Free SecOps-Pro sample questions

Correct answer: Create a custom role with 'Incident & Alert View' permissions, 'Investigation View' permissions, and disable all 'Response Action' privileges.

Cortex XDR allows for granular custom roles. To meet the requirement of viewing and investigating without response capabilities, a custom role must be created where View permissions are granted but Response Actions (like isolation or Live Terminal) are explicitly disabled. The Instance Administrator role is too powerful regardless of scoping.

Correct answer: Configure the retention policy within the Cortex Data Lake settings to specify a retention period of 90 days for the relevant log types.

Cortex Data Lake allows administrators to define retention policies based on time. Setting a specific 90-day retention policy ensures that data is kept for the required compliance period and then purged, regardless of storage quota usage (assuming quota is sufficient). Relying on overwrite (Option B) is risky for compliance as volume fluctuations could shorten the retention window.

Correct answer: Create a custom Dashboard with widgets for MTTD/MTTR and Incident Severity, then use the 'Schedule Report' feature to email it weekly.

Cortex XDR allows users to build custom dashboards with specific widgets (including operational metrics like MTTD/MTTR) and then schedule these dashboards to be generated as PDF reports and emailed to stakeholders on a recurring basis. This directly addresses the automation and content requirements.

Correct answer: ML is a subset of AI that involves systems learning from data to identify patterns (like behavioral anomalies) without explicit programming, while AI is the broader science of mimicking human intelligence.

This is the correct technical distinction. In Cortex products, ML is specifically used for Behavioral Threat Protection (BTP) and analytics (learning baselines to find anomalies). AI is the overarching umbrella term. The other options reverse the relationship or misapply the terms to static signatures.

Correct answer: Causality View

The Causality View (or Causality Chain) is the primary visualization tool in Cortex XDR that displays the parent-child relationships of processes, file modifications, and network connections, allowing analysts to trace the root cause and sequence of an attack.

Correct answers: Security Orchestration, Automation, and Response (SOAR); Security Information and Event Management (SIEM)

SOAR platforms (like Cortex XSOAR) are essential for automating incident response workflows and orchestrating actions across disparate tools.

SIEM systems are foundational to the SOC for aggregating logs, correlating events, and providing a centralized view of security alerts.