SOC Fundamentals And Operations

Which TWO actions are considered 'Best Practices' for maintaining SOC operational documentation?

Which SOC operational document defines the service level objectives (SLOs) for incident response times?

Which TWO types of logs are critical for investigating a potential data exfiltration event?

In the SOC structure, which role is typically responsible for the initial triage and validation of security alerts?

A security analyst is investigating a phishing alert in Cortex XSOAR. Which workflow component is best utilized to standardize the response process for repetitive phishing email triage?

In Cortex XSOAR, which feature allows you to automatically create an incident when a specific email is received in a monitored inbox?

Which THREE roles are commonly involved in the SOC operational structure?

An analyst is reviewing a firewall policy. Which feature allows them to view the traffic logs that specifically match that rule?

Which TWO metrics are essential when evaluating the effectiveness of a SOC operational process?

Which THREE methods can be used in Cortex XSOAR to ingest indicators?

In XSOAR, an analyst wants to share a finding with another team member. Which feature allows for real-time collaboration within the incident workspace?

While analyzing a breach, an analyst identifies an IOC that is not yet flagged by automated systems. Which tool is used to manually update the global blacklist to prevent further spread across the organization?

What is the primary purpose of a SOC 'Daily Standup' meeting?

Which TWO data sources should a SOC analyst correlate to identify a compromised user account?

Which type of alert in Cortex XDR represents a high-confidence threat that has been automatically grouped with related events?

During a threat hunting mission in XDR Query Builder, you need to find all processes running from the 'temp' directory. Which XDR language is utilized?

In the context of the SOC maturity model, which phase focuses primarily on the formalization of playbooks and the integration of automated threat intelligence?

You are designing a SOC operational workflow using Cortex XDR. You need to ensure that alerts from high-value servers are prioritized over workstations. What feature allows for this granular incident management?

An analyst needs to correlate logs from multiple Palo Alto Networks firewalls to identify lateral movement. Which tool provides the centralized log aggregation and analytics required for this operation?

Which component of Cortex XDR is responsible for blocking processes that display malicious behavior on an endpoint?

During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?

Which THREE items should be included in a standard SOC shift-handover report?

Which THREE features are provided by the Palo Alto Networks Cortex platform for SOC operations?

You are troubleshooting a connectivity issue between an internal log forwarder and Cortex Data Lake. Which command should you run on the log forwarder to verify the ingestion status?

Which THREE actions can be performed directly from the Cortex XDR incident details page?

A SOC manager wants to track the 'Mean Time to Acknowledge' (MTTA) for critical incidents. Which feature in Cortex XSOAR provides this visualization?

An analyst discovers a false positive alert in Cortex XDR. Where should they go to prevent this alert from triggering again?

Your organization has adopted a Zero Trust architecture. Which SOC operational process is most critical to validate that identity-based policies are effective?

An incident requires forensic acquisition of a compromised endpoint. Which feature within Cortex XDR enables you to pull specific file artifacts directly from the machine?

Which TWO of the following are key components of a mature SOC incident response plan?

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

A new SOC analyst wants to see all traffic blocked by the firewall in the last hour. Where should they navigate in the Panorama monitor tab?

You are investigating an alert involving a malicious user identity. Which Cortex XDR dashboard widget provides the best overview of the user's risk profile?