SOC Fundamentals And Operations practice questions

BiS Rules

Why it fails: BiS rules are for Behavioral Indicator of Security, not asset prioritization.

Alert Exclusion Profiles

Why it fails: Exclusion profiles stop alerts, they do not manage priority.

Agent Profiles

Why it fails: Agent profiles manage settings, not incident prioritization.

Dynamic Address Groups

Why it fails: Dynamic Address Groups build membership from tags and criteria, so they cannot be edited to add a specific indicator manually. This is tempting because they enforce policy on endpoints, but the global blacklist is updated through the Block List, where an analyst adds the IOC's hash, domain or IP directly.

Security Profiles

Why it fails: Security Profiles in Microsoft Defender for Endpoint tune detection and response behaviour, such as file and network protection settings, rather than maintaining a tenant-wide indicator list. Manually adding an IOC to block it across the organisation requires the Indicators blade, where hashes, IPs and URLs are submitted with a block action.

Service Objects

Why it fails: Service Objects group ports, applications and protocols for policy rules; they hold no indicator data and cannot blacklist an IOC. This is tempting because they are reusable policy building blocks, but the global blacklist is maintained in the Block List, where the analyst manually adds the hash, domain or IP.

show system status

Why it fails: This shows general system health, not log forwarding metrics.

test log-collector connectivity

Why it fails: This command does not exist in the standard PAN-OS interface.

debug log-forwarding status

Why it fails: This is not the correct command for checking ingestion.

Network > Interfaces

Why it fails: This is for configuration of network ports.

Policies > Security

Why it fails: The Security policy rulebase defines permit and deny criteria; it holds no per-session logs, so no blocked-traffic history appears. It is tempting because rule order and shadowing are audited here, which is the correct place when verifying why a rule matches, not when reviewing recent denials.

Objects > Services

Why it fails: Services are reusable port and protocol definitions referenced by policy rules; they contain no traffic records. It is tempting because creating or editing a service object is the right task when a required application port is missing from an allowed rule, not when reviewing what the firewall already blocked.

Runbook

Why it fails: Runbooks are technical guides for tasks.

Security Policy

Why it fails: Policies define rules, not performance targets.

Playbook

Why it fails: Playbooks define steps, not service level objectives.

Cortex XDR Query Builder

Why it fails: Query Builder allows analysts to search across collected endpoint data using XQL, but it does not inherently visualize process lineage or the causal chain of events. It could be used to manually search for the IP, but the Causality Chain is purpose-built for this investigation scenario.

Cortex XDR Threat Intelligence Module

Why it fails: The Threat Intelligence module provides context about known malicious indicators and their reputation. It can confirm that the IP is malicious, but it does not show whether the connection was blocked or reveal other processes on the host that communicated with that IP, which requires endpoint event data.

Cortex XDR Incident Response Playbook

Why it fails: Incident Response Playbooks in Cortex XDR are automated workflows that execute predefined actions like isolating endpoints or blocking indicators. While useful for remediation, they do not provide the interactive, visual investigation of process relationships and network events that the analyst requires here.

Indicator Extraction

Why it fails: Indicator Extraction automatically identifies and extracts IOCs from incident data, but it does not automatically share them with external systems. It is a prerequisite step that populates the incident with indicators, which can then be used by other features. Without a separate integration or playbook, extraction alone does not push IOCs to a TIP.

Indicator Relationships

Why it fails: Indicator Relationships define logical connections between indicators, such as a domain resolving to an IP. This helps in understanding the context of an attack but does not facilitate sharing with external platforms. It is an internal enrichment feature, not an outbound integration for threat intelligence dissemination.

Playbook Tasks

Why it fails: Playbook Tasks can be configured to send IOCs to a TIP if a task is specifically built with that integration. However, the feature itself is not dedicated to IOC sharing; it is a general automation component. The analyst would need to create or modify a playbook to include such a task, which is not as direct as using a built-in sharing mechanism.

Cortex XDR

Why it fails: Cortex XDR is an endpoint detection and response platform that surfaces local telemetry and alerts, not a global file reputation lookup. WildFire supplies the worldwide prevalence and verdict for a submitted hash. Cortex XDR would be correct when correlating endpoint incidents across an estate.

Threat Vault

Why it fails: Threat Vault publishes signatures, advisories and countermeasure data, but it does not report global file prevalence or WildFire verdicts. It is tempting because it is a threat-intelligence repository, yet file prevalence and classification come from WildFire, which aggregates submissions across customers.

GlobalProtect

Why it fails: GlobalProtect is Palo Alto's endpoint VPN and agent, providing remote access and host posture checks; it holds no file reputation database. WildFire performs the global prevalence and classification lookup for a hash. GlobalProtect would be chosen when the requirement is secure remote connectivity, not threat intelligence.

Optimized

Why it fails: The Optimized phase concentrates on continuous improvement, metrics and tuning of existing detection and response, not on first formalising playbooks or integrating threat intelligence feeds. It tempts because maturity models place automation late, but playbook formalisation and threat-intel integration define the earlier Proactive phase.

