SecOps-Pro Threat Detection And Incident Response Practice Test 3 — 15 Questions

Question 1

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

Accepted Answer

Indicator Extraction. Indicator Extraction in Cortex XSOAR is the component that automatically parses raw text (such as log strings, email bodies, or incident fields) to identify and extract indicators like IP addresses, domains, URLs, and email addresses. It uses predefined regex patterns and can be configured per incident type, then enriches those indicators via integrations. This is exactly what is needed to structure an email address from a raw log string.

Answer

Playbook Workflow

Answer

War Room Note

Answer

Incident Layout

Question 2

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

Accepted Answer

NGFW threat logs. Cortex Data Lake ingests security telemetry from Palo Alto Networks products and integrated sources, and NGFW threat logs (option A) are a core supported log type generated by next-generation firewalls and forwarded to the data lake for analytics and Cortex XDR/Cortex Data Lake correlation. XDR agent endpoint logs (option C) are also ingested, since Cortex XDR agents on endpoints send process, network, and security event telemetry into Cortex Data Lake for detection and investigation. Options B and D describe physical hardware metrics (server temperature and power supply voltage) that are not log types ingested by Cortex Data Lake, and option E (physical badge access logs) is physical security data that is not a native Cortex Data Lake ingestion type.

Answer

Active Directory physical server temperature

Answer

Firewall power supply voltage

Answer

User physical badge access logs

Question 3

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Accepted Answer

Blocking a C2 IP address on the firewall. In the Containment phase, the goal is to stop the spread of the incident and limit its impact while preserving evidence. Option C (Blocking a C2 IP address on the firewall) is correct because blocking command-and-control traffic at the perimeter prevents compromised hosts from communicating with attacker infrastructure, a standard containment action. Option D (Isolating the affected endpoint) is correct because quarantining or network-isolating the endpoint stops lateral movement and further compromise. Option A (Updating system documentation) is a post-incident or documentation activity, not containment. Option B (Rebuilding the infected server) is part of Eradication/Recovery, since it removes and restores the system. Option E (Conducting a root cause analysis) belongs to the Post-Incident/Lessons Learned phase, not Containment.

Answer

Updating system documentation

Answer

Rebuilding the infected server

Answer

Conducting a root cause analysis

Question 4

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

Accepted Answer

Malicious files. The Evidence Board in a Cortex XSOAR incident is designed to hold the artifacts and context gathered during an investigation, so option B (Malicious files) is correct because suspicious or malicious file samples attached to the incident are stored there for analysis and reference. Option C (Extracted IOCs) is correct because indicators such as IP addresses, domains, URLs, and file hashes extracted from the incident are surfaced on the Evidence Board to support enrichment and pivoting. Option E (Screenshots of the incident) is correct because visual evidence like screenshots can be attached to the board to document findings and support the investigation narrative. Option A (Playbook source code) does not belong because playbooks are automation logic managed in the Playbooks section, not evidence artifacts, and option D (System boot logs) is not a standard Evidence Board item unless specifically attached as an artifact, so it is not one of the commonly included items.

Answer

Playbook source code

Answer

System boot logs

Question 5

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

Accepted Answer

Automatic email ingestion. Automatic email ingestion (A) is a valid trigger because Cortex XSOAR can connect to a mailbox via an email integration (e.g., the built-in Mail Listener v2), which continuously fetches incoming messages and automatically creates incidents from them, so a phishing report or alert email can start an investigation without human action. Manual incident creation (C) is also valid because an analyst can create an incident directly in the XSOAR UI (Incidents > New Incident) or via the API, which is the standard way to open an investigation by hand. The remaining options do not belong: a hardware power reset (B) is a physical action with no incident-triggering capability in XSOAR, a direct firewall firmware update (D) is a network-device maintenance task unrelated to XSOAR's incident lifecycle, and OS kernel patching (E) is a host operating-system maintenance activity that cannot create or trigger a XSOAR investigation.

