SecOps-Pro Threat Detection And Incident Response — Timed 10 Questions

Question 1

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Accepted Answer

BIOC Rules. BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.

Answer

IOC Search

Answer

Vulnerability Protection

Answer

Anti-Malware Policy

Question 2

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Accepted Answer

Live Terminal. The Remote Terminal or Live Terminal feature in Cortex XDR allows for direct command-line interaction with managed endpoints.

Answer

Endpoint File Search

Answer

Snapshot Manager

Answer

Policy Editor

Question 3

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Accepted Answer

Log Forwarding Profile. Log Forwarding profiles are required on the NGFW to transmit threat logs to external systems like XSOAR.

Answer

App-ID configuration

Answer

Security Policy Rule

Answer

GlobalProtect Gateway

Question 4

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Accepted Answer

Work Plan. The Work Plan tab in an incident displays the current status and execution path of the playbook.

Answer

War Room

Answer

Evidence Board

Answer

Indicator Tab

Question 5

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Accepted Answer

Causality View. The Causality View in Cortex XDR allows analysts to visualize the process tree and the chain of events that led to the security alert.

Answer

Forensics Tab

Answer

Network Activity

Answer

Alert Details

Question 6

In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?

Accepted Answer

Automation Scripts. The Indicator Auto-Extraction and subsequent Automation Scripts in XSOAR can trigger blocking actions across integrated products.

Answer

Content Packs

Answer

Indicator Auto-Extraction

Answer

Incident Layouts

Question 7

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Accepted Answer

Vulnerability Protection Profile. Vulnerability Protection profiles specifically look for exploitation attempts within network protocols like SMB.

Answer

DoS Protection Profile

Answer

URL Filtering Profile

Answer

File Blocking Profile

Question 8

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Accepted Answer

Custom URL Category. Adding a URL to a Custom URL Category and then applying that category to a URL Filtering Profile is the standard way to block malicious domains.

Answer

Application Override

Answer

Security Policy Action

Answer

Threat ID

Question 9

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Accepted Answer

XQL Search. XQL (XDR Query Language) allows for cross-source searching and correlation.

Answer

Incident Forensics

Answer

SQL Query Builder

Answer

Log Parser

Question 10

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Accepted Answer

Threat intelligence and hunting. AutoFocus is a threat intelligence service that provides context and hunting capabilities for threats.

Answer

Endpoint isolation

Answer

Log storage

Answer

Automated firewall rule creation