SecOps-Pro practice questions 31–35

1. Question 31 · 35 in bank

   Why would a security engineer be unable to activate Cortex XDR analytics when configuring data sources and alert sensors during a Cortex XSIAM evaluation?

   • APathfinder must be activated before turning on analytics.
   • BThe engineer still needs to activate the Identity Analytics engine.
   • CBaseline requirements must be met before activating analytics.
   • DThe engineer needs to install the Analytics engine.

   Show answer

   Answer: C

   Next question

2. Question 32 · 35 in bank

   What would an account administrator configure when allowing Cortex XDR user access to only a specific endpoint group?

   • AIdentity provider (IdP) account placed in the appropriate group
   • BRole-Based Access Control (RBAC) with a predefined role
   • CCustomer Support Portal account with the appropriate role
   • DScope-Based Access Control (SBAC) with specific tags

   Show answer

   Answer: D

   Next question

3. Question 33 · 35 in bank

   Which action should an administrator take to create automated response actions when a user account is compromised?

   • AMap the events as a type of Cortex XSOAR incident, then run a playbook.
   • BCreate playbook triggers in Cortex XSIAM and run playbooks for each alert.
   • CCreate a script in Cortex XSOAR that will run a playbook based on the scenario.
   • DRun a custom script from the Cortex XDR script library.

   Show answer

   Answer: A

   Next question

4. Question 34 · 35 in bank

   Which list accurately identifies out-of-the-box indicator types that can be queried?

   • AIPv4, URI, Threat Group, Hacking Tool
   • BInfrastructure, URL, Threat Actor, Tool
   • CIP Address, Web Link, Adversary, Exploit Kit
   • DNetwork Address, Hyperlink, Attacker, Weapon

   Show answer

   Answer: B

   Next question

5. Question 35 · 35 in bank

   An analytics alert is generated for a user account with a high volume of suspicious file deletions across multiple internal file shares, and a threat hunter is assigned to investigate the scope of the potential insider threat. Which activity aligns with the threat hunting phase of this investigation?

   • AReview all system access logs for the past six months to identify the exact point of the user’s initial compromise.
   • BUse the Response Actions tool to isolate the user’s workstation from the corporate network.
   • CCreate an automation rule in Cortex XDR to automatically disable the user’s account upon the next anomalous action.
   • DWrite an XQL query to find similar file deletion patterns and volumes from other high-risk or privileged accounts.

   Show answer

   Answer: D

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SecOps-Pro practice, question 31. 35 questions available.