SecOps-Pro Threat Intelligence And Secops Processes Practice Test 4 — 15 Questions

Question 1

A security analyst receives a threat intelligence report indicating that a specific IP address is associated with a command-and-control (C2) server. The analyst wants to automatically block this IP on the Palo Alto Networks firewall when it is detected in future incidents. Which Cortex XSOAR feature should the analyst use to ensure the IP is automatically blocked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook with a blocking task. The correct approach is to use a playbook with a blocking task because Cortex XSOAR playbooks orchestrate automated responses across integrated security tools. When an incident contains the malicious IP, the playbook can execute a firewall integration command to block it, ensuring consistent and immediate enforcement without manual intervention.

Answer

Indicator relationship mapping

Answer

Indicator enrichment

Answer

Indicator exclusion

Question 2

An analyst is reviewing an incident in Cortex XSOAR that contains an IP indicator. They want to automatically enrich this indicator with geolocation and reputation data from a third-party service during playbook execution. Which Cortex XSOAR component is specifically designed to perform this enrichment?

Accepted Answer

Playbook task using an integration command. The correct answer is a playbook task using an integration command. In Cortex XSOAR, enrichment is typically automated by adding tasks to a playbook that execute commands from configured integrations. These tasks can retrieve geolocation, reputation, and other data for indicators, and the results are stored in the incident context for further analysis or decision-making.

Answer

Indicator query in the threat intelligence management (TIM) module

Answer

Classification and mapping rules

Answer

Incident type configuration

Question 3

A security operations team wants to proactively search for threats using indicators of compromise (IOCs) that are not yet linked to any incident. They plan to use threat intelligence data to hunt for these IOCs across their environment. Which approach best describes this activity?

Accepted Answer

Threat hunting. Threat hunting is the proactive search for threats using IOCs and other intelligence, exactly as described. The team is not responding to an incident, managing vulnerabilities, or training users; they are actively seeking undetected threats. This process helps identify compromised systems before they cause harm, reducing dwell time and improving overall security posture.

Answer

Security awareness training

Answer

Incident response

Answer

Vulnerability management

Question 4

A security operations center (SOC) receives a report that a nation-state actor is targeting the organization's industry. The report includes indicators of compromise (IOCs) such as IP addresses, domain names, and file hashes. The SOC manager wants to prioritize the response efforts based on the threat actor's known tactics, techniques, and procedures (TTPs). Which framework should the SOC use to map the observed TTPs to a standardized knowledge base for prioritization?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the de facto standard for mapping adversary TTPs to a structured knowledge base. It allows SOC teams to translate threat intelligence into actionable defenses by identifying specific techniques used by the actor. The other frameworks provide broader or different perspectives but lack the detailed TTP catalog necessary for this scenario.

Answer

NIST Cybersecurity Framework

Answer

Cyber Kill Chain

Answer

Diamond Model

Question 5

A security operations center (SOC) uses Cortex XSOAR to manage incidents. An analyst notices that a particular threat intelligence feed is generating a high number of false positive indicators, causing unnecessary incident creation. The analyst wants to reduce noise without losing valuable intelligence from that feed. What is the most appropriate action?

Accepted Answer

Adjust the feed's reputation and confidence thresholds. Adjusting reputation and confidence thresholds allows the SOC to filter out low-confidence indicators that are likely false positives while still ingesting higher-confidence indicators. This maintains the value of the feed and reduces unnecessary incident creation, achieving the desired balance.

Answer

Remove the feed and replace it with a different source

Answer

Disable the feed entirely

Answer

Create a playbook to automatically close incidents from that feed

Question 6

A security operations center (SOC) wants to measure the effectiveness of their threat intelligence program. They need a metric that reflects how many of the indicators ingested from feeds were actually used in detecting or responding to incidents within Cortex XSOAR. Which Cortex XSOAR feature provides this information?

Accepted Answer

Indicator occurrences and related incidents. The correct answer is indicator occurrences and related incidents. This feature links indicators to the incidents in which they appear, allowing the SOC to see which threat intelligence was actionable. By analyzing these relationships, teams can assess whether their feeds are providing value and adjust their intelligence sources accordingly.

Answer

Incident dwell time

Answer

Number of enabled feed integrations

Answer

Feed integration health status

Question 7

A SOC analyst is reviewing a threat intelligence report that contains a list of IP addresses associated with a known botnet. The analyst wants to quickly determine which of these IPs have been observed in the organization's network logs. Which type of threat intelligence is most directly used for this purpose?

Accepted Answer

Technical threat intelligence. Technical threat intelligence provides the concrete IOCs needed to search logs and identify malicious activity. Strategic, operational, and tactical intelligence offer context and higher-level insights but do not supply the raw IPs for direct matching. The analyst requires technical indicators to perform the lookup.

Answer

Strategic threat intelligence

Answer

Tactical threat intelligence

Answer

Operational threat intelligence

Question 8

A security analyst is investigating a phishing incident in Cortex XSOAR. The analyst needs to determine the reputation of a suspicious domain found in the email. Which Cortex XSOAR feature provides this information by querying multiple threat intelligence sources?

Accepted Answer

Indicator enrichment. Indicator enrichment is the correct feature because it automatically queries multiple threat intelligence integrations to return reputation and context for indicators such as domains. This allows the analyst to quickly assess whether the domain is malicious without manually checking each source.

Answer

Evidence board

Answer

Incident type

Answer

Playbook task

Question 9

A Cortex XSOAR administrator is configuring a new threat intelligence feed that provides indicators in STIX 2.1 format. The administrator wants to ensure that the indicators are automatically tagged with a specific source name for easy filtering. Which configuration step is required?

