SecOps-Pro Threat Intelligence And Secops Processes Practice Test 1 — 15 Questions

Question 1

A security analyst notices that XDR incidents are not being updated with threat intelligence data from AutoFocus. Which menu path should the analyst check to verify the AutoFocus integration status?

Accepted Answer

Settings > Configurations > Integrations > AutoFocus. The integration status is found within the Settings menu under Integrations.

Answer

Incidents > Threat Intel > AutoFocus Status

Answer

Policies > Security Profiles > AutoFocus

Answer

Marketplace > Installed Integrations > AutoFocus

Question 2

You are managing IOCs in Cortex XSOAR and need to ensure that expired indicators are purged from the system after 30 days. Where do you configure this retention policy?

Accepted Answer

Settings > Indicators > Indicator Settings. In Cortex XSOAR, indicator retention and expiration policies are configured under Settings > Indicators > Indicator Settings. This section allows you to define how long indicators are retained and when they are purged, including the 30-day retention policy for expired indicators.

Answer

Settings > Server Configuration > Retention

Answer

Playbooks > Indicator Management > Cleanup

Answer

Jobs > Cleanup Tasks

Question 3

You are integrating Cortex XSOAR with a third-party threat intelligence platform. Which configuration setting is required to ensure that incoming indicators are automatically mapped to the appropriate threat intelligence source in the Indicator Lifecycle management?

Accepted Answer

Set the integration instance to 'Active' with 'Auto-map' enabled. Mapping is handled through the indicator type and source mapping configurations in the integration settings.

Answer

Set the indicator severity to 'High' in the integration instance

Answer

Create a new threat intel feed via the API

Answer

Configure a custom playbook to trigger on indicator import

Question 4

You want to limit the visibility of certain sensitive threat intelligence indicators to only senior analysts. How is this achieved in XSOAR?

Accepted Answer

By assigning specific Roles with RBAC to the indicators. Roles and permissions in XSOAR allow granular control over data access.

Answer

By deleting the indicators

Answer

By encrypting the database

Answer

By moving indicators to a separate server

Question 5

When integrating Palo Alto Networks AutoFocus into XSOAR, which specific field allows you to map AutoFocus 'Tags' to XSOAR 'Labels'?

Accepted Answer

Mapping Fields. The mapping configuration in the integration instance settings allows for custom field and label mapping.

Answer

Feed Fetch Settings

Answer

Advanced Options

Answer

Indicator Thresholds

Question 6

How can an administrator ensure that only verified, high-confidence IOCs trigger automatic blocking actions on a Palo Alto Networks Firewall?

Accepted Answer

Configure an indicator threshold in the Blocking Playbook. Reputation scoring and thresholds are used to filter indicators before action.

Answer

Delete all low-confidence feeds

Answer

Disable automatic ingestion

Answer

Set the integration to 'Manual' mode

Question 7

When defining a custom indicator type in XSOAR, which field is mandatory to ensure it can be tracked in the Threat Intel module?

Accepted Answer

Indicator Type Name. All indicators must have a reputation score or type associated to be processed by the threat intelligence engine.

Answer

Default Expiration

Answer

Source Mapping

Answer

Default Color

Question 8

You have a custom threat intelligence source that provides data in CSV format. How can you ingest this into XSOAR?

Accepted Answer

Use the Generic Feed integration. XSOAR supports CSV ingestion through the generic Feed integration.

Answer

Write a Python script to copy the file

Answer

Use the API to upload to the database

Answer

Create an incident manually

Question 9

Which tool in the XSOAR suite is best suited for documenting the steps taken during an incident to ensure repeatable processes?

Accepted Answer

Playbook. Playbooks are specifically designed for documenting and automating incident response procedures.

Answer

Dashboard

Answer

Reporter

Answer

War Room

Question 10

Which component in XSOAR allows you to test a playbook in a controlled environment before deploying it?

Accepted Answer

Playbook Debugger. The 'Playbook Debugger' or 'Sandbox' environment allows for testing.

Answer

Production Server

Answer

Dashboard

Answer

Integration Settings

Question 11

Which THREE of the following are valid methods to increase the 'reputation' of an indicator in Cortex XSOAR?

Accepted Answer

Results from an enrichment integration. In Cortex XSOAR, an indicator's reputation score can be raised by several legitimate sources. Option A (Results from an enrichment integration) is correct because when an enrichment integration (e.g., VirusTotal, WildFire) returns a malicious or suspicious verdict, XSOAR automatically updates the indicator's reputation score based on that integration's output. Option B (Correlation rules) is correct because correlation rules can match indicators against other data and, when triggered, set or increase the indicator's reputation as part of the rule's action. Option E (Manual update by an analyst) is correct because analysts can manually edit an indicator's reputation field in the indicator details page or via the CLI, directly increasing its score. Option C (Deleting the indicator) is not valid because deletion removes the indicator entirely rather than increasing its reputation. Option D (Changing the indicator name) is not valid because renaming an indicator does not affect its reputation score.

Answer

Deleting the indicator

Answer

Changing the indicator name

Question 12

Which THREE metrics are commonly used to evaluate the effectiveness of an incident response process in a dashboard?

Accepted Answer

Mean Time to Remediate (MTTR). MTTR, number of incidents closed, and false positive rates are standard performance metrics.

Answer

Number of firewall logs

Answer

Total database storage used

Answer

Number of coffee breaks taken

Question 13

You are reviewing threat intelligence feeds in Cortex XSOAR. Why would an indicator be marked as 'False Positive' by the system automatically?

Accepted Answer

The indicator is found on a configured Whitelist or matches reputation thresholds. Cortex XSOAR can automatically mark an indicator as 'False Positive' when it matches a configured whitelist (allowlist) or when its reputation score falls within thresholds defined as benign. This automation reduces analyst workload by suppressing known-good indicators from triggering alerts or incidents.

Answer

The indicator is not associated with an incident

Answer

The indicator is older than 24 hours

Answer

The indicator has a score of 0

Question 14

A security operations center uses Cortex XSOAR to manage incidents. An analyst notices that a specific IP address 203.0.113.45 has been added to the blocklist after being marked as malicious by a threat intelligence feed, but later the same IP appears in a new incident as a source of benign traffic. The analyst wants to prevent future automatic blocking of this IP while keeping it visible for investigation. What should the analyst do in Cortex XSOAR?

Accepted Answer

Exclude the IP from automatic blocking by adjusting the indicator's 'Blocklist' setting to 'Do Not Block'.. The correct action is to adjust the indicator's blocklist setting to prevent automatic blocking while preserving its malicious reputation for continued visibility. This ensures that the IP remains available for investigation without triggering automated responses, which is crucial when an indicator's maliciousness is uncertain or context has changed.

Answer

Mark the indicator as 'False Positive' in the threat intel management interface.

Answer

Remove the IP from the blocklist and set its reputation to 'Good' in the indicator store.

Answer

Add the IP to the 'Allow List' in the threat intel management settings.

Question 15

A security analyst receives an alert about a suspicious file hash. Before escalating, the analyst wants to understand the file's behaviour and origin. Which threat intelligence technique should the analyst use to gather this information?

Accepted Answer

Dynamic analysis. Dynamic analysis is correct because it executes the file in a controlled sandbox to observe its runtime behaviour, including network traffic, system changes, and other indicators of origin and intent. Static analysis, hash reputation, and WHOIS do not provide the behavioural context required. This technique helps analysts determine if the file is malicious and how it operates, informing escalation decisions.

Answer

Static analysis

Answer

WHOIS lookup

Answer

Hash reputation lookup