SECOPS-PRO Exam Questions

Which component of Cortex XDR is designed to detect insider threats?

A new incident in Cortex XSIAM contains WildFire malware and Behavioral Threat Protection (BTP) alertsout an unsigned process attempting to dump the memory of Isass.exe. Which init...

A file hash is evaluated a Cortex XSOAR by using two unique threat feeds: - VirusTotal feed (rating of B- usually reliable) and the file verdict is malicious - AlienVault feed (rat...

A customer is investigating a security incident in which unusual network traffic is observed and a malicious process is identified on an endpoint. Which Cortex XDR capability assis...

Where can an administrator begin to grant a new non-SSO user access to a Cortex XDR tenant?

Where can the actions taken to stitch alerts together in Cortex XSIAM be viewed?

What determines the indicator layout displayed and the scripts that will run on an indicator of compromise (IOC) in Cortex XSIAM?

Which action is performed as the final step of the NIST incident response plan?

What is the purpose of incident types in Cortex XSOAR?

Which activities are facilitated through the War Room in Cortex XSOAR?

What are the primary functions of the Causality Analysis Engine in Cortex XDR?

How do indicator verdicts in Cortex XSOAR assist analysts in threat detection and response efforts?

What is the function of a Causality View?

What is a primary responsibility of an incident responder in a SOC?

How do sensors function in Cortex XSIAM?

In which scenario would an organization benefit from Cortex XDR compared to an EDR solution?

What does the analytics engine use to compare an entity to itself across different time periods using statistical methods?

Which action is the responsibility of the SOC manager?

What role does incident response play in handling cybersecurity incidents?

What is the expected behavior when an endpoint is isolated in Cortex XSIAM?

Which two statements apply to creating scripts in Cortex XSOAR? (Choose two.)

Which two roles can access data model rules in Cortex XSIAM? (Choose two.)

Which two types of tasks are supported in Cortex XSIAM playbooks? (Choose two.)

Which scripting language would create a custom widget in Cortex XDR that shows the top five accounts with failed Windows logons in the past 24 hours?

Which solution will minimize mean time to resolution (MTTR) when, as a result of previous malware infection, a company's Windows endpoint is suffering a small amount of file corrup...

With a Windows endpoint, what is required to remove the Cortex XDR agent when the endpoint is no longer online and cannot be managed directly from the management console?

Which sensor is used by Cortex XSIAM to identify and collect DNS queries, HTTP header, and DHCP information?

What are two outcomes of threat intelligence in a SOC? (Choose two.)

Which MITRE enterprise tactic will provide more information on the technique used by a threat actor who has successfully used PsExec to upload files to an internal server from a co...

What is the main difference between artificial intelligence (AI) and machine learning (ML) in cybersecurity?

What is the WildFire verdict on a sample that does not pose a direct security threat, but is shown to display obtrusive behavior?

What is the Cortex XSOAR Marketplace?

Which two functions are allowed when stitching logs in Cortex XDR? (Choose two.)

Which two statements are relevant to reports in Cortex XDR? (Choose two.)

What is enabled by Role Based Access Control (RBAC) in Cortex XDR?

What are two ways a security team assigns priority to security incidents in Cortex XDR? (Choose two.)

A custom PowerShell command is detected by Cortex XDR as a behavioral threat, and the administrator has confirmed it as a false positive. What is the most operationally efficient w...

An analyst investigating an incident using Cortex XSIAM confirms that the files involved are not malware, but wants to determine if the incident is a genuine threat or a false posi...

What is involved in the day-to-day role of a triage specialist?

Which two steps belong in the Cortex XSOAR incident lifecycle? (Choose two.)

What can be used to triage and determine if an artifact in Cortex XDR is malicious?

What is a benefit of using Unit 42 threat intelligence during a ransomware attack?

Which function eliminates the need for manual analysis in an organization with multiple data sensors?

How can an administrator run a Cortex XSOAR playbook regularly at a specific time and day of the week?

Which predefined role in the Cortex XDR tenant can view and triage incidents?

A security auditor must ensure adherence to which two regulatory compliance frameworks when reviewing a financial institution's data protection policies? (Choose two.)

How is WildFire typically used by Cortex XDR?

Which attribute is an advantage of SOAR over SIEM?

Which SOC tool allows an organization to aggregate logs from various sources for compliance, reporting, dashboarding, and threat hunting?

Which task should a threat hunter include in the investigation when a Cortex XDR incident contains alertsout a malicious process?