SecOps-Pro Threat Intelligence And Secops Processes Practice Test 3 — 15 Questions

Question 1

A large volume of duplicate indicators is flooding your XSOAR instance from multiple sources. What is the most efficient way to manage this?

Accepted Answer

Configure global indicator deduplication settings. Cortex XSOAR provides global indicator deduplication settings that allow you to define how duplicate indicators from multiple sources are merged or deduplicated based on fields like value and type. Configuring these settings is the most efficient way to manage a high volume of duplicate indicators because it reduces noise at ingestion without losing data. This is a built-in feature designed specifically for this problem.

Answer

Change the integration poll time

Answer

Disable threat intelligence feeds

Answer

Manually delete duplicates daily

Question 2

Why should you use an 'Indicator Reputation' threshold in your SecOps process?

Accepted Answer

To prevent low-confidence or unverified indicators from triggering automated blocks. It helps reduce false positives by ensuring only high-confidence indicators trigger automated blocks.

Answer

To automatically delete logs

Answer

To increase the number of alerts

Answer

To speed up data ingestion

Question 3

You are performing a 'threat hunt' and identify a new malicious domain. How do you add this to your blocklist and ensure it persists for future investigations?

Accepted Answer

Create an indicator and set the reputation to 'Malicious'. In Cortex XSOAR, creating an indicator and setting its reputation to 'Malicious' adds it to the threat intelligence database, where it persists and is automatically matched against future incidents and enriched data. This ensures the malicious domain is blocklisted for future investigations and can trigger automated responses via playbooks.

Answer

Change the firewall policy

Answer

Add it to a text file on the server

Answer

Email the SOC team

Question 4

Which feature in XSOAR allows you to see the relationships between various indicators, incidents, and threat actors?

Accepted Answer

Graph. The Graph view is designed for visualizing relationships between entities.

Answer

Report

Answer

Dashboard

Answer

Settings

Answer

War Room

Question 5

What is the benefit of using 'Incident Tags' in the SecOps process?

Accepted Answer

To categorize incidents for reporting and filtering. Incident Tags in Cortex XSOAR/SecOps are labels applied to incidents to categorize them, enabling filtering, grouping, and reporting across large incident volumes. They provide a flexible taxonomy (e.g., 'phishing', 'malware', 'VIP') that supports dashboards, saved searches, and metrics. This is why the benefit is categorization for reporting and filtering.

Answer

To automate the deletion of data

Answer

To define the password for the incident

Answer

To change the incident priority

Question 6

When configuring threat intelligence feeds in Cortex XSOAR, which TWO of the following are key settings that must be configured for the feed to function correctly?

Accepted Answer

Feed URL. Option C (Feed URL) is correct because every Cortex XSOAR threat intelligence feed integration must be pointed at the external source's endpoint (the API or HTTP/HTTPS URL) from which indicators are retrieved, and without a valid URL the fetch mechanism has nothing to query. Option E (Polling Interval) is correct because feeds run on a scheduled fetch cycle, and the polling interval parameter defines how often XSOAR pulls new indicators (for example, every 5 minutes or hourly) so the indicator repository stays current. Option A (Operating System Version) is not a feed setting; it is irrelevant to indicator ingestion and belongs to endpoint or agent configuration. Option B (Incident Assignee) is not required for a feed to function, since feed fetching is an automated integration task rather than an incident workflow assignment. Option D (Database Password) is not a feed parameter; XSOAR manages its own datastore credentials internally, and feeds authenticate to the external source via API keys or tokens, not a database password.

Answer

Operating System Version

Answer

Incident Assignee

Answer

Database Password

Question 7

Which THREE components are part of the standard XSOAR incident layout customization?

Accepted Answer

Tabs. In Cortex XSOAR, incident layout customization is performed through the incident type's layout editor, where Tabs (A) define the top-level sections of the incident view (such as Summary, War Room, and custom tabs) and control which information appears in each area. Custom Fields (B) are user-defined incident fields that can be added to the layout and displayed within those tabs, making them a core element of layout customization. Custom Buttons (E) are also configured as part of the layout, allowing analysts to trigger scripts, playbooks, or commands directly from the incident view. System BIOS settings (C) and CPU core count (D) are hardware/firmware attributes of the underlying host machine and have no role in XSOAR incident layout configuration.

