SecOps-Pro Threat Detection And Incident Response — Timed 20 Questions

Question 1

In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?

20 minute time limit — choose an answer to begin.

Accepted Answer

Automation Scripts. The Indicator Auto-Extraction and subsequent Automation Scripts in XSOAR can trigger blocking actions across integrated products.

Answer

Content Packs

Answer

Indicator Auto-Extraction

Answer

Incident Layouts

Question 2

When investigating a compromise, you find an artifact in XSOAR. To gather more context about this file without leaving the platform, which integration should be utilized?

Accepted Answer

Threat Intel Integrations. Threat Intelligence integrations in XSOAR allow for automated lookups of IOCs against external sources.

Answer

Automation Integrations

Answer

Incident Layouts

Answer

Dashboard Widgets

Question 3

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

Accepted Answer

Integration Instance Settings. The XDR-XSOAR integration instance configuration defines the flow of alerts into XSOAR.

Answer

Incident Mapping

Answer

User Permissions

Answer

Playbook Workflow

Question 4

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Accepted Answer

Set Incident. The 'Set Incident' task in XSOAR allows for the modification of incident attributes, including status.

Answer

Incident Mapping

Answer

Close Incident

Answer

Task Assignment

Question 5

A SOC analyst is building an XQL query in Cortex XDR to hunt for lateral movement via remote service creation. The analyst needs to correlate process execution on a source host with the corresponding logon activity on a destination host. (Choose two.)

Accepted Answer

Include a 'fields' clause to retain only the columns needed for the correlation, such as actor_process_image_name and action_local_ip. Correlating source process activity with destination logon activity requires the join operator to link events on a shared key such as hostname or account, and the fields clause to keep the output focused on the columns that matter. Together they produce a readable result set that shows which process on the source host led to which logon on the destination host.

Answer

Add a 'comp' stage to compress identical rows and reduce noise in the output

Answer

Use the union operator to append destination logon events directly after source process events in a single result set

Answer

Filter the XQL dataset with a 'stage' clause that limits results to only the destination host events

Question 6

A Cortex XDR analyst is investigating an alert where a user's endpoint executed a renamed version of psexec.exe (now called svc_host.exe) that spawned a cmd.exe child process and wrote a service binary to C:\Windows\Temp. The analyst wants to enrich the investigation by automatically identifying other endpoints in the environment that exhibited the same sequence of behaviors, not just the same file hash. Which Cortex XDR capability should the analyst use to pivot from this alert to related activity across all endpoints?

Accepted Answer

Causality view, which chains the alert's process, file, and network artifacts into a graph to reveal related events and other affected hosts.. The analyst needs to move from a single alert to a behavioral, environment-wide view. Cortex XDR's Causality graph links the process, file, registry, and network events tied to the alert, allowing the analyst to see parent/child process chains and identify other endpoints that ran the same renamed tool with the same child-process behavior. Hash-based tools like IOC rules, WildFire sandbox reports, and endpoint scans do not provide this cross-endpoint behavioral correlation.

Answer

WildFire analysis report, which detonates the renamed psexec.exe in a sandbox and reports the resulting behaviors and verdict.

Answer

IOC rule matching, which flags any future occurrence of the exact file hash of svc_host.exe on any endpoint.

Answer

Endpoint scan, which runs a full antivirus scan on the affected host to locate additional copies of the malicious binary.

Question 7

A Cortex XDR administrator is configuring a BIOC (Behavioral Indicator of Compromise) rule to detect credential dumping activity on endpoints. The administrator wants to ensure the rule triggers only when specific conditions are met. Which two of the following are valid components that can be used in a BIOC rule definition? (Choose two.)

Accepted Answer

Registry key access patterns. BIOC rules are built from behavioral conditions observed on endpoints, including process execution parameters and registry key access patterns. These allow detection of credential dumping by monitoring how processes interact with sensitive system areas. Network packet payload signatures, file hash values, and email sender reputation are not components of BIOC rules; they belong to other detection mechanisms such as network IPS, IOC matching, or email security.

Answer

Network packet payload signatures

Answer

File hash values

Answer

Email sender reputation

Question 8

An analyst is configuring a Cortex XSOAR playbook to automate the response to a phishing incident. The playbook needs to extract indicators from the reported email, enrich them, and then take appropriate actions. Which two steps should the analyst include to ensure that malicious indicators are blocked across integrated security tools? (Choose two.)

Accepted Answer

Include a task that runs the '!blockIndicators' command to block indicators across integrated tools. To block malicious indicators across integrated security tools in Cortex XSOAR, the analyst should use commands that enforce blocking actions. The '!blockIndicators' command blocks indicators across all supported integrations, while '!createBlocklist' creates blocklist entries in specific tools. Both actions ensure that the indicators are actively blocked, unlike enrichment or reputation-setting commands.