Accepted Answer

Set the 'Source' field in the feed integration instance settings.. The correct answer is to set the 'Source' field in the feed integration instance settings. This field is specifically designed to assign a source name to all indicators from that feed, enabling easy filtering and attribution. It is a straightforward configuration that avoids custom scripting or rule creation.

Answer

Create a classification rule that adds the source name to the indicator.

Answer

Use a playbook that runs on indicator creation to add the tag.

Answer

Modify the indicator type definition to include a default source tag.

Question 10

A security analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious IP address communicating with an internal server. To determine if this IP is associated with known malicious activity, the analyst queries a threat intelligence platform. The platform returns a confidence score of 85% and tags the IP as 'C2'. However, the analyst notices that the IP belongs to a cloud hosting provider and could be legitimate. What should the analyst do next to validate the threat intelligence?

Accepted Answer

Correlate the IP with additional internal telemetry, such as proxy logs and endpoint data, to assess the context of the communication.. The analyst should correlate the IP with internal telemetry to understand the communication's context. This validation step is essential when threat intelligence has ambiguity, such as an IP from a cloud provider. It allows the analyst to make an informed decision about whether to block, monitor, or dismiss the indicator.

Answer

Immediately block the IP at the firewall based on the high confidence score.

Answer

Ignore the threat intelligence because the IP is from a cloud provider and likely legitimate.

Answer

Submit the IP to a public blocklist to prevent other organizations from communicating with it.

Question 11

A security analyst notices that a new threat intelligence feed is sending indicators with a 'confidence' field set to 'Low' for most entries. The team wants to ensure that only high-confidence indicators trigger automated blocking actions on the firewall. Which of the following is the most appropriate action to achieve this?

Accepted Answer

Create a playbook that filters indicators based on the confidence field before sending them to the firewall integration.. The correct answer is to create a playbook that filters indicators based on the confidence field before sending them to the firewall integration. This ensures that only high-confidence indicators trigger automated blocking, while low-confidence indicators are still stored and available for analysis. Playbooks in Cortex XSOAR provide the necessary conditional logic and are the standard method for implementing such business rules without losing data.

Answer

Manually review each indicator and tag high-confidence ones, then create a playbook that only blocks tagged indicators.

Answer

Set the firewall integration to only accept indicators with a 'High' confidence by configuring the integration instance settings.

Answer

Modify the feed integration to exclude any indicator with a confidence field lower than 'High' during ingestion.

Question 12

A security analyst is using the Structured Threat Information Expression (STIX) format to share threat intelligence with a partner organization. The analyst wants to include a relationship between an indicator and a malware object. Which STIX Domain Object (SDO) should the analyst use to represent this relationship?

Accepted Answer

Relationship. In STIX, relationships between SDOs are represented using the Relationship SDO. It connects two objects and specifies the nature of their association, such as 'indicates' or 'uses'. This allows for a graph-based model of threat intelligence. The analyst should use a Relationship object to link the Indicator and Malware, ensuring the partner organization understands the connection.

Answer

Observed Data

Answer

Indicator

Answer

Malware

Question 13

A SecOps analyst is investigating a phishing incident in Cortex XSOAR. The incident includes an email with a malicious attachment. The analyst wants to automatically extract and enrich all indicators from the attachment and then block them on the firewall. Which Cortex XSOAR component should the analyst use to orchestrate this workflow?

Accepted Answer

Playbook. A playbook in Cortex XSOAR is the orchestration component that automates multi-step processes, including indicator extraction, enrichment, and response actions like blocking. It allows the analyst to define the sequence and conditions for each step, ensuring consistent and efficient incident handling.

Answer

Indicator Extraction Rule

Answer

Incident Type

Answer

Integration

Question 14

A security operations center (SOC) uses Cortex XSOAR to manage incidents. They want to measure the effectiveness of their threat intelligence sources by tracking how many incidents are generated from each source and the average time to resolution. Which Cortex XSOAR feature should they use to collect and visualize this data?

Accepted Answer

Widgets and dashboards in the Cortex XSOAR UI, configured to display incident metrics grouped by source.. The correct answer is to use widgets and dashboards configured to display incident metrics grouped by source. Cortex XSOAR dashboards are highly customizable and can pull data from incidents, allowing the SOC to track incident volume and resolution times per intelligence source. This provides a real-time, visual representation that aids in evaluating source effectiveness and making informed decisions about feed prioritization or tuning.

Answer

The built-in 'Threat Intel' report in the Reports section, which automatically includes source effectiveness metrics.

Answer

Incident fields and a custom report using the Report Builder.

Answer

The Threat Intelligence Management (TIM) dashboard and indicator scoring.

Question 15

A security operations team is using Cortex XSOAR to manage threat intelligence. They want to ensure that indicators from a newly added feed are automatically tagged with a specific source name and that their reputation is set to 'Suspicious' by default. Which configuration should the team apply in Cortex XSOAR?

Accepted Answer

Configure the feed integration settings to assign a source tag and set the default reputation to 'Suspicious'.. Feed integration settings in Cortex XSOAR include options for source tagging and default reputation, allowing automatic application to all indicators from that feed. This ensures consistent handling and reduces manual effort, directly fulfilling the team's requirement.

Answer

Modify the indicator extraction rules to include the source tag and reputation.

Answer

Create a new indicator type with the desired default reputation and source tag.

Answer

Use a playbook that triggers on feed ingestion to update indicator fields.