SecOps-Pro Threat Detection And Incident Response Practice Test 2 — 15 Questions

Question 1

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Accepted Answer

War Room. The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.

Answer

Summary Tab

Answer

Evidence Board

Answer

Playbook Tab

Question 2

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

Accepted Answer

Threat Log. Threat logs specifically capture information about security events identified by the NGFW security profiles.

Answer

Config Log

Answer

Traffic Log

Answer

System Log

Question 3

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 4

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Accepted Answer

Isolate Endpoint. Isolating the endpoint prevents all network communications except to the XDR console.

Answer

Delete Process

Answer

Reboot Endpoint

Answer

Disable User Account

Question 5

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Accepted Answer

Set Incident. The 'Set Incident' task in XSOAR allows for the modification of incident attributes, including status.

Answer

Incident Mapping

Answer

Close Incident

Answer

Task Assignment

Question 6

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Accepted Answer

join. The 'join' operator is used in XQL to associate events from different datasets based on common keys like host_id or user_id.

Answer

summarize

Answer

filter

Answer

dedup

Question 7

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Accepted Answer

Centralized log storage. Cortex Data Lake serves as the centralized repository for logs collected from firewalls, endpoints, and other security devices.

Answer

Network policy enforcement

Answer

Endpoint management

Answer

Automated incident response

Question 8

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Accepted Answer

BIOCs detect behaviors, IOCs detect static identifiers. BIOC rules detect sequences of actions or behaviors, while IOCs look for static identifiers like hashes.

Answer

BIOCs only apply to network logs

Answer

BIOCs are cloud-based, IOCs are endpoint-based

Answer

BIOCs block traffic, IOCs alert

Question 9

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

Accepted Answer

Identifying root cause of an event. Causality provides visual process tracing and helps identify the root cause of an alert.

Answer

Automated firewall rule creation

Answer

Managing user identity

Answer

Encrypting endpoint data

Question 10

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Accepted Answer

Indicator Extraction. Indicator Extraction or RegEx patterns within an integration/task are used to parse and structure indicator data.

Answer

Playbook Workflow

Answer

War Room Note

Answer

Incident Layout

Question 11

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Accepted Answer

NGFW threat logs. Cortex Data Lake collects logs from various sources including network firewalls and endpoint security agents.

Answer

Active Directory physical server temperature

Answer

Firewall power supply voltage

Answer

User physical badge access logs

Question 12

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Accepted Answer

Blocking a C2 IP address on the firewall. Containment focuses on stopping the spread, such as isolating endpoints or blocking malicious network traffic.

Answer

Updating system documentation

Answer

Rebuilding the infected server

Answer

Conducting a root cause analysis

Question 13

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Accepted Answer

Malicious files. The Evidence Board acts as a repository for files, screenshots, and extracted indicators collected during an investigation.

Answer

Playbook source code

Answer

System boot logs

Question 14

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Accepted Answer

Automatic email ingestion. Analysts can trigger investigations via email ingestion or manual incident creation.

Answer

Hardware power reset

Answer

Direct firewall firmware update

Answer

OS kernel patching

Question 15

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

Accepted Answer

Dynamic analysis of files. WildFire performs static analysis, dynamic analysis, and automated signature creation.

Answer

Real-time remote shell access

Answer

Firewall configuration backup