SecOps-Pro Threat Intelligence And Secops Processes — 20 Questions

Question 1

A security analyst notices that XDR incidents are not being updated with threat intelligence data from AutoFocus. Which menu path should the analyst check to verify the AutoFocus integration status?

Accepted Answer

Settings > Configurations > Integrations > AutoFocus. The integration status is found within the Settings menu under Integrations.

Answer

Incidents > Threat Intel > AutoFocus Status

Answer

Policies > Security Profiles > AutoFocus

Answer

Marketplace > Installed Integrations > AutoFocus

Question 2

You are managing IOCs in Cortex XSOAR and need to ensure that expired indicators are purged from the system after 30 days. Where do you configure this retention policy?

Accepted Answer

Settings > Indicators > Indicator Settings. In Cortex XSOAR, indicator retention and expiration policies are configured under Settings > Indicators > Indicator Settings. This section allows you to define how long indicators are retained and when they are purged, including the 30-day retention policy for expired indicators.

Answer

Settings > Server Configuration > Retention

Answer

Playbooks > Indicator Management > Cleanup

Answer

Jobs > Cleanup Tasks

Question 3

You are integrating Cortex XSOAR with a third-party threat intelligence platform. Which configuration setting is required to ensure that incoming indicators are automatically mapped to the appropriate threat intelligence source in the Indicator Lifecycle management?

Accepted Answer

Set the integration instance to 'Active' with 'Auto-map' enabled. Mapping is handled through the indicator type and source mapping configurations in the integration settings.

Answer

Set the indicator severity to 'High' in the integration instance

Answer

Create a new threat intel feed via the API

Answer

Configure a custom playbook to trigger on indicator import

Question 4

You want to limit the visibility of certain sensitive threat intelligence indicators to only senior analysts. How is this achieved in XSOAR?

Accepted Answer

By assigning specific Roles with RBAC to the indicators. Roles and permissions in XSOAR allow granular control over data access.

Answer

By deleting the indicators

Answer

By encrypting the database

Answer

By moving indicators to a separate server

Question 5

When integrating Palo Alto Networks AutoFocus into XSOAR, which specific field allows you to map AutoFocus 'Tags' to XSOAR 'Labels'?

Accepted Answer

Mapping Fields. The mapping configuration in the integration instance settings allows for custom field and label mapping.

Answer

Feed Fetch Settings

Answer

Advanced Options

Answer

Indicator Thresholds

Question 6

How can an administrator ensure that only verified, high-confidence IOCs trigger automatic blocking actions on a Palo Alto Networks Firewall?

Accepted Answer

Configure an indicator threshold in the Blocking Playbook. Reputation scoring and thresholds are used to filter indicators before action.

Answer

Delete all low-confidence feeds

Answer

Disable automatic ingestion

Answer

Set the integration to 'Manual' mode

Question 7

When defining a custom indicator type in XSOAR, which field is mandatory to ensure it can be tracked in the Threat Intel module?

Accepted Answer

Indicator Type Name. All indicators must have a reputation score or type associated to be processed by the threat intelligence engine.

Answer

Default Expiration

Answer

Source Mapping

Answer

Default Color

Question 8

You have a custom threat intelligence source that provides data in CSV format. How can you ingest this into XSOAR?

Accepted Answer

Use the Generic Feed integration. XSOAR supports CSV ingestion through the generic Feed integration.

Answer

Write a Python script to copy the file

Answer

Use the API to upload to the database

Answer

Create an incident manually

Question 9

Which tool in the XSOAR suite is best suited for documenting the steps taken during an incident to ensure repeatable processes?

Accepted Answer

Playbook. Playbooks are specifically designed for documenting and automating incident response procedures.

Answer

Dashboard

Answer

Reporter

Answer

War Room

Question 10

Which component in XSOAR allows you to test a playbook in a controlled environment before deploying it?

Accepted Answer

Playbook Debugger. The 'Playbook Debugger' or 'Sandbox' environment allows for testing.

Answer

Production Server

Answer

Dashboard

Answer

Integration Settings

Question 11

Which THREE of the following are valid methods to increase the 'reputation' of an indicator in Cortex XSOAR?

Accepted Answer

Results from an enrichment integration. In Cortex XSOAR, an indicator's reputation score can be raised by several legitimate sources. Option A (Results from an enrichment integration) is correct because when an enrichment integration (e.g., VirusTotal, WildFire) returns a malicious or suspicious verdict, XSOAR automatically updates the indicator's reputation score based on that integration's output. Option B (Correlation rules) is correct because correlation rules can match indicators against other data and, when triggered, set or increase the indicator's reputation as part of the rule's action. Option E (Manual update by an analyst) is correct because analysts can manually edit an indicator's reputation field in the indicator details page or via the CLI, directly increasing its score. Option C (Deleting the indicator) is not valid because deletion removes the indicator entirely rather than increasing its reputation. Option D (Changing the indicator name) is not valid because renaming an indicator does not affect its reputation score.

Answer

Deleting the indicator

Answer

Changing the indicator name

Question 12

Which THREE metrics are commonly used to evaluate the effectiveness of an incident response process in a dashboard?

Accepted Answer

Mean Time to Remediate (MTTR). MTTR, number of incidents closed, and false positive rates are standard performance metrics.

Answer

Number of firewall logs

Answer

Total database storage used

Answer

Number of coffee breaks taken

Question 13

You are reviewing threat intelligence feeds in Cortex XSOAR. Why would an indicator be marked as 'False Positive' by the system automatically?

