SecOps-Pro Threat Detection And Incident Response Practice Test 4 — 15 Questions

Question 1

During an active incident, a Cortex XDR analyst wants to stop a compromised endpoint from communicating with a known command-and-control server while still allowing the rest of the SOC to collect forensic evidence from the host. Which Cortex XDR response action should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the endpoint using network isolation. Network isolation is the correct containment action because it cuts off all external communication from the endpoint while preserving the Cortex XDR management tunnel. This allows the SOC to continue remote investigation, run live terminal commands, and collect evidence without letting the attacker retain C2 access, which is exactly the balance the scenario requires.

Answer

Quarantine the file using the 'Quarantine File' action

Answer

Block the C2 IP address using a Cortex XDR IOC rule

Answer

Terminate the suspicious process with the 'Kill Process' action

Question 2

During an incident response engagement, a SOC analyst needs to isolate a compromised endpoint from the network while preserving the ability to remotely investigate it. The endpoint is running the Cortex XDR agent. Which Cortex XDR response action should the analyst use?

Accepted Answer

Endpoint Isolation. Endpoint Isolation is the correct response action because it severs all network connections except the management channel, effectively containing the threat while enabling remote forensic analysis. Other actions are more granular and do not provide the same level of network containment.

Answer

Terminate Process

Answer

Quarantine File

Answer

Block List

Question 3

A Cortex XSOAR engineer is building a playbook to automate the containment of a compromised endpoint. The playbook must isolate the endpoint from the network and then collect forensic evidence before remediation. Which two actions should the engineer include in the playbook to achieve these goals? (Choose two.)

Accepted Answer

Use the Cortex XDR - Get Endpoint Forensic Data command to collect volatile evidence from the endpoint. The playbook must isolate the endpoint and collect forensic evidence. The Cortex XDR - Isolate Endpoint command quarantines the endpoint from the network, achieving containment. The Cortex XDR - Get Endpoint Forensic Data command retrieves volatile evidence for analysis. The other commands perform remediation or scanning, which are out of sequence and do not meet the stated goals.

Answer

Use the Cortex XDR - Scan Endpoint command to run a full antivirus scan on the endpoint

Answer

Use the Cortex XDR - Block File command to delete the malicious executable from the endpoint

Answer

Use the Cortex XDR - Quarantine File command to move the malicious file to a quarantine folder

Question 4

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

Accepted Answer

xdr_memory. To detect credential dumping via LSASS memory access, the analyst needs to correlate process execution with memory access events. The xdr_process dataset provides process context, while xdr_memory captures the actual memory access. Together, they enable detection of suspicious processes reading LSASS memory.

Answer

xdr_registry

Answer

xdr_network

Answer

xdr_file

Question 5

A SecOps analyst receives an alert indicating a possible credential dumping attempt on a Windows server. The analyst wants to quickly determine which user account initiated the suspicious process and what other commands were run in the same session. Which Cortex XDR data source should the analyst query?

Accepted Answer

The endpoint process execution telemetry, which includes user context and command-line arguments. Endpoint process execution telemetry in Cortex XDR includes user context, command-line arguments, and session identifiers. This directly answers which user initiated the suspicious process and what other commands were run. Network, authentication, and DNS logs lack the process-level detail needed for this attribution.

Answer

The network traffic logs, which show outbound connections from the server

Answer

The DNS query logs, which show domain resolutions from the server

Answer

The authentication logs, which record successful and failed logon attempts

Question 6

A Cortex XDR analyst is reviewing an alert where a user's workstation executed a PowerShell script that downloaded a payload from an external IP. The analyst wants to determine whether the script was launched by a parent process that is a known legitimate application or a suspicious one. Which Cortex XDR feature should the analyst use to trace the full parent-child process lineage?

Accepted Answer

Causality Analysis. Causality Analysis is the correct feature because it reconstructs the sequence of events and process relationships that led to an alert. It shows the parent-child chain, enabling the analyst to determine if the PowerShell script was spawned by a legitimate application or a malicious one. Other options either focus on live inspection, automation, or external threat data, none of which provide the required lineage view.

