最新的Security Operations Generalist認證 SecOps-Pro考試題庫

問題1

An administrator has configured Cortex XDR to ingest logs from third-party firewalls and is using Cortex XDR agents on endpoints. The goal is to see network connections from the firewalls correlated with the endpoint processes that initiated them. Which feature handles this correlation to form network stories?

A. Log stitching

B. Correlation rules

C. Pathfinder

D. Identity Analytics

正確答案: A

說明：（僅 VCESoft 成員可見）

問題2

An incident response team is investigating a potential breach involving an internal server communicating with a suspicious external IP address. Initial checks on VirusTotal for the external IP yield no results. Upon further investigation, network telemetry suggests the communication pattern is highly unusual and indicative of command-and-control (C2) activity. The team needs to determine if this C2 traffic is associated with a known threat actor, understand their TTPs, and identify specific exploit methods. Which of the following distinct characteristics, when comparing WildFire, Unit 42, and VirusTotal, are most critical for the team to leverage in this situation?
(Select all that apply)

A. The ability of VirusTotal to conduct real-time deep packet inspection on live network traffic to identify unknown C2 protocols.

B. WildFire's automatic generation and distribution of new threat signatures to Palo Alto Networks NGFWs upon detecting novel malware, ensuring proactive network protection against the C2.

C. Unit 42's comprehensive, human-curated threat intelligence reports providing detailed adversary profiles, campaign analysis, and TTPs, which can link the observed C2 to known threat groups.

D. WildFire's ability to perform deep, proprietary behavioral analysis of submitted malware samples, including C2 communications, even if the IP is not yet publicly blacklisted.

E. VirusTotal's aggregated community intelligence, allowing for rapid lookup of known bad hashes and URLs from various antivirus vendors and public sandboxes.

正確答案: B,C,D

說明：（僅 VCESoft 成員可見）

問題3

A customer is investigating a security incident in which unusual network traffic is observed and a malicious process is identified on an endpoint. Which Cortex XDR capability assists with correlating firewall network logs and endpoint data in this environment?

A. User authentication management

B. Log stitching

C. Indicator of compromise (IOC) rule

D. Analytics

正確答案: D

說明：（僅 VCESoft 成員可見）

問題4

In Cortex XDR, what can be used to notify analysts of atomic behavior related to processes, registry, files, and network activity?

A. Behavioral indicator of compromise (BIOC)

B. Network traffic analysis (NTA)

C. Indicator of compromise (IOC)

D. Analytics behavioral indicator of compromise (ABIOC)

正確答案: A

說明：（僅 VCESoft 成員可見）

問題5

You are a lead security engineer at a large enterprise, tasked with optimizing the organization's threat intelligence pipeline for maximum effectiveness against polymorphic malware and advanced persistent threats (APTs). The current setup primarily relies on basic SIEM correlation and generic firewall rules. Your goal is to implement a solution that provides real-time, context- rich intelligence, automates detection of unknown threats, and enables proactive defense. Which of the following architectural and operational decisions would be most aligned with achieving these objectives?

A. Focus exclusively on endpoint protection platforms (EPPs) with AI-driven behavioral analysis, as network-level threat intelligence is becoming less relevant for advanced threats.

B. Implement an extensive honeypot network to capture malware samples, then manually analyze them and submit hashes to VirusTotal for public validation.

C. Deploy Palo Alto Networks NGFWs with integrated WildFire cloud subscription for automated unknown file analysis and immediate signature distribution; subscribe to Unit 42's premium threat intelligence feeds for contextualized insights and adversary TTPs, and integrate these feeds into your SIEM for enhanced correlation and alerting.

D. Integrate all network logs with VirusTotal's public API for continuous hash lookups, and manually update firewall rules based on any new detections.

E. Purchase an open-source sandbox solution and develop custom Python scripts to parse its output into STIX/TAXII formats for ingestion into a generic firewall, avoiding proprietary solutions.

正確答案: C

說明：（僅 VCESoft 成員可見）

問題6

Which solution will minimize mean time to resolution (MTTR) when, as a result of previous malware infection, a company's Windows endpoint is suffering a small amount of file corruption and modified registry keys?

A. Use Live Terminal to connect to the machine and upload files to replace the corrupted files.

B. Issue a new laptop from the help desk to expedite a clean system.

C. Use remediation suggestions to restore the affected files and registry modifications.

D. Use group policy objects to push new files and registry key changes to the endpoint.

正確答案: C

說明：（僅 VCESoft 成員可見）

最新的Palo Alto Networks Security Operations Professional - SecOps-Pro免費考試真題

最新更新

站內鏈接

聯系我們