A threat intelligence team is ingesting indicators from multiple feeds. They notice that some indicators are duplicated across feeds, and they want to avoid duplicate entries in the indicator database. What feature of Cortex XSOAR TIM should they use?

The 'Feed Health' report, which shows feed status but does not affect duplicates.

Indicator deduplication, which automatically merges indicators with the same value and type.

The 'Remove Duplicates' playbook, which they must run after each feed ingestion.

The 'Indicator Expiration' setting, which removes old indicators.

A security team wants to use a specific integration from a content pack, but the pack is not yet installed. They also want to ensure that the integration's configuration (API keys, URLs) is stored securely. What is the correct approach?

Use the integration's default configuration without installing the pack, since integrations are built into the core XSOAR platform.

Install the pack, but store the API keys in a plain text field in the integration configuration.

Install the pack from the Marketplace, then configure the integration instance with credentials stored in the XSOAR credential vault.

Manually create the integration by writing Python code in the Playground, then store API keys in a playbook variable.

A playbook is designed to handle network alerts. It has a conditional task that checks if the source IP is in a blocklist. If the IP is blocked, the playbook should automatically create a ticket in the ticketing system. If not, it should proceed to manual analysis. The playbook is not creating the ticket as expected. What is the most likely cause?

The ticketing system integration is not installed.

The playbook is not attached to the incident type.

The War Room is not open for the incident.

The conditional task's paths are not correctly configured, so the playbook is taking the wrong branch.

Palo Alto NetworksCertified Security Operations Professional

Domain 4Objective 1

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Part of the Cortex XSOAR domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

28questions here

6free pages

6concepts

16%of the exam

Questions 11–15

11foundation · easy
Which feature in Cortex XSOAR allows an analyst to manually run a command during a case investigation?
Select an answer first
12application · medium
A threat intelligence team is ingesting indicators from multiple feeds. They notice that some indicators are duplicated across feeds, and they want to avoid duplicate entries in the indicator database. What feature of Cortex XSOAR TIM should they use?
Select an answer first
13application · medium
A security team wants to use a specific integration from a content pack, but the pack is not yet installed. They also want to ensure that the integration's configuration (API keys, URLs) is stored securely. What is the correct approach?
Select an answer first
14application · medium
A playbook is designed to handle network alerts. It has a conditional task that checks if the source IP is in a blocklist. If the IP is blocked, the playbook should automatically create a ticket in the ticketing system. If not, it should proceed to manual analysis. The playbook is not creating the ticket as expected. What is the most likely cause?
Select an answer first
15foundation · easy
In Cortex XSOAR, what is the term for a specific operation that an integration can perform, such as 'block an IP' or 'create a ticket'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

Which feature in Cortex XSOAR allows an analyst to manually run a command during a case investigation?

A threat intelligence team is ingesting indicators from multiple feeds. They notice that some indicators are duplicated across feeds, and they want to avoid duplicate entries in the indicator database. What feature of Cortex XSOAR TIM should they use?

A security team wants to use a specific integration from a content pack, but the pack is not yet installed. They also want to ensure that the integration's configuration (API keys, URLs) is stored securely. What is the correct approach?

In Cortex XSOAR, what is the term for a specific operation that an integration can perform, such as 'block an IP' or 'create a ticket'?

Keep studying — Cortex XSOAR