SecOps-Pro Threat Intelligence And Secops Processes Practice Test 2 — 15 Questions

Question 1

A SOC manager wants to measure the effectiveness of threat intelligence feeds in Cortex XSOAR. They need a metric that indicates how many indicators from a feed led to the creation of incidents that were later confirmed as true positives. Which Cortex XSOAR feature provides this insight?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident metrics with feed source correlation. Incident metrics with feed source correlation is the correct choice because it enables the SOC manager to track incidents back to their originating feed and assess how many were true positives. This requires setting up incident fields and using Cortex XSOAR's reporting capabilities to aggregate data.

Answer

Indicator relationship graph

Answer

Indicator prevalence

Answer

Feed health dashboard

Question 2

A threat intelligence analyst in a SecOps team is using Cortex XSOAR to correlate indicators of compromise (IOCs) from multiple feeds. They notice that an IP address 198.51.100.22 is associated with a known APT group in one feed, but another feed reports it as a benign scanner. The analyst wants to determine the confidence level of the association with the APT group before escalating. Which Cortex XSOAR feature should the analyst use to evaluate the reliability of the APT association?

Accepted Answer

Indicator confidence score in the indicator details view.. The indicator confidence score in Cortex XSOAR provides a quantitative measure of the reliability of an association, aggregating data from multiple sources. This allows the analyst to assess whether the APT group attribution is strong enough to warrant escalation, considering conflicting reports from other feeds.

Answer

Threat actor profile page in the Threat Intel module.

Answer

Feed reputation settings in the threat intel management configuration.

Answer

Indicator relationships graph in the Threat Intel module.

Question 3

A SOC manager is designing a threat intelligence program. The manager wants to ensure that the program covers both the collection of indicators and the dissemination of intelligence to relevant stakeholders. Which two of the following are key components of a threat intelligence lifecycle? (Choose two.)

Accepted Answer

Dissemination. The threat intelligence lifecycle includes Direction, Collection, Processing, Analysis, Dissemination, and Feedback. Direction sets the requirements, and Dissemination delivers the intelligence. Together, they ensure that collection is guided and that the resulting intelligence is shared with stakeholders. These two components directly address the manager's goal of covering both collection and dissemination.

Answer

Collection

Answer

Encryption

Answer

Feedback

Question 4

A security analyst is using Cortex XSOAR to investigate a phishing incident. They have extracted several indicators, including a URL, a file hash, and an email address. They want to determine which of these indicators are malicious by checking them against multiple threat intelligence sources simultaneously. Which TWO Cortex XSOAR capabilities allow the analyst to perform this task efficiently? (Choose two.)

Accepted Answer

Use the 'Investigate' option in the indicator's details page to run all enrichment integrations.. The correct answers are using the 'Enrich Indicators' button in the War Room and using the 'Investigate' option in the indicator's details page. Both methods allow running all configured enrichment integrations at once, providing a comprehensive view of threat intelligence from multiple sources without manual command entry.

Answer

Use the CLI to run '!ip' command for each indicator and integration.

Answer

Manually run each integration command for each indicator in the War Room.

Answer

Create a playbook that runs a script to query each integration sequentially.

Question 5

A security operations centre wants to measure the effectiveness of its threat intelligence program. They need a metric that indicates how many indicators were acted upon and resulted in a security response. Which metric should they use?

Accepted Answer

Actionable intelligence ratio. Actionable intelligence ratio is the correct metric because it specifically measures the proportion of threat intelligence that resulted in a security action. This directly addresses the need to assess how many indicators were acted upon and led to a response. Other metrics like hit rate, false positive rate, or MTTD provide different insights but do not capture the actionability of intelligence.

Answer

Indicator hit rate

Answer

False positive rate

Answer

Mean time to detect (MTTD)

Question 6

A SOC manager wants to ensure that when a new indicator is added to Cortex XSOAR, it is automatically checked against a list of known false positives to avoid unnecessary alerts. Which Cortex XSOAR feature should be configured to achieve this?

Accepted Answer

Indicator exclusion list. The correct answer is the indicator exclusion list. This feature allows administrators to maintain a list of indicators that should be treated as false positives or excluded from detection. When new indicators are ingested, they are automatically checked against this list, and matches are excluded from further processing.