Answer

Process Explorer

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Question 7

A Cortex XDR analyst is investigating a series of alerts across multiple endpoints that appear to be part of a coordinated attack. The analyst wants to identify the common root cause and see how the attack spread from the initial endpoint to others. Which Cortex XDR capability provides this cross-endpoint correlation?

Accepted Answer

Incident grouping that correlates alerts across endpoints based on shared indicators and causality. Cortex XDR incident grouping correlates alerts across endpoints by shared indicators, causality, and attack patterns. This gives the analyst a unified view to identify the common root cause and trace lateral movement. Isolation, WildFire reports, and manual XQL queries do not provide automated cross-endpoint correlation for a coordinated campaign.

Answer

The XQL query editor, which can search for alerts by endpoint name across the dataset

Answer

The WildFire analysis report, which shows the behavior of the malicious file in a sandbox

Answer

The endpoint isolation feature, which quarantines each affected endpoint individually

Question 8

A security operations center (SOC) analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious outbound connection from a server to an unknown external IP. To determine if this connection is part of a larger attack, the analyst wants to see all other endpoints that communicated with the same external IP within the last 24 hours. Which Cortex XDR query should the analyst run?

Accepted Answer

dataset = xdr_data | filter action_remote_ip = "<external_ip>" | fields agent_hostname, action_remote_ip, timestamp. The correct query filters the xdr_data dataset by the remote IP address and projects the hostname, remote IP, and timestamp. This provides a list of all endpoints that communicated with the suspicious external IP, along with when those connections occurred. The other queries either filter on the wrong field, target process events instead of network events, or remove critical context through deduplication.

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "<external_ip>" | fields agent_hostname, timestamp

Answer

dataset = xdr_data | filter action_local_ip = "<external_ip>" | fields agent_hostname, action_local_ip, timestamp

Answer

dataset = xdr_data | filter action_remote_ip = "<external_ip>" | dedup agent_hostname | fields agent_hostname

Question 9

A Cortex XSOAR playbook is triggered by a phishing incident. The playbook automatically extracts indicators from the email and enriches them using threat intelligence integrations. The analyst wants to ensure that any malicious URLs found are blocked on the next-generation firewall (NGFW) and that the incident is documented. Which XSOAR feature should the analyst use to automatically push the malicious URLs to the NGFW block list?

Accepted Answer

Integration Command. Integration Commands are the specific XSOAR actions that enable communication with external tools like an NGFW. They allow the playbook to automatically add malicious URLs to a block list, ensuring rapid response. Other options are either part of the playbook logic or data storage, not the execution mechanism.

Answer

Incident Field

Answer

Indicator Extraction

Answer

Playbook Task

Question 10

A Cortex XSOAR analyst is building a playbook to automate the response to phishing incidents. The playbook must extract indicators from the reported email, check their reputation against integrated threat intelligence sources, and then decide whether to block the sender domain or close the incident as benign. Which type of XSOAR task should the analyst use to perform the reputation check?

Accepted Answer

Automated task. An automated task is designed to execute integration commands or scripts without human intervention, making it the correct choice for querying threat intelligence sources. It can retrieve reputation scores and pass them to conditional tasks for decision-making. Manual, conditional, and data collection tasks serve different purposes: human input, branching logic, and form submission, respectively, and none of them automatically perform the reputation check.

Answer

Data collection task

Answer

Conditional task

Answer

Manual task

Question 11

A Cortex XSOAR analyst is designing a playbook that must automatically enrich every new phishing alert by querying VirusTotal, then create a ticket in ServiceNow only when the verdict is malicious. Which playbook construct should the analyst use to branch execution based on the enrichment verdict?

Accepted Answer

A conditional task that evaluates the VirusTotal verdict and routes execution down the malicious or benign path. Conditional tasks are the XSOAR construct designed for decision logic: they inspect the output of prior tasks and route execution down different branches. This allows the playbook to create a ServiceNow ticket only when the enrichment verdict is malicious, while benign alerts follow a separate closure path without human intervention.