Answer

Add a task that uses the '!setIndicators' command to mark indicators as malicious

Answer

Use the '!ip' command to enrich IP indicators

Answer

Use the '!file' command to detonate the file in a sandbox

Question 9

During an incident investigation, an analyst observes that a compromised endpoint is communicating with a command-and-control (C2) server using DNS tunneling. The analyst wants to block this communication and prevent further data exfiltration. Which Cortex XDR action should the analyst take to immediately stop the C2 traffic while allowing the endpoint to continue other business-critical communications?

Accepted Answer

Add the C2 domain to a blocklist in Cortex XDR. Adding the C2 domain to a blocklist is the most precise action because it blocks the specific C2 channel while allowing other legitimate traffic. This stops data exfiltration and C2 communication without isolating the endpoint, which would disrupt all network activity. Cortex XDR blocklists can be enforced at the endpoint or via integration with network security devices.

Answer

Isolate the endpoint from the network

Answer

Terminate the malicious process on the endpoint

Answer

Quarantine the malicious file

Question 10

A Cortex XSOAR playbook is configured to automatically enrich incidents with threat intelligence from multiple sources. During an investigation, an analyst notices that the playbook fails to execute the enrichment tasks for a specific incident. Which of the following is the most likely cause?

Accepted Answer

The incident's severity is set to 'Low', and the playbook is configured to run only on 'High' severity incidents.. In Cortex XSOAR, playbooks often include conditional tasks that depend on incident severity. If the playbook is set to run only on high-severity incidents, a low-severity incident will not trigger the enrichment tasks. The analyst should review the playbook's triggers and conditions to ensure they align with the incident's severity level, as this is a common configuration to manage alert volume.

Answer

The playbook is not assigned to the incident type, so it does not trigger for this incident.

Answer

The threat intelligence integration is disabled, preventing the playbook from executing any tasks.

Answer

The incident's labels do not match the playbook's task conditions, causing the enrichment tasks to be skipped.

Question 11

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

Accepted Answer

BIOC Rules. BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.

Answer

IOC Search

Answer

Vulnerability Protection

Answer

Anti-Malware Policy

Question 12

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Accepted Answer

Live Terminal. The Remote Terminal or Live Terminal feature in Cortex XDR allows for direct command-line interaction with managed endpoints.

Answer

Endpoint File Search

Answer

Snapshot Manager

Answer

Policy Editor

Question 13

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Accepted Answer

Log Forwarding Profile. A Log Forwarding Profile on the NGFW defines which logs (traffic, threat, URL, etc.) are sent to which external destination, including Cortex XSOAR. To trigger an XSOAR playbook when a threat signature fires, the firewall must forward the threat log via a Log Forwarding Profile attached to the relevant security policy rule. Without this, XSOAR never receives the event to initiate automation.

Answer

App-ID configuration

Answer

Security Policy Rule

Answer

GlobalProtect Gateway

Question 14

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

Accepted Answer

Work Plan. The Work Plan tab in an incident displays the current status and execution path of the playbook.

Answer

War Room

Answer

Evidence Board

Answer

Indicator Tab

Question 15

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Accepted Answer

Causality View. The Causality View in Cortex XDR allows analysts to visualize the process tree and the chain of events that led to the security alert.

Answer

Forensics Tab

Answer

Network Activity

Answer

Alert Details

Question 16

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

Accepted Answer

Vulnerability Protection Profile. SMB is a file-sharing protocol that carries exploit attempts, malware payloads, and lateral movement tools like PsExec and EternalBlue. The Vulnerability Protection Profile in PAN-OS inspects traffic for known exploits, including SMB-based attacks (e.g., MS17-010), and can block or alert on them. Applying it to the security policy ensures SMB sessions are scanned for malicious patterns at the application layer.

Answer

DoS Protection Profile

Answer

URL Filtering Profile

Answer

File Blocking Profile

Question 17

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

Accepted Answer

Custom URL Category. In PAN-DB (Palo Alto Networks URL database), custom URL categories are the object used to define lists of URLs/domains that can be referenced in security policies. To block a C2 domain globally across all Panorama-managed firewalls, you create or update a custom URL category containing the domain, then reference it in a security policy rule pushed from Panorama to all managed devices.

Answer

Application Override

Answer

Security Policy Action

Answer

Threat ID

Question 18

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

Accepted Answer

XQL Search. XQL (XDR Query Language) allows for cross-source searching and correlation.

Answer

Incident Forensics

Answer

SQL Query Builder

Answer

Log Parser

Question 19

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Accepted Answer

Threat intelligence and hunting. AutoFocus is a threat intelligence service that provides context and hunting capabilities for threats.

Answer

Endpoint isolation

Answer

Log storage

Answer

Automated firewall rule creation

Question 20

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Accepted Answer

Detection and Analysis. The Detection and Analysis stage focuses on confirming that an incident occurred.

Answer

Containment

Answer

Eradication

Answer

Recovery