34 questions · Threat Detection And Incident Response · All types, answers revealed
Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?
Causality allows analysts to see the sequence of events leading to the alert.
Why this answer
Causality provides visual process tracing and helps identify the root cause of an alert.
You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?
Vulnerability protection profiles inspect traffic for known exploits.
Why this answer
Vulnerability Protection profiles specifically look for exploitation attempts within network protocols like SMB.
An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?
BIOC rules detect behavioral patterns characteristic of attacks.
Why this answer
BIOC (Behavioral Indicator of Compromise) rules are designed to detect suspicious patterns of behavior like fileless execution.
An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?
The Causality View provides the visual map of process relationships.
Why this answer
The Causality View in Cortex XDR allows analysts to visualize the process tree and the chain of events that led to the security alert.
Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?
Files gathered during the investigation are stored here.
Why this answer
The Evidence Board acts as a repository for files, screenshots, and extracted indicators collected during an investigation.
In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?
AutoFocus provides deep context for threat hunting.
Why this answer
AutoFocus is a threat intelligence service that provides context and hunting capabilities for threats.
Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?
XSOAR can ingest emails to create incidents.
Why this answer
Analysts can trigger investigations via email ingestion or manual incident creation.
What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?
Cortex Data Lake is the logging backend for XDR.
Why this answer
Cortex Data Lake serves as the centralized repository for logs collected from firewalls, endpoints, and other security devices.
When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?
Live Terminal provides direct remote command execution.
Why this answer
The Remote Terminal or Live Terminal feature in Cortex XDR allows for direct command-line interaction with managed endpoints.
Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?
This is the core response cycle.
Why this answer
Preparation, Detection/Analysis, and Containment/Eradication/Recovery are core phases.
When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?
The join operator correlates datasets based on a specific field.
Why this answer
The 'join' operator is used in XQL to associate events from different datasets based on common keys like host_id or user_id.
You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?
The Set Incident task allows updating fields like status.
Why this answer
The 'Set Incident' task in XSOAR allows for the modification of incident attributes, including status.
Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?
Blocking C2 traffic limits the attacker's control.
Why this answer
Containment focuses on stopping the spread, such as isolating endpoints or blocking malicious network traffic.
Which TWO of the following are types of data that can be ingested into Cortex Data Lake?
Firewall logs are a primary source for Data Lake.
Why this answer
Cortex Data Lake collects logs from various sources including network firewalls and endpoint security agents.
In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?
Extraction parses raw data into usable indicators.
Why this answer
Indicator Extraction or RegEx patterns within an integration/task are used to parse and structure indicator data.
You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?
Log Forwarding profiles define the destination for security logs.
Why this answer
Log Forwarding profiles are required on the NGFW to transmit threat logs to external systems like XSOAR.
Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?
Network traffic data is stored and queryable.
Why this answer
XQL can query data from endpoint activity, network traffic, and system/cloud logs.
Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?
Threat logs contain details about detected signatures and anomalies.
Why this answer
Threat logs specifically capture information about security events identified by the NGFW security profiles.
During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?
Adding to a custom category allows for consistent blocking via policy.
Why this answer
Adding a URL to a Custom URL Category and then applying that category to a URL Filtering Profile is the standard way to block malicious domains.
When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?
Work Plan shows the visual progression of the playbook.
Why this answer
The Work Plan tab in an incident displays the current status and execution path of the playbook.
In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?
Automation scripts perform the enforcement action across integrated platforms.
Why this answer
The Indicator Auto-Extraction and subsequent Automation Scripts in XSOAR can trigger blocking actions across integrated products.
Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?
WildFire runs files in a sandbox.
Why this answer
WildFire performs static analysis, dynamic analysis, and automated signature creation.
An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?
Stitching aggregates related alerts into a single incident.
Why this answer
Cortex XDR uses Incident Stitching to group related alerts based on causality and common indicators.
Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?
This stage is where triage occurs.
Why this answer
The Detection and Analysis stage focuses on confirming that an incident occurred.
Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?
Threat Vault provides guidance on handling threats.
Why this answer
Threat Vault provides information on threat signatures and their associated mitigation strategies.
An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?
XQL is the unified query language for XDR data.
Why this answer
XQL (XDR Query Language) allows for cross-source searching and correlation.
An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?
WildFire analyzes files in a sandbox to identify malicious behavior.
Why this answer
WildFire's cloud-based sandbox performs dynamic and static analysis on suspicious files.
Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?
BIOCs find patterns, IOCs find known bad artifacts.
Why this answer
BIOC rules detect sequences of actions or behaviors, while IOCs look for static identifiers like hashes.
You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?
Forensic collection gathers artifacts for deep analysis.
Why this answer
The Forensic Analysis/Collection feature in Cortex XDR allows for remote collection of memory and disk artifacts.
When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?
Isolation blocks network traffic to contain the threat.
Why this answer
Isolating the endpoint prevents all network communications except to the XDR console.
Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?
You can run shell commands like ipconfig or netstat.
Why this answer
Live Terminal allows for file management, process management, and diagnostic command execution.
You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?
These settings define how XDR and XSOAR exchange data.
Why this answer
The XDR-XSOAR integration instance configuration defines the flow of alerts into XSOAR.
When investigating a compromise, you find an artifact in XSOAR. To gather more context about this file without leaving the platform, which integration should be utilized?
These integrations automatically pull data about IOCs.
Why this answer
Threat Intelligence integrations in XSOAR allow for automated lookups of IOCs against external sources.
Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?
The War Room serves as the collaborative investigation log.
Why this answer
The War Room is the primary location for documenting actions, running commands, and recording notes in XSOAR.
Ready to test yourself?
Try a timed practice session using only Threat Detection And Incident Response questions.