Online Access Free SecOps-Pro Practice Test

In Cortex XSOAR, which key function is fulfilled by content packs, distinguishing them from individual content items like scripts or playbooks?

• A.Being a requirement for enabling high availability (HA) and disaster recovery across multiple servers
• B.Executing integration commands in a remote network segment
• C.Bundling related security content for versioning, distribution, and installation of specific use cases
• D.Serving as the core logging and auditing mechanism for all incident activities

A Security Operations Center (SOC) analyst is reviewing alerts generated by a Palo Alto Networks Next-Generation Firewall (NGFW) configured with Threat Prevention. An alert is triggered for an alleged 'C2 beaconing' activity from an internal host to an external IP address.
Upon investigation, the analyst discovers the external IP belongs to a legitimate cloud-based productivity suite, and the traffic is standard API communication. What is the most accurate classification of this alert, and what immediate action should be taken?

• A.False Positive; The alert was generated for legitimate traffic. Suppress the alert and create an exclusion for this specific communication pattern.
• B.False Positive; The alert was generated for legitimate traffic. Report to vendor and disable the C2 signature globally.
• C.True Positive; This is a confirmed C2 connection. Isolate the host immediately and initiate incident response.
• D.True Negative; The firewall correctly identified benign traffic. No action is required.
• E.False Negative; The firewall missed a true C2 connection. Reconfigure the firewall to be more aggressive.

A critical zero-day vulnerability is publicly disclosed in a widely used web server. Your organization's incident response plan dictates immediate action to identify potential exploitation attempts. You have Palo Alto Networks NGFWs, access to WildFire, and subscribe to Unit 42 threat intelligence. Furthermore, your team frequently uses VirusTotal for initial reconnaissance.
To swiftly identify and contain potential exploitation attempts, which of the following combined strategies offers the best immediate response capability and long-term intelligence gathering?

• A.Disabling the vulnerable web server entirely until a patch is released, and reviewing historical VirusTotal submissions for any related hashes.
• B.Proactively blocking all traffic to the affected web server and submitting its logs to VirusTotal for retrospective analysis.
• C.Monitoring public forums and social media for mentions of the vulnerability and applying generic network intrusion detection system (NIDS) rules.
• D.Focusing solely on endpoint detection and response (EDR) alerts, as web server exploitation is primarily an endpoint issue.
• E.Leveraging Unit 42's rapid vulnerability research and exploit intelligence to identify specific exploit patterns, configuring custom signatures or threat prevention profiles on NGFWs, and using WildFire for any observed suspicious payloads.

A security architect is designing a new incident response workflow that requires a specific playbook to be executed every Saturday at 1:00 AM to perform weekly archival and cleanup tasks. This process must be reliably scheduled within Cortex XSOAR. What should the architect use to ensure the playbook runs automatically per the specifications?

• A.Scheduled report configured to invoke a command for the playbook
• B.External cron job that uses the Cortex XSOAR API to start the playbook
• C.Playbook pre-execution hook that is set with a time-based trigger
• D.Job that initiates the playbook at the designated time

Which Cortex XSOAR capability provides sourcing, download, and management of curated collections of security orchestration content?

• A.Content contribution interface
• B.Deployment Wizard
• C.Content version control
• D.Cortex Marketplace