Answer

Hardware power reset

Answer

Direct firewall firmware update

Answer

OS kernel patching

Question 6

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

Accepted Answer

Dynamic analysis of files. WildFire is Palo Alto Networks' cloud-based threat analysis service, and it performs static analysis of files (option D) by examining file characteristics, headers, and code structure without executing them, as well as dynamic analysis (option B) by detonating files in a sandboxed virtual environment to observe malicious behavior such as network callbacks and registry changes. It also provides automated signature generation (option C), converting the findings from its analysis into protections that are delivered to firewalls and endpoints to block future instances of the threat. Option A is incorrect because real-time remote shell access is not a WildFire capability; it is a remote administration function unrelated to malware analysis. Option E is incorrect because firewall configuration backup is a management/operations task handled by tools like Panorama or the firewall's own export features, not by WildFire.

Answer

Real-time remote shell access

Answer

Firewall configuration backup

Question 7

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

Accepted Answer

Information on mitigation strategies. Option A is correct because Threat Vault provides actionable mitigation strategies and guidance for detected threats, helping security teams respond effectively. Option D is correct because Threat Vault gives access to detailed vulnerability and threat signature information, including signature IDs and coverage details used by Palo Alto Networks firewalls and security services. The other options do not belong: real-time endpoint isolation (B) is a function of endpoint protection platforms such as Cortex XDR, automated playbook execution (C) is handled by SOAR tools like Cortex XSOAR, and firewall image deployment (E) is a management task performed through Panorama or the firewall's software update mechanism, not a Threat Vault feature.

Answer

Real-time endpoint isolation

Answer

Automated playbook execution

Answer

Firewall image deployment

Question 8

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

Accepted Answer

Executing system commands. Live Terminal in Cortex XDR provides a remote shell on the endpoint, so option A (Executing system commands) is correct because it lets analysts run OS-level commands directly on the host for investigation or remediation. Option C (Deleting files on the endpoint) is correct because the terminal can issue file-deletion commands to remove malicious artifacts from the endpoint. Option E (Listing running processes) is correct because analysts can run process-listing commands (e.g., tasklist on Windows or ps on Linux/macOS) to enumerate active processes during triage. Option B (Automating incident closure in XSOAR) is not a Live Terminal capability, as that is handled by XSOAR playbooks and incident management workflows, not a remote endpoint shell. Option D (Modifying firewall policy rules) is not performed through Live Terminal, since firewall policy changes are made in the firewall management console or policy configuration, not via endpoint command execution.

Answer

Automating incident closure in XSOAR

Answer

Modifying firewall policy rules

Question 9

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Accepted Answer

Network flow logs. Network flow logs (A) are a core Cortex XDR data source because the XDR Collectors and Broker VM ingest firewall, proxy, and network traffic telemetry into the Cortex Data Lake, where XQL can query fields such as source/destination IP and port. Endpoint process logs (B) are also correct, since the Cortex XDR agent streams endpoint telemetry including process execution, command-line arguments, and parent-child process relationships that XQL uses in the xdr_data dataset. Cloud service activity logs (E) are correct as well, because Cortex XDR ingests SaaS and cloud audit logs (for example, via the Cortex XDR cloud connectors or the Cortex Data Lake) so XQL can correlate cloud events with endpoint and network activity. Personal employee browser cookies (C) are not a supported data source, as they are personal user data unrelated to security telemetry and would raise privacy and compliance issues. Local printer error logs (D) are not a standard Cortex XDR data source, since printer diagnostics are not ingested by the agent, Collectors, or cloud connectors and are irrelevant to XQL threat hunting.

Answer

Personal employee browser cookies

Answer

Local printer error logs

Question 10

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

Accepted Answer

Containment, Eradication, and Recovery. The incident response lifecycle as defined by NIST SP 800-61 and supported by Palo Alto Networks tools includes Preparation (E), Detection and Analysis (C), and Containment, Eradication, and Recovery (A). Preparation (E) is the first phase, covering policies, tools, training, and readiness activities such as configuring Cortex XDR, WildFire, and AutoFocus before an incident occurs. Detection and Analysis (C) is where telemetry from sources like Cortex XDR, firewalls, and WildFire is correlated to identify and validate malicious activity. Containment, Eradication, and Recovery (A) is the response phase where threats are isolated, removed, and systems restored, using capabilities such as endpoint isolation and automated playbooks. Public relations campaigning (B) is a communications activity, not a lifecycle phase, and manual hardware procurement (D) is a logistics task unrelated to the standard incident response framework.

