Threat Detection And Incident Response practice questions

Content Packs

Why it fails: Content packs add functionality, they are not the enforcement mechanism.

Indicator Auto-Extraction

Why it fails: This identifies the IOC, it does not enforce the block.

Incident Layouts

Why it fails: Layouts are for UI display.

Automation Integrations

Why it fails: These are for running tasks, not gathering intelligence.

Incident Layouts

Why it fails: Layouts organize data.

Dashboard Widgets

Why it fails: Widgets display data, they do not gather context.

Incident Mapping

Why it fails: Mapping is for field translation, not the arrival of the incident.

User Permissions

Why it fails: Permissions affect access, not integration connectivity.

Playbook Workflow

Why it fails: Playbooks run after the incident is received.

Incident Mapping

Why it fails: This is for data ingest.

Close Incident

Why it fails: This is not a default task name.

Task Assignment

Why it fails: This assigns a task to an analyst.

Add a 'comp' stage to compress identical rows and reduce noise in the output

Why it fails: The comp stage aggregates and compresses similar rows, which is useful for summarization but does not establish a relationship between source and destination events. Applying it here would collapse the very event pairs the analyst needs to inspect, defeating the purpose of the lateral movement hunt.

Use the union operator to append destination logon events directly after source process events in a single result set

Why it fails: The union operator stacks rows from two queries without matching them on any field. While it produces a combined list, there is no correlation between a specific source process and a specific destination logon, so the analyst cannot prove which process caused which logon.

Filter the XQL dataset with a 'stage' clause that limits results to only the destination host events

Why it fails: A stage clause reduces the result set to a specific stage of a multi-stage query, but it does not create a relationship between source and destination events. Using it alone would drop the source-side process context, so the analyst could not see which process initiated the connection to the destination host.

WildFire analysis report, which detonates the renamed psexec.exe in a sandbox and reports the resulting behaviors and verdict.

Why it fails: WildFire performs dynamic sandbox analysis of files and returns a verdict and behavioral report for the submitted sample. It is valuable for understanding what a file does, but it does not search the entire endpoint fleet for other hosts that exhibited the same sequence of behaviors. It is a file-reputation and sandboxing service, not an environment-wide behavioral pivot mechanism.

IOC rule matching, which flags any future occurrence of the exact file hash of svc_host.exe on any endpoint.

Why it fails: An IOC rule based on the svc_host.exe hash would only detect that specific file. Because the attacker renamed psexec.exe, the hash may be known, but the scenario asks for behavioral correlation across endpoints, not hash-based matching. IOC rules are indicator-specific and would miss variants that change the hash while preserving the same behavior.

Endpoint scan, which runs a full antivirus scan on the affected host to locate additional copies of the malicious binary.

Why it fails: A full endpoint scan searches a single host for known malicious files and is useful for remediation on that host, but it does not correlate behavior across multiple endpoints. It also relies on signatures or hashes, so it would not identify other hosts exhibiting the same behavioral sequence unless those hosts contained the exact same file. It is too narrow for the stated goal.

Network packet payload signatures

Why it fails: BIOC rules in Cortex XDR focus on endpoint behavior, not deep packet inspection of network payloads. Network packet payload signatures are typically handled by network security devices like firewalls or IPS, not by endpoint BIOC rules. While Cortex XDR can correlate network events, BIOC rules themselves do not parse packet payloads. Therefore, this is not a valid component for a BIOC rule targeting credential dumping.

File hash values

Why it fails: File hash values are static indicators used in IOC rules, not in BIOC rules. BIOC rules detect behavioral patterns, such as a process opening a specific registry key or accessing memory, rather than matching known malicious file hashes. While hashes can be part of a broader detection strategy, they are not a component of BIOC rule definitions. The administrator needs behavioral conditions, not static signatures.

Email sender reputation

Why it fails: Email sender reputation is an email security concept, not an endpoint behavioral indicator. BIOC rules operate on endpoint telemetry such as process, file, and registry events. While Cortex XDR can ingest email security logs, BIOC rule definitions do not include email sender reputation as a condition. The administrator should focus on endpoint behaviors like process execution and registry access for credential dumping detection.

Add a task that uses the '!setIndicators' command to mark indicators as malicious

Why it fails: The '!setIndicators' command in Cortex XSOAR sets the reputation of indicators in the Cortex XSOAR database. While this can help with future correlation, it does not automatically push block actions to external security tools like firewalls or endpoint protection. Blocking across tools typically requires integration-specific commands or playbook tasks that enforce policies.

Use the '!ip' command to enrich IP indicators

Why it fails: The '!ip' command in Cortex XSOAR is used to enrich IP addresses by querying threat intelligence sources. While enrichment is important for context, it does not block the indicator across security tools. Blocking requires an explicit action such as adding to a blocklist or creating a policy. Therefore, this step alone does not fulfill the requirement to block malicious indicators.

Use the '!file' command to detonate the file in a sandbox

Why it fails: The '!file' command in Cortex XSOAR is used to detonate a file in a sandbox (e.g., WildFire) to obtain a verdict. While this can identify malicious files, it does not block indicators across security tools. Detonation is an analysis step, not a blocking action. The requirement is to block, so this step is insufficient on its own.