Managed

Why it fails: The managed phase covers outsourced or co-managed SOC operations, not the internal formalisation of playbooks and automated threat intelligence integration. Managed would be the correct choice where a third party delivers monitoring and response under contract.

Ad-hoc

Why it fails: Ad-hoc describes the initial, unstructured phase where monitoring is reactive and undocumented, so playbooks and automated threat intelligence integration are absent by definition. It is tempting because many SOCs genuinely start here, but the question asks about the phase where formalisation and automation first appear, which is a later, defined maturity stage.

Playbook Indicators

Why it fails: Playbook Indicators are inputs and outputs extracted during playbook execution, used for task conditions and outputs, not incident timing metrics. MTTA tracking is tempting to associate with playbooks because they drive incident response, but the metric itself is surfaced through incident dashboards, reports and SLA fields in Cortex XSOAR.

War Room logs

Why it fails: War Room logs record the entries, commands and collaboration history inside a single investigation, so they hold no aggregated timing metrics across incidents. MTTA reporting comes from Cortex XSOAR's built-in dashboards and reports, which compute incident lifecycle timestamps. War Room logs would be the right source when auditing what an analyst did during one specific incident.

Incident Layouts

Why it fails: Incident Layouts control how individual incident fields and tabs are arranged for analysts, not metric aggregation. MTTA reporting requires the built-in dashboard widgets or reports that compute timestamps across incidents. Layouts would be the right choice when customising which fields appear on an incident's detail view.

AutoFocus

Why it fails: AutoFocus provides threat intelligence correlation and indicator context, not raw log aggregation across firewalls. Cortex Data Lake or Strata Logging Service centralises firewall logs for lateral-movement analytics; AutoFocus suits pivoting on threat indicators and campaign attribution.

Panorama

Why it fails: Panorama centralises firewall management, policy push, and device configuration, but its logging scope is operational and policy-oriented rather than full analytics across many firewalls. Cortex Data Lake or Strata Logging Service aggregates and queries those logs for lateral-movement detection; Panorama suits multi-firewall administration.

Prisma Access

Why it fails: Prisma Access is a cloud-delivered SASE platform providing secure web gateway and firewall services at the network edge, not a log aggregation repository. It cannot ingest and correlate traffic logs from on-premises firewalls. It would be the right choice when replacing physical perimeter appliances with cloud-delivered security for remote users and branches.

Threat Researcher

Why it fails: Threat researchers study adversary tactics, campaigns and emerging indicators to improve detection content; they do not perform first-line alert triage. It is tempting because the role is analytical and security-focused, but initial validation of alerts belongs to Tier 1 analysts monitoring the queue.

Tier 3 Analyst

Why it fails: Tier 3 analysts handle deep-dive investigation, malware reverse engineering and threat hunting, escalating only after Tier 1 has validated alerts. It is tempting because Tier 3 carries the deepest technical expertise, but initial triage and validation sit with Tier 1, not the escalation tier.

SOC Manager

Why it fails: The SOC Manager owns staffing, metrics and escalation governance, not alert triage; analysts perform initial validation. It is tempting because the manager oversees the SOC's workflow, and would be the answer if the question asked who reports incident status to leadership or allocates shift coverage.

Integration instance

Why it fails: An integration instance only connects XSOAR to an external product, such as the email gateway or sandbox, for executing commands. It is tempting because integrations perform the actual enrichment and remediation actions, but standardising repeatable triage steps requires a playbook, which orchestrates those instances.

Indicator auto-extraction

Why it fails: Indicator auto-extraction pulls observables such as URLs and hashes from incident data, feeding enrichment rather than defining the response sequence. It is tempting because phishing triage relies heavily on extracted indicators, but it is a data-gathering step, not the component that standardises the repeatable workflow itself.

Dashboard widget

Why it fails: A dashboard widget only visualises metrics and alert data; it cannot execute or sequence triage steps, so it cannot standardise a repeatable phishing response. It is tempting because dashboards do surface phishing alert volumes and status, but they are for monitoring, not automating playbook tasks.

Hardware Lifecycle

Why it fails: Hardware lifecycle tracks device provisioning and retirement, which does not test whether identity-based access policies enforce correctly. It is tempting because device state feeds Zero Trust signals, but access reviews and sign-in log analysis are what validate policy effectiveness against real authentication events.

Patch Management

Why it fails: Patch management remediates software flaws, not identity policy effectiveness, so it cannot validate Zero Trust access decisions. It is tempting because patching supports security posture, but access review and sign-in log analysis are what actually test whether identity-based policies enforce correctly.

Vulnerability Scanning

Why it fails: Vulnerability scanning identifies software weaknesses, not whether identity policies block or allow access correctly, so it cannot validate Zero Trust enforcement. It is tempting because scanning supports risk reduction, but access review and sign-in log analysis are what test identity-based policy outcomes.

