Question 16
A new incident in Cortex XSIAM contains WildFire malware and Behavioral Threat Protection (BTP) alerts about an unsigned process attempting to dump the memory of lsass.exe . Which initial verdict applies to this incident?
Question 17
An XSOAR playbook for insider threat detection involves monitoring employee activity. If suspicious activity (e.g., large data exfiltration) is detected, the playbook needs to:
1 . Confirm the activity with a manager (manual approval).
2. If approved, temporary disable the user's network access via Active Directory and firewall.
3. If disapproved or no response within 2 hours, escalate to HR and security management.
4. Generate a detailed report of the activity.
Which set of XSOAR playbook features allows for this sophisticated orchestration, particularly the timed escalation and conditional branching based on human input?
Question 18
A critical zero-day vulnerability is publicly disclosed in a widely used web server. Your organization's incident response plan dictates immediate action to identify potential exploitation attempts. You have Palo Alto Networks NGFWs, access to WildFire, and subscribe to Unit 42 threat intelligence. Furthermore, your team frequently uses VirusTotal for initial reconnaissance. To swiftly identify and contain potential exploitation attempts, which of the following combined strategies offers the best immediate response capability and long-term intelligence gathering?
Question 19
An organization is migrating its security operations to a cloud-native model using Palo Alto Networks Cortex products. They need to establish a robust reporting framework that satisfies GDPR compliance requirements for data access logs. Specifically, they require:
1. A monthly report showing all access attempts to sensitive data repositories (identified by specific network zones or application names) by users, including the outcome (success/failure) and the data accessed.
2. This report must be auditable, meaning every data point can be traced back to its original log source and timestamp.
3. Data retention for these specific logs must be 5 years, even if the default CDL retention is shorter.
4. Automated anomaly detection for unusual access patterns (e.g., access outside working hours, unusually high volume of access).
Which architecture and process would be most suitable to meet these stringent requirements?
Question 20
A sophisticated adversary has managed to establish persistence on an internal server within an organization monitored by Cortex XSIAM, bypassing initial preventative controls. The XSIAM platform has generated an alert for 'Suspicious PowerShell Execution'. As a Tier 2 SOC analyst, you need to conduct a deeper investigation. Which combination of XSIAM capabilities and data artifacts would provide the most comprehensive understanding of the persistence mechanism and lateral movement attempts?