Answer

System BIOS settings

Answer

CPU core count

Question 8

In the context of SecOps processes, which TWO of the following are benefits of using automated playbooks for threat intelligence?

Accepted Answer

Consistent enforcement of security policies. Option B is correct because automated playbooks codify response steps and policy checks into repeatable workflows, so every threat-intelligence alert is handled the same way and security policies are enforced consistently rather than varying by analyst or shift. Option D is correct because automation executes enrichment, containment, and remediation actions immediately upon trigger, removing manual delays and thereby reducing Mean Time to Remediate (MTTR). Option A is not correct because playbooks still require human oversight, tuning, and escalation for complex or novel threats, so they do not eliminate analysts. Option C is not correct because playbooks orchestrate security tools and processes; they do not increase hardware performance such as CPU or memory capacity. Option E is not correct because firmware upgrades are a patch-management task, not a threat-intelligence playbook benefit, and should not happen automatically without change control.

Answer

Elimination of the need for human analysts

Answer

Increased hardware performance

Answer

Automatic upgrade of firewall firmware

Question 9

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Accepted Answer

Assign a Tag. Option A (Assign a Tag) is correct because XSOAR indicators support tags that analysts apply to categorize, group, and track threat data through its lifecycle, enabling filtering, searching, and automated playbook logic based on tag values. Option B (Update Reputation) is correct because each indicator in XSOAR carries a reputation score (e.g., None, Benign, Suspicious, Malicious) that can be manually or automatically updated, which is central to lifecycle management since it drives incident severity and playbook branching. The remaining options do not apply to indicator objects: installing a new plugin (C) is a system/marketplace administration task, renaming the source feed (D) modifies a feed integration rather than an indicator, and changing the server OS (E) is an infrastructure operation unrelated to indicator lifecycle management.

Answer

Install a new plugin

Answer

Rename the source feed

Answer

Change the server OS

Question 10

Which TWO of the following are valid ways to ingest threat intelligence data into Cortex XSOAR?

Accepted Answer

Manually creating an indicator record. Option C is correct because Cortex XSOAR allows analysts to manually create indicator records (e.g., via the Indicators page or the indicator API) to add threat intelligence data directly into the system. Option D is correct because Cortex XSOAR ships with numerous pre-built Threat Intel Integrations (such as AlienVault OTX, VirusTotal, and MISP) that fetch and ingest indicators automatically through integration instances and fetch-indicators commands. Option A is not valid because a hardware configuration file is unrelated to threat intelligence ingestion and is not a supported data source in XSOAR. Option B is not valid because deleting the database destroys data rather than ingesting it. Option E is not valid because running an OS update is a system maintenance task and does not bring threat intelligence into Cortex XSOAR.

Answer

Uploading a hardware configuration file

Answer

Deleting the database

Answer

Running an OS update

Question 11

Which TWO of the following are primary objectives of a post-incident review (PIR) using XSOAR reports?

Accepted Answer

Improve future automation playbooks. Option B is correct because a primary objective of a post-incident review using XSOAR reports is to feed lessons learned back into the automation content, refining playbook tasks, conditions, and integrations so future incident response is faster and more consistent. Option D is correct because PIRs are designed to surface weaknesses in detection, triage, containment, and remediation workflows, and XSOAR reports provide the incident timeline, task-level data, and metrics needed to pinpoint those gaps. The unmarked options do not belong: A is wrong because increasing project cost is not a goal of a PIR, C is wrong because resetting a firewall to factory settings is a destructive remediation action rather than a review objective, and E is wrong because deleting evidence files would violate forensic preservation and audit requirements.

Answer

Increase the cost of the project

Answer

Reset the firewall to factory settings

Answer

Delete all evidence files

Question 12

Which THREE of the following are critical elements of the Indicator Lifecycle in Cortex XSOAR?