Isolate the endpoint from the network

Why it fails: Isolating the endpoint from the network in Cortex XDR blocks all network communication, including business-critical traffic. While it stops C2 traffic, it also disrupts the user's ability to work and may not be the best immediate action if the goal is to allow other communications. The analyst should first consider more targeted actions.

Terminate the malicious process on the endpoint

Why it fails: Terminating the malicious process in Cortex XDR stops the current C2 communication but does not prevent the malware from restarting or using other processes. It also does not block the C2 domain, so the malware could re-establish communication. This action alone is insufficient to prevent further exfiltration if the malware persists.

Quarantine the malicious file

Why it fails: Quarantining the malicious file in Cortex XDR removes the file from the endpoint, which may stop the malware if it relies on that file. However, if the malware is already running or has other components, quarantine may not stop the C2 traffic. Additionally, it does not block the C2 domain, so other instances could still communicate.

The playbook is not assigned to the incident type, so it does not trigger for this incident.

Why it fails: If the playbook is not assigned to the incident type, it would not run at all for any incident of that type. However, the scenario implies the playbook is configured but fails to execute enrichment tasks, which suggests it might be running but skipping tasks due to conditions. If the playbook were completely unassigned, no tasks would run, but the analyst would likely notice the playbook not starting at all.

The threat intelligence integration is disabled, preventing the playbook from executing any tasks.

Why it fails: While a disabled integration would cause enrichment tasks to fail, it would typically result in errors or failed tasks rather than the playbook not executing at all. The scenario states the playbook fails to execute enrichment tasks, but if the integration were disabled, the playbook would still run and might log errors. The more likely cause is a condition that prevents the playbook from starting or skipping those tasks entirely.

The incident's labels do not match the playbook's task conditions, causing the enrichment tasks to be skipped.

Why it fails: While labels can be used in task conditions, the most common reason for enrichment tasks not executing is severity-based conditions. Labels are often used for routing or categorization, but severity is a standard field for playbook triggers. Without additional context, severity mismatch is a more likely cause than label mismatch, especially since the scenario does not mention custom labels.

IOC Search

Why it fails: IOC Search queries known indicators such as hashes or IP addresses, which fileless attacks typically lack, so it cannot reconstruct process-creation and memory-execution activity. It is the right tool when you already hold specific indicators to hunt across endpoints.

Vulnerability Protection

Why it fails: Vulnerability Protection blocks exploitation attempts against known CVEs, not the process-creation and memory-execution events an analyst needs to reconstruct a fileless attack. It is correct when the goal is shielding unpatched software from exploit attempts.

Anti-Malware Policy

Why it fails: Anti-Malware Policy scans files and blocks known malicious signatures, so it cannot surface the process-creation and memory-execution telemetry a fileless attack leaves. It is the right tool for preventing and quarantining file-based malware at the endpoint.

Endpoint File Search

Why it fails: Endpoint File Search queries file metadata and hashes across endpoints, but it cannot run shell commands or browse arbitrary directories interactively. It is tempting because it inspects the file system remotely, and it would be correct when hunting for a specific filename or hash rather than executing commands.

Snapshot Manager

Why it fails: Snapshot Manager captures point-in-time endpoint state for later comparison or rollback, not interactive command execution or file browsing. It is tempting because snapshots support investigation, and it would be the right choice when you need to diff system state before and after an incident.

Policy Editor

Why it fails: Policy Editor configures agent behaviour rules and exception policies; it cannot open a remote shell or browse the endpoint file system. It is tempting because it governs what the agent blocks or allows, which is the correct tool when tuning prevention profiles rather than performing live triage.

App-ID configuration

Why it fails: App-ID classifies applications for policy enforcement; it does not forward threat logs to Cortex XSOAR. App-ID is the correct control when permitting or denying traffic by application rather than by port, which is unrelated to triggering playbooks from signature matches.

Security Policy Rule

Why it fails: Security policy rules control traffic permit/deny decisions and threat inspection; they do not dispatch log data to external systems. Log forwarding requires configuring a log forwarding profile with a syslog or HTTP server destination, which is what triggers Cortex XSOAR playbooks. Policy rules would be relevant for enforcing the threat signature match itself.

GlobalProtect Gateway

Why it fails: GlobalProtect Gateway terminates VPN tunnels for remote users; it plays no part in exporting threat logs to Cortex XSOAR. It is the right component when enabling remote user connectivity with host posture checks, not for log forwarding to a SOAR platform.

War Room

Why it fails: The War Room is the collaborative incident timeline where analysts chat, run commands and document findings; it does not render the playbook's task-by-task execution graph. That visual flow lives in the Playbook tab of the incident. War Room is correct when you need an audit trail of analyst actions and evidence.

Evidence Board

Why it fails: The Evidence Board displays incident artefacts and investigation evidence, not playbook task execution. It is tempting because it visualises incident-related data, but the real-time playbook flow with task statuses appears in the playbook's War Room view instead.

