Online Access Free SecOps-Pro Exam Questions

Which identity security component is best suited to detect lateral movement within a compromised service account?

• A.Cortex Identity Threat Detection and Response (ITDR) module
• B.Cortex XSOAR
• C.Analytics behavioral indicator of compromise (ABIOC) feature
• D.Identity Analytics

A sophisticated APT group is observed using a custom, polymorphic malware variant. The only consistent indicator found across initial compromises is the use of a unique, newly registered domain (evil-command-control.xyz) for C2 communications, which is not yet widely known to public threat intelligence feeds. The security team needs to rapidly operationalize this domain indicator within their Cortex ecosystem for both prevention and detection.

• A.Submit the domain to WildFire for analysis and await a verdict, then manually create a custom URL filtering profile on the NGFW for the domain. Use Cortex XDR 'Search' to look for DNS queries to the domain.
• B.Leverage Cortex XDR's 'Indicator Management' to directly import the domain. This will automatically block traffic to the domain and trigger alerts on existing connections.
• C.Ingest the domain into a custom 'Threat Intelligence Feed' within Cortex XSOAR, which then automatically pushes it to an External Dynamic List (EDL) on all Next-Generation Firewalls.
  Concurrently, configure a new 'Analytics Rule' in Cortex XDR to alert on any network connections or DNS resolutions to evil-command- control. xyz.
• D.Modify the existing 'DNS Security Policy' on the NGFW to block all queries to .xyz top-level domains, and initiate a 'Live Terminal' session on affected endpoints to search for the domain in browser history.
• E.Create a custom 'AutoFocus Profile' for the domain evil-command-control.xyz and then use Cortex XSOAR to create a 'War Room' for manual investigation.

An analyst investigating an incident using Cortex XSIAM confirms that the files involved are not malware, but wants to determine if the incident is a genuine threat or a false positive. Which action will provide the analyst information for making the determination?

• A.Viewing the timeline and filter for a alerts
• B.Viewing the information alerts for the incident
• C.Checking the incident War Room for history and command tasks
• D.Checking the endpoint details if the machines involved

During a post-incident review of a successful ransomware attack, the incident response team identifies that initial alerts were generated but deprioritized due to an 'Information' severity classification. Analysis reveals the alerts, while individually low-fidelity, collectively pointed to a reconnaissance phase followed by credential access on a critical server. What adjustment to the incident categorization and prioritization framework would be most effective in preventing similar oversights?

• A.Develop correlation rules in the SIEM (e.g., Splunk, QRadar) or SOAR (e.g., XSOAR) to elevate incident severity based on sequences of related low-severity events targeting high-value assets.
• B.Increase the threshold for all network-based alerts by 50% to reduce false positives and focus only on high-severity alerts.
• C.Mandate manual review of all 'Information' severity alerts by a Tier 1 SOC analyst within 1 hour of generation.
• D.Categorize all alerts related to critical servers as 'High' severity by default, irrespective of the initial detection's confidence level.
• E.Implement an automated system to escalate any 'Information' level alert to 'Low' severity after 24 hours, regardless of context.

What is the role of content packs in Cortex XSOAR?

• A.To serve as a central location for installing, exchanging, and contributing content
• B.To provide rebuilt bundles for supporting security orchestration use cases
• C.To support technical support teams with relevant information required to troubleshoot
• D.To serve as a major software versioning update