Accepted Answer

The indicator is found on a configured Whitelist or matches reputation thresholds. Cortex XSOAR can automatically mark an indicator as 'False Positive' when it matches a configured whitelist (allowlist) or when its reputation score falls within thresholds defined as benign. This automation reduces analyst workload by suppressing known-good indicators from triggering alerts or incidents.

Answer

The indicator is not associated with an incident

Answer

The indicator is older than 24 hours

Answer

The indicator has a score of 0

Question 14

A security operations center uses Cortex XSOAR to manage incidents. An analyst notices that a specific IP address 203.0.113.45 has been added to the blocklist after being marked as malicious by a threat intelligence feed, but later the same IP appears in a new incident as a source of benign traffic. The analyst wants to prevent future automatic blocking of this IP while keeping it visible for investigation. What should the analyst do in Cortex XSOAR?

Accepted Answer

Exclude the IP from automatic blocking by adjusting the indicator's 'Blocklist' setting to 'Do Not Block'.. The correct action is to adjust the indicator's blocklist setting to prevent automatic blocking while preserving its malicious reputation for continued visibility. This ensures that the IP remains available for investigation without triggering automated responses, which is crucial when an indicator's maliciousness is uncertain or context has changed.

Answer

Mark the indicator as 'False Positive' in the threat intel management interface.

Answer

Remove the IP from the blocklist and set its reputation to 'Good' in the indicator store.

Answer

Add the IP to the 'Allow List' in the threat intel management settings.

Question 15

A security analyst receives an alert about a suspicious file hash. Before escalating, the analyst wants to understand the file's behaviour and origin. Which threat intelligence technique should the analyst use to gather this information?

Accepted Answer

Dynamic analysis. Dynamic analysis is correct because it executes the file in a controlled sandbox to observe its runtime behaviour, including network traffic, system changes, and other indicators of origin and intent. Static analysis, hash reputation, and WHOIS do not provide the behavioural context required. This technique helps analysts determine if the file is malicious and how it operates, informing escalation decisions.

Answer

Static analysis

Answer

WHOIS lookup

Answer

Hash reputation lookup

Question 16

A SOC manager wants to measure the effectiveness of threat intelligence feeds in Cortex XSOAR. They need a metric that indicates how many indicators from a feed led to the creation of incidents that were later confirmed as true positives. Which Cortex XSOAR feature provides this insight?

Accepted Answer

Incident metrics with feed source correlation. Incident metrics with feed source correlation is the correct choice because it enables the SOC manager to track incidents back to their originating feed and assess how many were true positives. This requires setting up incident fields and using Cortex XSOAR's reporting capabilities to aggregate data.

Answer

Indicator relationship graph

Answer

Indicator prevalence

Answer

Feed health dashboard

Question 17

A threat intelligence analyst in a SecOps team is using Cortex XSOAR to correlate indicators of compromise (IOCs) from multiple feeds. They notice that an IP address 198.51.100.22 is associated with a known APT group in one feed, but another feed reports it as a benign scanner. The analyst wants to determine the confidence level of the association with the APT group before escalating. Which Cortex XSOAR feature should the analyst use to evaluate the reliability of the APT association?

Accepted Answer

Indicator confidence score in the indicator details view.. The indicator confidence score in Cortex XSOAR provides a quantitative measure of the reliability of an association, aggregating data from multiple sources. This allows the analyst to assess whether the APT group attribution is strong enough to warrant escalation, considering conflicting reports from other feeds.

Answer

Threat actor profile page in the Threat Intel module.

Answer

Feed reputation settings in the threat intel management configuration.

Answer

Indicator relationships graph in the Threat Intel module.

Question 18

A SOC manager is designing a threat intelligence program. The manager wants to ensure that the program covers both the collection of indicators and the dissemination of intelligence to relevant stakeholders. Which two of the following are key components of a threat intelligence lifecycle? (Choose two.)

Accepted Answer

Dissemination. The threat intelligence lifecycle includes Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Direction sets the requirements, and Dissemination delivers the intelligence. Together, they ensure that collection is guided and that the resulting intelligence is shared with stakeholders. These two components directly address the manager's goal of covering both collection and dissemination.

Answer

Collection

Answer

Encryption

Answer

Feedback

Question 19

A security analyst is using Cortex XSOAR to investigate a phishing incident. They have extracted several indicators, including a URL, a file hash, and an email address. They want to determine which of these indicators are malicious by checking them against multiple threat intelligence sources simultaneously. Which TWO Cortex XSOAR capabilities allow the analyst to perform this task efficiently? (Choose two.)

Accepted Answer

Use the 'Investigate' option in the indicator's details page to run all enrichment integrations.. The correct answers are using the 'Enrich Indicators' button in the War Room and using the 'Investigate' option in the indicator's details page. Both methods allow running all configured enrichment integrations at once, providing a comprehensive view of threat intelligence from multiple sources without manual command entry.

Answer

Use the CLI to run '!ip' command for each indicator and integration.

Answer

Manually run each integration command for each indicator in the War Room.

Answer

Create a playbook that runs a script to query each integration sequentially.

Question 20

A security operations centre wants to measure the effectiveness of its threat intelligence program. They need a metric that indicates how many indicators were acted upon and resulted in a security response. Which metric should they use?

Accepted Answer

Actionable intelligence ratio. Actionable intelligence ratio is the correct metric because it specifically measures the proportion of threat intelligence that resulted in a security action. This directly addresses the need to assess how many indicators were acted upon and led to a response. Other metrics like hit rate, false positive rate, or MTTD provide different insights but do not capture the actionability of intelligence.

Answer

Indicator hit rate

Answer

False positive rate

Answer

Mean time to detect (MTTD)