Live Terminal

Why it fails: Live Terminal provides an interactive remote shell for running commands, not a managed collection of specified file artefacts with hashes preserved for evidence. It is tempting because it does reach the endpoint directly, and would be correct for hands-on triage or command execution rather than forensic acquisition.

Scan Endpoint

Why it fails: Scan Endpoint runs malware and indicator scanning against the host; it reports detections rather than retrieving chosen file artefacts for evidence. It is tempting because it also targets the compromised machine, and would be correct for threat hunting or verification sweeps rather than forensic artefact acquisition.

Quarantine File

Why it fails: Quarantine File isolates a suspicious executable on the endpoint, preventing execution, but does not retrieve artefacts for forensic analysis. It is tempting because quarantine is a core malware-response action, and it would be correct when containing a confirmed threat rather than collecting evidence.

Log

Why it fails: A Log is raw telemetry ingested from endpoints, firewalls or cloud services; it is not an alert at all, so it cannot represent a grouped high-confidence threat. It is tempting because logs are the foundation Cortex XDR correlates, but the grouping and severity verdict happen after ingestion, in the incident itself.

Indicator

Why it fails: An Indicator is a single atomic artefact such as a hash, IP address or domain observed in telemetry; on its own it carries no grouping or confidence verdict. It is tempting because indicators feed detection logic, but the grouped high-confidence threat is the incident built from correlated indicators, not the indicator itself.

Exclusion

Why it fails: An Exclusion prevents specified files, folders or processes from being scanned or alerted on, so it suppresses detection rather than representing a grouped high-confidence threat. It is tempting because exclusions are managed alongside detection policy, but they exist to reduce noise, not to aggregate related events into an incident.

Exception

Why it fails: An Exception is an administrator-defined rule that suppresses or bypasses detection for specified activity, so it reduces alerts rather than representing a grouped high-confidence threat. It is tempting because exceptions are configured in the same console, but their purpose is tuning false positives, the opposite of surfacing a confirmed incident.

Incident Classifier

Why it fails: The Incident Classifier maps incoming incident fields to types and severities after an incident already exists; it does not create incidents from mailbox events. It is tempting because classification sounds like intake, but mailbox-triggered incident creation is performed by a data collection integration or rule.

Data collection rule

Why it fails: A data collection rule defines how data is ingested and mapped into XSOAR, but it does not itself monitor an inbox and raise an incident. It is tempting because ingestion precedes incident creation, yet the mailbox-triggered creation requires a dedicated email integration or fetching instance.

Automation script

Why it fails: An automation script executes logic within an existing incident or playbook task; it cannot independently monitor a mailbox and spawn incidents. It is tempting because scripts can act on email content, but the triggering mechanism for mailbox-based incident creation is the email integration's fetch configuration.

Python

Why it fails: Python cannot query XDR telemetry; it is a general-purpose scripting language with no native access to Defender XDR tables. It is tempting because Python suits automation and API-driven hunting via the Microsoft Graph Security API, which would be the right approach for scheduled, custom analytics outside Query Builder.

Regex

Why it fails: Regex matches text patterns within strings; it cannot enumerate processes or filter by file path across the XDR schema. It would be correct inside a query for pattern-matching a field value, not as the language the Query Builder itself parses.

SQL

Why it fails: XDR Query Builder uses its own KQL-style schema and operators, not SQL syntax, so SQL statements will not parse. SQL is tempting because analysts already know SELECT, WHERE and JOIN, and it would be the right language for querying relational databases or exported log tables.

Exploit Prevention

Why it fails: Exploit Prevention blocks exploitation of software vulnerabilities, such as memory corruption attacks, rather than processes already running with malicious behaviour. It is tempting because it is a prevention module, and would be correct when stopping an exploit attempt against a vulnerable application.

Network Isolation

Why it fails: Network Isolation cuts an endpoint's network connectivity to contain a confirmed compromise; it does not terminate processes exhibiting malicious behaviour. It is tempting as a response action, and would be correct when containing a host already known to be compromised.

Host Insight

Why it fails: Host Insight inventories endpoint data and surfaces it for investigation; it takes no enforcement action against running processes. It is tempting because it is an endpoint agent component, but its purpose is visibility and asset context, not behavioural blocking, which the BIOC engine performs.

Technical training

Why it fails: Standups synchronise analysts on current incidents, priorities and blockers; technical training is delivered through dedicated sessions or knowledge-transfer programmes. It is tempting because standups do surface skill gaps, but the meeting's cadence and brevity serve operational hand-off, not structured instruction.

Vendor management

Why it fails: Standups coordinate analysts on live incidents and workload; vendor management sits with procurement and service-owner functions. It is tempting because third-party tooling issues may surface during standup, but discussing them there is escalation, not the meeting's primary purpose, which is intra-team situational awareness.

Long-term strategy planning

Why it fails: Standups address immediate operational coordination — active incidents, shift hand-offs and blockers — not long-term strategy, which belongs in roadmap or governance reviews. It is tempting because recurring meetings can inform strategy, but a daily fifteen-minute sync lacks the scope and stakeholder breadth that strategic planning demands.