches them using threat intelligence integrations. The analyst wants to ensure that any malicious URLs found are blocked on the next-generation firewall (NGFW) and that the incident is documented. Which XSOAR feature should the analyst use to automatically push the malicious URLs to the NGFW block list?

Question 55mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR analyst is building a playbook to automate the response to phishing incidents. The playbook must extract indicators from the reported email, check their reputation against integrated threat intelligence sources, and then decide whether to block the sender domain or close the incident as benign. Which type of XSOAR task should the analyst use to perform the reputation check?

Question 56mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR analyst is designing a playbook that must automatically enrich every new phishing alert by querying VirusTotal, then create a ticket in ServiceNow only when the verdict is malicious. Which playbook construct should the analyst use to branch execution based on the enrichment verdict?

Question 57hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst notices an endpoint generating a high volume of process creation events that match a known attack pattern, but the pattern is not tied to any file hash or network indicator. The analyst wants Cortex XDR to alert on this behaviour automatically in the future without creating a signature-based rule. Which Cortex XDR capability should the analyst use?

Question 58hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

Question 59mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC manager wants to ensure that during a major incident, all analysts see the same set of indicators, tasks, and investigation findings without duplicating effort across shifts. Which Cortex XSOAR feature should the manager rely on to provide this shared investigation workspace?

Question 60easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC analyst receives a Cortex XDR alert indicating that a workstation attempted to contact a domain associated with a known malware family. The analyst confirms the domain is malicious and wants to prevent any further communication from the endpoint to that domain while keeping the endpoint online for continued investigation. Which Cortex XDR response action should the analyst take?

Question 61hardmulti select

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

Question 62easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A SOC analyst receives an alert from Cortex XDR indicating that a known malicious hash was executed on an endpoint. The analyst wants to quickly determine if this hash has been seen on other endpoints in the organization and what processes were involved. Which Cortex XDR feature provides a centralized view of all endpoint events related to a specific indicator?

Question 63mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

During a Cortex XDR investigation, an analyst notices that a single suspicious process spawned multiple child processes, created several files, and made outbound network connections over a short period. The analyst wants to preserve the entire set of related events and artifacts as a single unit so that other team members can review the full context rather than individual alerts. Which Cortex XDR feature should the analyst use to group these related events into one reviewable entity?

Question 64mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

An analyst is reviewing a Cortex XDR alert where a user's credentials were used to authenticate from an IP address in a foreign country, but the user is known to be on a business trip in that country. The analyst wants to determine whether this is a true positive or a false positive. Which Cortex XDR feature should the analyst use to correlate this authentication event with other activity from the same user and endpoint over time?

Question 65hardmultiple choice

Read the full Threat Detection And Incident Response explanation →

A security analyst is investigating a potential data exfiltration incident. They have identified a suspicious process on an endpoint that is making outbound connections to an unknown IP address. The analyst wants to determine the parent process that spawned this suspicious process and the command line arguments used. Which Cortex XDR data source should the analyst query to obtain this information?

Question 66easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A security operations center (SOC) analyst receives an alert about a suspicious PowerShell script execution on a user's workstation. The analyst wants to quickly determine if this script has been seen in the environment before and if it is associated with any known threats. Which Cortex XDR feature should the analyst use to search for the script's hash across the environment and threat intelligence?

Question 67mediummultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XDR analyst is investigating a security incident where an attacker used RDP to move laterally from a compromised workstation to a server. The analyst wants to create a BIOC rule to detect future RDP lateral movement attempts. Which of the following XQL queries would best accomplish this?

Question 68mediummulti select

Read the full Threat Detection And Incident Response explanation →

A SOC analyst is reviewing a Cortex XDR alert for a suspicious process execution on a Windows endpoint. The process is powershell.exe with a command line that includes 'Invoke-Expression' and a Base64-encoded string. The analyst wants to gather additional context to determine if this is malicious. Which two actions should the analyst take next? (Choose two.)

Question 69easymultiple choice

Read the full Threat Detection And Incident Response explanation →

A Cortex XSOAR analyst is creating a new incident type for phishing reports. The analyst wants to ensure that the incident includes predefined fields for the sender's email address, the subject line, and the list of recipients. Which feature in Cortex XSOAR should the analyst use to define these fields?