What is a primary responsibility of an incident responder in a SOC?

• A.Mitigating incidents that have been escalated
• B.Supervising vulnerability assessments and penetration tests
• C.Determining or adjusting criticality of alerts
• D.Developing incident recovery crises communications plans

Comment: *

Name: *

Email: *

Verification: *

A threat intelligence analyst is investigating a spear-phishing campaign. They have identified several malicious URLs and file hashes associated with the campaign. The analyst wants to ensure these indicators are added to Cortex XSOAR, automatically enriched, and distributed to relevant security controls, while also ensuring that false positives are minimized. Which XSOAR feature is primarily responsible for the automatic enrichment of these indicators and how can false positives be mitigated through its configuration?

• A.The 'Incident Management' module automatically enriches indicators. False positives are mitigated by manually reviewing each incident before action.
• B.The 'Indicator Types' configuration defines enrichment playbooks. False positives are mitigated by setting a high 'Reputation Threshold' for actions.
• C.The 'Threat Intelligence Management' module, specifically through 'Indicator Feeds' and 'Indicator Playbooks'. False positives are mitigated by configuring 'Score Thresholds' and 'Expiration Policies' on indicators, and by integrating multiple reputation services for verification.
• D.The 'Playbook' engine automatically enriches indicators based on defined tasks. False positives are mitigated by adding a 'Human Approval' task before any blocking actions.
• E.The 'Automation' scripts handle enrichment. False positives are mitigated by deploying a 'Blacklist' of known safe indicators.

Comment: *

Name: *

Email: *

Verification: *

An incident in Cortex XSIAM displays alerts for "Lsass Memory Dump" originating from a process named proc_dump.exe. The process is unsigned, has an unknown reputation, and was launched from a temporary directory. Which initial verdict applies to this incident?

• A.True positive
• B.False negative
• C.True negative
• D.False positive

Comment: *

Name: *

Email: *

Verification: *

A large enterprise utilizes Palo Alto Networks security infrastructure, including NGFWs, Cortex XSOAR for security orchestration, automation, and response, and a centralized SIEM. An analyst discovers a critical vulnerability (CVE-2023-XXXX) affecting a widely used internal application.
Threat intelligence indicates this vulnerability is being actively exploited by a known APT group.
The SOC'S current detection rules and playbooks within XSOAR do not explicitly cover this specific CVE. What is the most significant risk associated with this gap from a detection classification standpoint, and how should Cortex XSOAR be leveraged to mitigate it proactively?

• A.The risk is a True Positive overload, as all scans for the vulnerability will generate alerts. XSOAR should be used to automatically suppress these alerts.
• B.The risk is primarily a False Positive from misconfigured rules. XSOAR should be used to create custom reports to monitor for this misconfiguration.
• C.The primary risk is a False Negative. XSOAR should be leveraged to ingest the new threat intelligence, automatically create new indicators of compromise (IOCs) and detection rules within the SIEM and NGFW, and update playbooks for automated response to confirmed exploits.
• D.The risk is a True Negative. XSOAR should be used to ensure the vulnerability is not present on any systems, thus confirming no threat.
• E.The risk is an 'unknown' state. XSOAR can only be used reactively after an incident has occurred.

Comment: *

Name: *

Email: *

Verification: *

A SOC is implementing a comprehensive 'Zero Trust' architecture using Palo Alto Networks products. As part of this, they need to ensure that even internal lateral movement is strictly controlled and monitored. A critical internal application server (APP SERVER) hosts sensitive customer data and is only accessed by a specific administrative workstation (ADMIN WS) for maintenance. All other internal traffic to APP SERVER should be blocked. Which of the following NGFW security policy configuration elements, combined with a best practice, would most effectively enforce this principle, allowing only the ADMIN WS to access APP SERVER on necessary ports, while logging all other attempts?

• A.Create a security policy: Source Zone (Internal), Source Address (ADMIN_WS IP), Destination Zone (Internal), Destination Address (APP_SERVER IP), Application (all), Service (any), Action (Allow). Create a second policy: Source Zone (Internal), Source Address (any), Destination Zone (Internal), Destination Address (APP_SERVER IP), Application (any), Service (any), Action (Deny), Log (yes).
• B.Create a security policy: Source Zone (Internal), Source User (AdminGroup), Destination Zone (Internal), Destination Address (APP_SERVER IP), Application (service-http, ssh), Service (application-default), Action (Allow). Ensure User-ID is enabled.
• C.Create a security policy with a 'Policy-Based Forwarding' rule: Source IP (ADMIN_WS IP), Destination IP (APP SERVER IP), Next Hop (APP_SERVER Gateway). Log all traffic by default on the firewall.
• D.Create a security policy allowing only necessary applications/ports: Source Zone (Internal), Source Address (ADMIN_WS IP), Destination Zone (Internal), Destination Address (APP_SERVER IP), Application (ssh, paloalto-web-gui, specific-app-service), Service (application-default), Action (Allow), Log (Session End). Ensure a default deny rule is in place at the bottom of the policy list.
• E.Implement an 'External Dynamic List' (EDL) containing the ADMIN_WS IP and apply it as the only allowed source for the APP SERVER, while leveraging Threat Prevention and WildFire profiles on the rule.

Comment: *

Name: *

Email: *

Verification: *