Answer

Indicator type definition with a 'false positive' field

Answer

Playbook that runs on indicator creation to check against a list

Answer

Indicator whitelist

Question 7

A SecOps analyst is reviewing threat intelligence indicators in Cortex XSOAR. The analyst wants to identify indicators that are associated with a specific malware family and have been observed in the last 30 days. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Use the indicator search with a query filtering by malware family and last seen date.. The analyst should use the indicator search with a query filtering by malware family and last seen date, and also use the threat intel module's filtering capabilities. Both methods allow precise, efficient identification of indicators matching the specified criteria within Cortex XSOAR, avoiding manual or external processing.

Answer

Create a custom indicator view that includes columns for malware family and last seen date.

Answer

Export all indicators to a CSV file and use a spreadsheet to filter by malware family and last seen date.

Answer

Run a playbook that enriches all indicators and then manually review the results for malware family and date.

Question 8

A security analyst is configuring a new threat intelligence feed in Cortex XSOAR and wants to ensure that the feed data is properly mapped to the correct indicator fields. The feed provides data in JSON format with fields such as 'ip_address', 'domain_name', and 'threat_level'. Which TWO of the following steps are necessary to correctly map these fields to Cortex XSOAR indicator fields? (Choose two.)

Accepted Answer

Use the feed integration's mapping configuration to associate feed fields with XSOAR indicator fields.. The correct answers are to define a classifier that maps the feed's fields to XSOAR indicator fields and to use the feed integration's mapping configuration. These steps ensure that the incoming data is correctly interpreted and stored in the appropriate indicator fields, enabling effective threat intelligence management. Classifiers and mapping configurations are standard mechanisms in Cortex XSOAR for integrating external data sources.

Answer

Manually edit each indicator after ingestion to correct field values.

Answer

Create a custom indicator type for each field in the feed.

Answer

Write a script that transforms the JSON data into a CSV format before ingestion.

Question 9

What is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?

Accepted Answer

To parse and identify IOCs from incident descriptions or email bodies. Indicator extraction automatically identifies and parses artifacts from unstructured text.

Answer

To manually block IPs on the firewall

Answer

To update the threat intelligence database

Answer

To generate reports on threat actors

Question 10

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Accepted Answer

Line Chart. A Line Chart is the correct widget type for visualizing how a metric (count of indicator types) changes over time, since it plots data points across a time axis. In Cortex XSOAR dashboards, line charts are used for trend analysis over time, which matches tracking threat intelligence trends.

Answer

Counter Widget

Answer

Pie Chart

Answer

Table Widget

Question 11

Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?

Accepted Answer

Mean Time to Remediate (MTTR). Mean Time to Remediate (MTTR) measures the average time from incident detection to full remediation, directly reflecting the operational efficiency of the Incident Response team. Over a fiscal quarter, tracking MTTR shows whether the team is improving its response speed and effectiveness, making it the most relevant efficiency metric.

Answer

Total number of alerts generated

Answer

Number of active playbooks

Answer

Number of users trained on phishing

Question 12

You need to automate the enrichment of IP addresses during incident investigation. Which component in XSOAR facilitates this process?

Accepted Answer

Playbooks. Playbooks are the primary automation engine for enrichment.

Answer

Layouts

Answer

Dashboard

Answer

Indicator Types

Question 13

What is the role of a 'Classification' in the context of XSOAR incident management?

Accepted Answer

To identify the type of incident and assign it to the correct playbook. In Cortex XSOAR, a Classification is a mapping rule that examines incoming incident fields (such as the incident type, source, or custom fields) and determines which Incident Type the alert belongs to, which in turn drives which playbook is attached and executed. It is the mechanism that routes raw alerts from integrations into the correct automated response workflow. Without a classification, XSOAR cannot automatically decide which playbook to trigger for a given alert.

Answer

To encrypt the alert content

Answer

To define the severity of the alert

Answer

To list the analysts assigned to the incident

Question 14

A security analyst is troubleshooting an integration that is failing to pull data from a threat feed. What is the first place they should check for errors?

Accepted Answer

The War Room or the Integration Instance logs. The War Room or the integration instance logs provide specific error codes.

Answer

The User Management settings

Answer

The Incident Dashboard

Answer

The Threat Intel page

Question 15

Which object in Cortex XSOAR is used to define the specific actions taken when a specific threat type is identified?

Accepted Answer

Playbook. Playbooks contain the logic and steps for handling specific threats.

Answer

Indicator

Answer

Incident

Answer

Integration