A company uses Cortex XSOAR to orchestrate its security tools. They have a new email security gateway that provides an API for retrieving quarantined messages. The team wants to add this gateway to XSOAR so that playbooks can fetch and release quarantined emails. What is the first step they should take?

Use the built-in 'Email Gateway' integration that comes with XSOAR by default.

Search the Marketplace for an existing integration pack for the gateway; if none exists, develop a custom integration using the integration framework.

Configure the gateway as a new incident type in XSOAR.

Create a new playbook that directly calls the gateway's API using a generic HTTP request task.

A SOC analyst is investigating an incident and needs to pivot from an IP address to a related domain. They have the IP address in the War Room and want to find all indicators associated with it. What is the most efficient way to do this?

Use the 'Related Indicators' feature in the indicator's details page to see linked indicators.

Create a new incident and copy the IP address into it.

Manually search the War Room for any mention of the domain.

Run a playbook that queries all integrations for the IP address.

A threat intelligence team is ingesting indicators from a feed that includes a large number of low-confidence indicators. They want to ensure that these indicators are not used in active blocking playbooks, but they still want to store them for future analysis. What is the best way to handle this?

Do not ingest the low-confidence indicators at all.

Set the indicators to expire immediately after ingestion.

Set the indicators' reputation to 'Unknown' or 'None' and configure playbooks to only act on indicators with a 'Malicious' or 'Suspicious' reputation.

Use a separate indicator type for low-confidence indicators.

A threat intelligence team wants to automatically enrich indicators in Cortex XSOAR using a commercial threat feed. They have installed the feed integration and configured it. Now they want to ensure that indicators from this feed are automatically added to the indicator database and that playbooks can use them for enrichment. What must they configure?

Create a playbook that manually runs the 'get-indicators' command on a schedule.

Enable the 'Fetch indicators' option in the feed integration's instance configuration.

Add the feed's URL to the 'Indicator Extraction' settings in the incident layout.

Configure the feed as a 'Custom' indicator type in the TIM settings.

How does Cortex XSOAR interact with third-party systems such as SIEMs, firewalls, and ticketing tools?

Through integrations that provide actions and commands

Through manual data entry by analysts

By directly accessing the third-party system's database

Palo Alto NetworksCertified Security Operations Professional

Domain 4Objective 1

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Cortex XSOAR domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

28questions here

6free pages

6concepts

16%of the exam

Questions 16–20

16application · medium
A company uses Cortex XSOAR to orchestrate its security tools. They have a new email security gateway that provides an API for retrieving quarantined messages. The team wants to add this gateway to XSOAR so that playbooks can fetch and release quarantined emails. What is the first step they should take?
Select an answer first
17expert · hard
A SOC analyst is investigating an incident and needs to pivot from an IP address to a related domain. They have the IP address in the War Room and want to find all indicators associated with it. What is the most efficient way to do this?
Select an answer first
18expert · hard
A threat intelligence team is ingesting indicators from a feed that includes a large number of low-confidence indicators. They want to ensure that these indicators are not used in active blocking playbooks, but they still want to store them for future analysis. What is the best way to handle this?
Select an answer first
19application · medium
A threat intelligence team wants to automatically enrich indicators in Cortex XSOAR using a commercial threat feed. They have installed the feed integration and configured it. Now they want to ensure that indicators from this feed are automatically added to the indicator database and that playbooks can use them for enrichment. What must they configure?
Select an answer first
20foundation · easy
How does Cortex XSOAR interact with third-party systems such as SIEMs, firewalls, and ticketing tools?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

A SOC analyst is investigating an incident and needs to pivot from an IP address to a related domain. They have the IP address in the War Room and want to find all indicators associated with it. What is the most efficient way to do this?

A threat intelligence team is ingesting indicators from a feed that includes a large number of low-confidence indicators. They want to ensure that these indicators are not used in active blocking playbooks, but they still want to store them for future analysis. What is the best way to handle this?

How does Cortex XSOAR interact with third-party systems such as SIEMs, firewalls, and ticketing tools?

Keep studying — Cortex XSOAR