Answer

A section header task that groups the enrichment commands into a labeled block

Answer

A manual task that assigns the alert to the SOC queue for triage

Answer

A data collection task that prompts the analyst to manually choose the verdict

Question 12

A Cortex XDR analyst notices an endpoint generating a high volume of process creation events that match a known attack pattern, but the pattern is not tied to any file hash or network indicator. The analyst wants Cortex XDR to alert on this behaviour automatically in the future without creating a signature-based rule. Which Cortex XDR capability should the analyst use?

Accepted Answer

Create a BIOC rule that defines the behavioural sequence and triggers an alert when matched. BIOC rules are designed to detect behavioural sequences rather than static indicators, so they can alert on process creation patterns even when no hash or network artifact exists. This gives the SOC durable, signature-independent detection that fires automatically whenever the same behaviour recurs on any endpoint in the environment.

Answer

Submit the suspicious binary to WildFire for sandbox analysis

Answer

Add the file hash to an IOC rule with a block action

Answer

Enable a Cortex XDR exception policy for the affected process

Question 13

A Cortex XSOAR engineer is building a playbook that must automatically enrich a suspicious IP address by querying an external threat intelligence service, then conditionally block that IP at the firewall if the reputation score exceeds a threshold. The engineer needs a playbook task that can make an HTTP request to the threat intel API, parse the JSON response, and pass the resulting score to a downstream conditional task. Which Cortex XSOAR task type should the engineer use?

Accepted Answer

A standard task that runs an integration command, because integration commands can return JSON that is parsed into context and used by later tasks.. Automated enrichment that calls an external API, parses the JSON response, and exposes values to later tasks is accomplished with a Cortex XSOAR task that runs an integration command. The command output is written into the incident context, where a conditional task can evaluate the reputation score against the threshold and branch accordingly. Manual, conditional, and data collection tasks do not perform the outbound HTTP request or JSON parsing required here.

Answer

A manual task that prompts the analyst to look up the IP reputation in a browser and enter the score by hand.

Answer

A data collection task that presents a form to the analyst to select the threat intel source before the playbook continues.

Answer

A conditional task that evaluates the IP against a static list of known-bad addresses stored in the playbook.

Question 14

A SOC manager wants to ensure that during a major incident, all analysts see the same set of indicators, tasks, and investigation findings without duplicating effort across shifts. Which Cortex XSOAR feature should the manager rely on to provide this shared investigation workspace?

Accepted Answer

The incident War Room, which centralizes tasks, entries, and artifacts for the investigation. The War Room is the collaborative workspace where all incident-related tasks, chat entries, files, and indicators are visible to every analyst. Using it ensures shift handoffs and parallel work stay synchronized, since everyone operates from the same incident context instead of duplicating discovery in separate tools.

Answer

The dashboard builder, which creates custom widgets summarizing incident metrics

Answer

The playbook editor, which allows analysts to modify automation logic during the incident

Answer

The indicator repository, which stores and scores IOCs across incidents

Question 15

A SOC analyst receives a Cortex XDR alert indicating that a workstation attempted to contact a domain associated with a known malware family. The analyst confirms the domain is malicious and wants to prevent any further communication from the endpoint to that domain while keeping the endpoint online for continued investigation. Which Cortex XDR response action should the analyst take?

Accepted Answer

Add the domain to a block list in the Cortex XDR policy so the agent blocks resolution and connection attempts to it.. The analyst has confirmed the domain is malicious and wants targeted containment that preserves the endpoint's usability. Adding the domain to the Cortex XDR block list causes the endpoint agent to block resolution and connection attempts to that specific domain, stopping the malicious traffic while keeping the host online. Full isolation is too broad, and process termination or scanning do not directly block the domain communication.

Answer

Run a full malware scan on the endpoint and wait for the results before taking any network action.

Answer

Isolate the endpoint from the network entirely using the endpoint isolation action.

Answer

Terminate the offending process and delete the associated file from the endpoint.