Indicator Tab

Why it fails: The Indicator Tab lists extracted indicators and their reputations; it holds no playbook task graph or live execution state. It is the correct place to review and enrich IOCs during an investigation, which is why it appears relevant to incident work.

Forensics Tab

Why it fails: The Forensics tab holds raw endpoint artefacts such as memory dumps, process lists and file metadata for evidence collection, not the visual relationship graph. The Causality View chain links the alert to its initiating process, file and network connection; that is where analysts trace the attack sequence across the incident.

Network Activity

Why it fails: Network Activity lists outbound connections and bytes, but the incident view's Causality Chain tab is what visually links the injected process, its parent file, and the resulting network connection. Network Activity is the right place to pivot on a suspicious destination IP once that causal link is already established.

Alert Details

Why it fails: Alert Details shows the raw detection metadata, severity, and rule name for the triggering event, not a graph correlating process, file, and connection. It is the correct tab when you need the detection's own attributes, but the Causality Chain tab supplies the visual relationship this scenario asks for.

DoS Protection Profile

Why it fails: DoS Protection profiles defend against volumetric and resource-exhaustion floods, not the protocol-level inspection that identifies malicious SMB patterns. It is tempting because lateral movement can generate anomalous traffic volumes, but it would be correct for mitigating SYN floods or session exhaustion, not for detecting SMB exploit behaviour.

URL Filtering Profile

Why it fails: URL Filtering classifies web destinations and enforces category-based access, so it cannot inspect SMB protocol fields for malicious patterns. It is tempting because it blocks malicious infrastructure, but that applies to HTTP and HTTPS sessions; it would be correct for restricting access to phishing or malware-hosting sites, not SMB lateral movement.

File Blocking Profile

Why it fails: A File Blocking Profile controls which file types traverse the firewall, not the protocol inspection that detects malicious SMB patterns such as exploit attempts or credential abuse. It is tempting because SMB carries files, but it would be correct for stopping executable downloads or uploads, not for inspecting SMB protocol behaviour.

Application Override

Why it fails: Application Override forces traffic on specified ports to a named application, bypassing App-ID signature inspection; it cannot block a domain. It is tempting because overrides do control how traffic is classified, but the correct object is a URL Filtering profile or EDL entry pushed via Panorama to block the C2 domain globally.

Security Policy Action

Why it fails: A security policy action permits or denies traffic based on matched zones, addresses, applications and URL categories; it does not itself hold a domain blocklist. It is tempting because deny actions do block traffic, but the domain must first exist in a URL Filtering profile or EDL pushed globally by Panorama.

Threat ID

Why it fails: Threat IDs are signatures detecting exploits, spyware and vulnerabilities within content updates; they are not domain blocklist entries. It is tempting because threat prevention profiles do block malicious traffic, but a C2 domain requires a URL Filtering profile or external dynamic list distributed by Panorama to every managed firewall.

Incident Forensics

Why it fails: Incident Forensics presents the timeline and artefacts of an existing incident for investigation; it does not run ad hoc unified queries across all data sources. It is tempting because it correlates evidence visually, and it would be correct when triaging a detected incident rather than hunting raw logs.

SQL Query Builder

Why it fails: SQL Query Builder generates SQL against the Cortex Data Lake dataset rather than the XQL unified language spanning endpoint, network and cloud sources. It is tempting because SQL is familiar, and it would be correct for structured reporting over a single dataset.

Log Parser

Why it fails: Log Parser defines ingestion field extraction and normalisation rules for incoming data; it does not execute queries across datasets. It is tempting because parsing underpins searchable logs, and it would be the right choice when onboarding a new log source whose fields need mapping.

Endpoint isolation

Why it fails: AutoFocus is a threat-intelligence and analysis service that correlates WildFire and PAN-DB data to prioritise indicators; it does not quarantine or isolate hosts. Endpoint isolation is performed by Cortex XDR, so this would be the right answer only for a question about containing a compromised endpoint.

Log storage

Why it fails: AutoFocus aggregates and enriches threat intelligence rather than storing raw firewall traffic logs; log retention is the role of the firewall's local log storage or Cortex Data Lake. This would be correct only if the question asked where session and threat logs are retained for compliance.

Automated firewall rule creation

Why it fails: AutoFocus provides threat-intelligence context and indicator correlation; it does not push policy to firewalls. Automated rule creation is handled by the firewall's own policy engine or by Panorama templates, so this would fit only a question about centrally provisioning firewall policy at scale.

Containment

Why it fails: Containment limits the spread and impact of a confirmed incident, such as isolating affected hosts, which presupposes that identification and triage have already occurred. It is tempting because containment is an early active-response step, and it would be correct when describing actions taken to stop lateral movement after verification.

Eradication

Why it fails: Eradication removes the root cause, such as deleting malware or closing the exploited vulnerability, which happens after the alert has been verified. It is tempting because eradication follows detection closely, and it would be correct when describing elimination of the threat once the incident is confirmed and contained.

Recovery

Why it fails: Recovery restores systems and data to normal operation after the threat is removed, so it occurs long after identification and triage. It is tempting because recovery is a distinct, well-known lifecycle stage, and it would be correct when describing restoration activities following successful eradication and validation.