Answer

Public relations campaigning

Answer

Manual hardware procurement

Question 11

A Cortex XDR administrator needs to ensure that a newly created custom BIOC rule is evaluated against endpoint activity in real time without waiting for the next scheduled rule refresh. The rule must also be able to reference the parent process of the triggering event. Which combination of rule configuration choices should the administrator make?

Accepted Answer

Set the rule to 'Real-time' evaluation mode and include the 'causality' field in the rule condition.. Real-time evaluation causes the BIOC engine to assess endpoint telemetry as it arrives, eliminating the delay inherent in scheduled rule runs. The causality field exposes the parent process chain, allowing a condition to reference the process that spawned the triggering event. Selecting real-time mode together with causality satisfies both the latency and lineage requirements, so the rule fires promptly and can correlate the event with its originating parent process.

Answer

Set the rule to 'Scheduled' evaluation mode and include the 'actor_process_image_name' field in the rule condition.

Answer

Set the rule to 'Scheduled' evaluation mode and include the 'causality' field in the rule condition.

Answer

Set the rule to 'Real-time' evaluation mode and include the 'action_process_image_name' field in the rule condition.

Question 12

A Cortex XDR analyst notices that a single endpoint generated over 200 alerts in the last hour, all tied to the same parent process tree and the same remote IP. The analyst wants to reduce analyst fatigue while preserving the full investigation timeline. Which Cortex XDR capability should the analyst use to consolidate these related alerts?

Accepted Answer

Incident grouping that correlates alerts sharing a common causality chain and host into one incident. Cortex XDR correlates alerts that share a causality chain and endpoint into a single incident entity. This preserves the full investigation timeline while collapsing duplicate noise, directly reducing analyst fatigue. The other options either analyze files, manually close alerts, or attempt suppression, none of which consolidate related alerts into one investigation entity.

Answer

Configuring a BIOC rule to suppress all alerts from the affected endpoint for one hour

Answer

Creating an XQL query that counts alerts per endpoint and manually closing duplicates

Answer

Enabling WildFire forwarding so the parent process is submitted for sandbox analysis

Question 13

An analyst in a Cortex XDR environment is investigating a series of alerts where a user's endpoint initiated an outbound connection to a known malicious IP address. The analyst needs to determine the parent process that spawned the process responsible for the connection. Which Cortex XDR feature should the analyst use to visualize the process lineage and identify the root cause?

Accepted Answer

Causality Chain. The Causality Chain is specifically designed to visualize process relationships and event sequences in Cortex XDR. It allows analysts to quickly trace the origin of an alert by following the chain of process executions, which is essential for root cause analysis during incident response. Other options either detect but don't visualize, or require manual querying.

Answer

XQL Query Builder

Answer

IOC Rules

Answer

BIOC Rules

Question 14

During an investigation, a Cortex XDR analyst needs to determine whether a suspicious PowerShell process was spawned by a known-good parent such as explorer.exe or by a malicious macro-enabled document. The analyst wants to visualize the full chain of process creation events leading to the alert. Which Cortex XDR feature should the analyst use?

Accepted Answer

The Causality view, which displays the process tree and parent-child relationships for the alert. The Causality view in Cortex XDR is designed to visualize the process tree and parent-child relationships behind an alert. It lets the analyst trace whether PowerShell originated from a benign parent like explorer.exe or a malicious document. Other options provide raw data, file analysis, or alert lists but not the visual causal chain required.

Answer

The XQL query editor, which can search raw endpoint telemetry for process creation events

Answer

The Alerts table filtered by severity, which lists all alerts sorted by risk score

Answer

The WildFire report for the document, which shows the file's behavioral sandbox analysis

Question 15

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious process on an endpoint that is communicating with an external IP address. To determine the full scope of the incident, the analyst needs to retrieve all network connections initiated by that process and any child processes. Which Cortex XDR action should the analyst take to efficiently gather this information?

Accepted Answer

Use the Cortex XDR Causality Chain to view the process and its network connections.. The Causality Chain is the optimal tool because it integrates process execution and network connection telemetry, allowing the analyst to see all connections made by the suspicious process and its children in a single view. This accelerates incident scoping and root cause analysis, unlike manual methods or signature-based scans.

Answer

Create an XQL query to search for all network connections from the endpoint and manually filter by process name.

Answer

Run a live terminal session on the endpoint and use netstat -ano to list connections.

Answer

Initiate a malware scan on the endpoint to identify the process and its network activity.