SecOps-Pro Threat Detection And Incident Response Practice Test 2 — 15 Questions

Question 1

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vulnerability Protection Profile. SMB is a file-sharing protocol that carries exploit attempts, malware payloads, and lateral movement tools like PsExec and EternalBlue. The Vulnerability Protection Profile in PAN-OS inspects traffic for known exploits, including SMB-based attacks (e.g., MS17-010), and can block or alert on them. Applying it to the security policy ensures SMB sessions are scanned for malicious patterns at the application layer.

Answer

DoS Protection Profile

Answer

URL Filtering Profile

Answer

File Blocking Profile

Question 2

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Accepted Answer

Custom URL Category. In PAN-DB (Palo Alto Networks URL database), custom URL categories are the object used to define lists of URLs/domains that can be referenced in security policies. To block a C2 domain globally across all Panorama-managed firewalls, you create or update a custom URL category containing the domain, then reference it in a security policy rule pushed from Panorama to all managed devices.

Answer

Application Override

Answer

Security Policy Action

Answer

Threat ID

Question 3

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Accepted Answer

XQL Search. XQL (XDR Query Language) allows for cross-source searching and correlation.

Answer

Incident Forensics

Answer

SQL Query Builder

Answer

Log Parser

Question 4

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Accepted Answer

Threat intelligence and hunting. AutoFocus is a threat intelligence service that provides context and hunting capabilities for threats.

Answer

Endpoint isolation

Answer

Log storage

Answer

Automated firewall rule creation

Question 5

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Accepted Answer

Detection and Analysis. The Detection and Analysis stage focuses on confirming that an incident occurred.

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 6

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

Accepted Answer

WildFire Sandbox. WildFire Sandbox is the feature that performs automated sandboxing and analysis of suspicious executable files to derive new threat intelligence. It executes files in a virtual environment, observes behavior, and generates signatures and reports. This is specifically designed for analyzing custom encryption C2 and other evasive threats.

Answer

App-ID database

Answer

AutoFocus

Answer

Threat Vault

Question 7

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Accepted Answer

Incident Stitching. Cortex XDR uses Incident Stitching to group related alerts based on causality and common indicators.

Answer

Alert Correlation Policy

Answer

Query Aggregation

Answer

BIOC Rule Grouping

Question 8

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?

Accepted Answer

War Room. The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.

Answer

Summary Tab

Answer

Evidence Board

Answer

Playbook Tab

Question 9

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

Accepted Answer

Threat Log. Threat logs specifically capture information about security events identified by the NGFW security profiles.

Answer

Config Log

Answer

Traffic Log

Answer

System Log

Question 10

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

Accepted Answer

Forensic Collection. The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.

Answer

Endpoint isolation

Answer

Snapshot Manager

Answer

Live Terminal

Question 11

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Accepted Answer

Isolate Endpoint. Isolating the endpoint in Cortex XDR immediately cuts off all network communication (except to the Cortex XDR management console) while preserving the endpoint's state for forensic investigation. This prevents lateral movement by the attacker while allowing analysts to investigate without the risk of the attacker pivoting to other systems.

Answer

Delete Process

Answer

Reboot Endpoint

Answer

Disable User Account

Question 12

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

Accepted Answer

join. The 'join' operator in XQL is used to correlate distinct event types by matching on a common field (e.g., username or host) across two datasets, which is exactly what is needed to link successful logins with subsequent suspicious process starts. It combines records from separate queries based on a join condition, enabling cross-event correlation. This makes 'join' the correct operator for correlating logins and process events.

Answer

summarize

Answer

filter

Answer

dedup

Question 13

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

Accepted Answer

Centralized log storage. Cortex Data Lake serves as the centralized repository for logs collected from firewalls, endpoints, and other security devices.

Answer

Network policy enforcement

Answer

Endpoint management

Answer

Automated incident response

Question 14

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

Accepted Answer

BIOCs detect behaviors, IOCs detect static identifiers. BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR detect malicious behaviors — sequences of actions like process injection, credential dumping, or lateral movement — rather than static artifacts. IOCs (Indicators of Compromise) are static identifiers such as file hashes, IP addresses, domains, or registry keys that are matched against telemetry. This behavioral vs. static distinction is the core difference and makes option A correct.

Answer

BIOCs only apply to network logs

Answer

BIOCs are cloud-based, IOCs are endpoint-based

Answer

BIOCs block traffic, IOCs alert

Question 15

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

Accepted Answer

Identifying root cause of an event. Option B is correct because Cortex XDR's Causality engine correlates alerts and telemetry across endpoints, networks, and clouds to trace an alert back to its originating root cause rather than treating each alert in isolation. Option E is correct because Causality builds a causal chain (the causality graph) that visualizes process lineage — parent-child process relationships, file and registry operations, and network connections — so analysts can see exactly how an attack unfolded. Options A, C, and D are incorrect: Causality does not automatically create firewall rules (that is the job of policy/response actions), it is not an identity management function (handled by IdP/User Directory integration), and it does not encrypt endpoint data (handled by disk encryption or DLP controls).

Answer

Automated firewall rule creation

Answer

Managing user identity

Answer

Encrypting endpoint data