Accepted Answer

Indicator Ingestion. The Indicator Lifecycle in Cortex XSOAR describes how indicators (such as IPs, domains, and file hashes) are brought into the system, enriched, and eventually aged out. Indicator Ingestion (B) is correct because it is the entry point of the lifecycle, where indicators are pulled in from feeds, integrations, or incidents and stored in the indicators database. Indicator Expiration (C) is correct because indicators have a time-to-live (TTL) and must be automatically expired or removed when they are no longer relevant, which is a defined stage of the lifecycle. Reputation Scoring (D) is correct because assigning and updating reputation (e.g., malicious, suspicious, benign, or unknown) based on enrichment and threat intel is a core part of how indicators are evaluated and maintained throughout their lifecycle. Changing the server IP address (A) is a network/infrastructure administration task unrelated to indicator handling, and physical security of the data center (E) is a facilities/security concern, neither of which is a stage or element of the Indicator Lifecycle in Cortex XSOAR.

Answer

Changing the server IP address

Answer

Physical security of the data center

Question 13

Which THREE of the following represent common challenges in SecOps threat intelligence integration that XSOAR helps address?

Accepted Answer

Fragmented and manual workflows. Option B is correct because XSOAR addresses fragmented and manual workflows by orchestrating playbooks that automate repetitive SOC tasks and connect disparate tools through its integration framework, replacing swivel-chair operations with standardized, machine-driven processes. Option C is correct because XSOAR helps reduce the high rate of false positives by enriching indicators with threat intelligence, applying automated deduplication and scoring, and enabling consistent triage logic so analysts focus only on genuine incidents. Option D is correct because XSOAR handles the excessive volume of indicators through indicator extraction, deduplication, and reputation-based scoring, allowing the platform to ingest and process large feeds without overwhelming analysts. Option A is not a typical SecOps threat-intelligence integration challenge XSOAR is designed to solve, since XSOAR itself requires network access to reach external services and threat feeds. Option E is not relevant because XSOAR is a platform-agnostic automation and orchestration layer, and operating system compatibility is not a core challenge in threat-intelligence integration that it addresses.

Answer

Lack of internet connectivity

Answer

Operating system compatibility

Question 14

During a malware investigation in Cortex XSOAR, an analyst sees that an indicator's reputation has been automatically downgraded from 'Bad' to 'Suspicious' even though no analyst modified it. The indicator was originally ingested from a trusted threat feed. Which mechanism most likely caused this change?

Accepted Answer

The threat feed integration's reputation was reduced because of a feed reliability score or source confidence change, altering the aggregated indicator score.. Indicator reputation in Cortex XSOAR is calculated from contributing sources, each with a reliability or confidence score. When a feed's reliability score changes, the aggregated reputation is recalculated, which can move an indicator from Bad to Suspicious without any analyst action. This is the only mechanism among the choices that inherently alters reputation based on source trust rather than lifecycle or manual events.

Answer

A deduplication process merged the indicator with a duplicate that had a lower reputation, and the merged record inherited the lower value.

Answer

The indicator's expiration time elapsed, and the system automatically recalculated its reputation based on remaining active sources.

Answer

The indicator was manually excluded from the blocklist by a playbook, which immediately lowered its reputation to Suspicious.

Question 15

A security analyst is investigating a phishing incident and wants to determine if the sender's IP address has been associated with any known malicious campaigns. Which threat intelligence platform feature should the analyst use to quickly obtain this context?

Accepted Answer

Indicator enrichment. Indicator enrichment is the correct feature because it automatically queries threat intelligence sources to add context to an indicator, such as an IP address. This allows the analyst to quickly determine if the sender's IP has been associated with malicious campaigns, providing actionable intelligence for the phishing investigation. Other features like playbook automation, classification, or dashboards serve different purposes and do not directly provide this context.

Answer

Incident classification

Answer

Dashboard reporting

Answer

Playbook automation